Privacy Policy

Who we are

QNTXL is operated by TODO: legal entity. For anything in this policy - including any request about your data - write to TODO@example.com.

What we collect

If you only browse the site

There are no accounts, no advertising trackers and no third-party analytics. Our host, Cloudflare, keeps standard server logs (IP address, user agent, requested URL, timestamp) for security and traffic measurement, as any web host does. We do not build profiles from them.

If you submit a company

• the company name and careers URL you give us, and any contact email you add;
• a salted hash of your IP address, used to rate-limit submissions and stop abuse. We never store the raw address, and the hash cannot be turned back into one;
• a bot-check token, if Cloudflare Turnstile is enabled on the form. Turnstile may set its own cookies; we only see its verdict.

Submissions are processed automatically - we fetch the pages you point us at, and language models help structure what we find - and then reviewed by a human before publication.

If you are on our staff

The admin area is behind a login, which sets session cookies so you stay signed in. Those cookies exist only for staff accounts.

What we never collect

No CVs, no applications, no candidate profiles. Applying for a job sends you to the employer’s own site, where their privacy policy applies - not ours. Job alerts by email are not offered yet; when they are, subscribing will be a separate, explicit choice.

Cookies and local storage

• Theme preference - stored in your browser’s local storage, not sent to us.
• Staff session cookies - only if you sign in to the admin area.
• Turnstile cookies - only on the company submission form, if the bot check is enabled.

Who processes data for us

• Cloudflare - hosting, CDN and the optional bot check. Requests to this site pass through them.
• Supabase - database hosting. Our project runs in the EU (eu-west-1).
• Language model providers - we send publicly available company career-page text to them to extract structured job data and to verify that a board belongs to a company. That text is employer copy. It may occasionally name individuals (for example a hiring manager in an advert); we do not send anything about visitors or candidates.
• Logo.dev and CARTO - company logos and map tiles. Your browser fetches those directly, so they see your IP address.

Why we are allowed to do this

Under the GDPR we rely on legitimate interests for running a job board and protecting it from abuse - that covers server logs, the salted IP hash and security checks. Where we process anything on the basis of your consent, we ask for it separately and you can withdraw it at any time. Contract terms apply to companies that have an agreement with us.

How long we keep it

Server logs are kept by our host on its standard retention period. Submission records and their IP hashes are kept only as long as we need them to prevent abuse and to keep a record of the decision we made about a company - and we will delete yours on request.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, ask us to restrict or stop processing it, or ask for it in a portable format. Email TODO@example.com and we will respond within the time the law allows. If you are unhappy with our answer, you can complain to your national data protection authority.

Changes to this policy

If we change how we handle data, we will update this page and its date. Material changes will be flagged on the site rather than slipped in quietly.

Contact

TODO: legal entity - TODO@example.com