Privacy policy

1 Who is responsible

findjobs.ge is the data controller. Contact: info@findjobs.ge. This policy covers the website, our Telegram bot and channels, our mobile apps, and our emails.

2 What we collect

Job seekers and candidates: name, email, phone (optional), cover letters, CV files; for seeker listings also your age (never shown publicly) and an optional photo (shown publicly).

Sign-in: your email; if you use Sign in with Apple or Google, the email and account identifier they hand us; the public half of every passkey you register and the name of the device it lives on; an authenticator secret if you enrol one; hashed recovery codes. We never hold the private half of a passkey or any password of yours.

Identity verification (optional): if you choose to verify, the document image you upload and three photos of your face taken during the check (looking ahead, left and right, so a person can compare them with the document) are stored encrypted, with the outcome and a one-way hash that prevents duplicate verifications. To save you typing, the document photo is also read once by an AI model running on Cloudflare to pick out its machine-readable lines; that step keeps nothing. We keep the images so a verification can be checked later against what was actually sent; every opening of them is logged, and you can ask us to delete them (see Your rights).

Employers: email, company name, phone, website, and activity on your own listings, including whether and when you opened each application (the applicant is shown that it was seen).

Messages and reviews: your conversation text; review text together with the employment record that makes it verified.

Telegram: your Telegram ID, username, language, and the alerts and account links you set up with the bot.

Payments: see the Payments section below.

Employer contacts from aggregated listings: when a publicly published listing shows a contact address, we store it to attribute the listing, to keep the applications sent to that listing in an inbox on findjobs.ge for that address, to tell the address when an application arrives, and to send the one-time notice described below. We remove it on request. For every notification sent to such an address we keep a delivery record: the address, the time, the mail provider's message id, and whether the message was accepted, delivered, delayed or bounced, plus any reply that comes back through us, and whether the sign-in link in it was opened or used.

The CV builder keeps a draft on your own device and makes the PDF there. When you are signed in, the builder is your profile: what you type there is saved to your profile, is there on your other devices and is the CV the apply form can attach; its import and improve buttons send the CV's text to us and to an AI model (see Automated processing), and a translation is a copy for download that is not saved to your profile.

Automated processing: several features run on AI models: the assistant, translation, the fraud and abuse screen and the other checks on listings, applications and messages, the reader that turns a CV you upload into profile entries and suggested skills, the CV builder's import, improve and translate buttons, the first replies in the support chat and the drafts of our answers to support email, and the writing tools of Pro for job seekers. The text each feature needs (what you type to the assistant, the text of listings, applications, messages and support requests, and the text of a CV you upload or of your profile) may be processed by OpenAI or by Cloudflare Workers AI; which of the two answers can change, for example when one is unavailable. Voice messages are transcribed, and the document photo of an identity check is read, by models running on Cloudflare; neither goes to OpenAI. OpenAI processes this text for us under its API terms, which do not let it train its models on it. Nothing an AI model produces decides anything about you on its own: a person reviews anything the screen holds back, and a draft written for you is only a suggestion until you send it.

The apps: if you allow notifications, the app registers a push token (with Apple on iPhone and Mac, with Google Firebase Cloud Messaging on Android) so alerts can reach that device. The token is tied to your account, dropped when you sign out, and deleted as soon as the network tells us the app is gone. The rating prompt sends us nothing.

Technical: privacy-first traffic counting with no cookies and no per-person profile; a visitor counts once a day via a hash deleted the same day, and known bots are excluded. Standard server logs exist for security. We also publish aggregate traffic figures measured by Cloudflare (visitors and page views per day); they say nothing about any individual.

3 Payments

If you buy Pro, Pro Lite, a promoted listing, a banner, a bump pack, extra listing slots or introduction packs, the payment is taken by Stripe, Inc., which acts as our payment processor. Stripe receives your email address, the amount and the card details you type on its page; card numbers never reach our servers. We keep what we need to run the service and our books: Stripe customer, subscription, session and invoice identifiers, the product bought, the amount and currency, the dates, and refunds or disputes. Banner images you upload are stored with the order and shown publicly while the banner runs. Payment records are kept for as long as accounting law requires, then deleted.

If you take Pro for job seekers, the same applies: Stripe receives your email address, the amount and your card details, and we keep the Stripe identifiers, the amount, the dates and any refund, linked to your job seeker account.

4 What we use it for

Running the board; delivering applications and messages; moderation and fraud prevention; transactional notifications by email and Telegram (application alerts, hire congratulations, unread-application reminders, one review invitation after a hire, at most one reminder for a quiet listing, push notifications in the app if you allow them); the "For you" pick on the board; aggregate statistics; answering support.

Besides the emails about your own account and applications, we email account holders about findjobs.ge itself, tips on using it and offers on our own paid plans, only if they say yes on the email preferences page or take over adverts copied to findjobs.ge, where the page says so beside the button. Each one carries a stop button that asks you to confirm once, and the same page turns each kind off; turning them off never stops the emails about your applications. Our news letter goes only to people who subscribed and confirmed. Separately, when an employer's publicly posted listing shows their own contact address, we may send that employer a few short notices that their listing appears here (so far no address has received more than four), each with a way to remove the listing and a stop button that asks you to confirm once. An opt-out is permanent: an address that asks us to stop is never emailed or listed again, and we delete it entirely on request.

The grounds we rely on, under the Law of Georgia on Personal Data Protection and, where it applies, the GDPR: providing the service you asked for (your account, applications, listings, messages and payments); our legitimate interests in keeping the platform safe, honest and working (security logs, fraud and abuse checks, comparing accounts against ban evasion, aggregate statistics and notices to an address an employer published); your consent, which you can withdraw at any time without affecting what was done before (the identity check, the news letter, tips and offers emails, push notifications); and our legal obligations (accounting and tax records, and answering lawful requests from authorities).

No decision with legal or similarly significant effects on you is made by a machine alone. Automated checks can hold something back for a person to review, and scores such as the fit score or the Highscores rank only order or inform; employers decide whom to hire. You can ask a person to look at any automated result that concerns you.

5 Your application and the employer

When you apply, your application (name, contacts, letter, CV and any answers) is kept on findjobs.ge and shown to the employer only inside their findjobs.ge account, after they sign in. We tell the employer by email that it has arrived. That email carries only the job title and your first name, never your CV, your contact details or your answers.

For a listing copied from a public job advert, your application waits in an inbox on findjobs.ge tied to the contact email printed in that advert, and the notification goes to that address. No one on the employer's side can open it until someone signs in with that address, which proves they control the mailbox the advert published. If nobody ever does, the employer may never read your application.

Your application page shows "Seen by employer" only once the employer has opened your application on findjobs.ge or answered you, and replies reach you through findjobs.ge. You can withdraw an application from its page while the conversation is open. If nobody on the employer's side has opened it yet, it leaves their inbox and is kept only in our archive; if they already opened it, it stays in their inbox, marked as withdrawn.

Why we may do this: you asked us to send your application, so keeping it and showing it to the employer is how we provide the service you requested. Telling the address published in the advert that an application is waiting rests on a legitimate interest, ours and the employer's, in applications reaching the address the advert gave for them, and the email names only the job and your first name so that it reveals as little as possible. The Law of Georgia on Personal Data Protection allows data to be processed on both of these grounds.

An employer who opens or downloads your application becomes responsible in its own right for how it uses it and for any copy it keeps, as our terms set out under Candidate data and employers.

If you send an application with Pro for job seekers to a listing copied from a public job advert, you ask us to send the whole application, including your contact details, answers and CV, to the address the advert gave for applications, with your email as the reply-to address. We do that at your request, which is how we provide the service you paid for. Once it arrives, the recipient is responsible in its own right for how it uses and keeps it. Employers who hire on findjobs.ge see that an application was sent with Pro; nothing about your payment is shared.

If you use the writing tools of Pro for job seekers, the text of your findjobs.ge profile (headline, about, work history, education, skills, languages, licences and certificates, never your email address or phone number) and the text of the listing are sent to OpenAI, which writes the draft. The drafts are kept with your account so you can open them again, and they go to nobody unless you put them in an application yourself.

6 Candidate Highscores

If you have a job seeker account, the applications you send take part in a monthly ranking, Candidate Highscores. Its public page shows the people at the top: only your first name and, if you added one, your profile photo, next to your points and the number of applications you sent this month. Never your surname, email, phone, CV, the jobs you applied to or the employers involved.

The ranking is worked out from what you already do on findjobs.ge: the applications you send, whether you wrote a note or answered the employer's questions, how soon after a listing appeared you applied, and what employers then did (opened your application, answered, shortlisted you, invited you to an interview). Nothing new is collected for it.

When an application goes out in gold (you are in the month's top 10, you hold a Gold Pass from the month before, or you spent a Gold Ticket), the employer sees a gold mark on it, with your rank when it came from the top 10, and it is listed first in their inbox until they open it. The email that tells them about it says it is a gold application and still carries only the job and your first name.

At the end of each month we keep that month's final ranking (your rank, points and number of applications) with your account, so the next month's Gold Pass can be given and employers can see your badges on your applications. We may also email you about your own standing: when you enter or leave the top 10, a weekly summary, the last days of a month and its results. At most one such email a day and three a week, and one tap turns them off without touching the emails about your applications.

You can take yourself off the public board at any time with one switch on the Highscores page. The board then shows "A job seeker" in your place, with no name and no photo, and you keep your rank and your gold. Closing your account removes you from the board completely. Why we may do this: working out your rank and marking gold applications is part of the service you asked for when you applied; showing your first name and photo on the public board rests on our legitimate interest in running the ranking openly, and you can object to it at any moment with that switch.

Employer accounts have a public Responsiveness Score worked out from the timing of their own actions on applications (when they were opened, answered and decided). It names the company, never an applicant. A Pro employer may invite you to apply from the public board: they see only your first name and rank, you get one email, and nothing about you is shared unless you apply. The switch beside “Show my first name and photo” turns invites off at any time.

Bringing friends: every job seeker can share their own link. If you made your account through another job seeker's link, that person sees only numbers: how many friends joined through their link, how many applied this month, and the points that earned them. Never your name, email or photo, or the jobs you applied to. To keep the count fair we check that the two accounts do not belong to the same person, with the same signals we use against fraud. Why: running the ranking you take part in, and our legitimate interest in keeping it honest.

Earning cash (partner programme): if you apply, we use your identity check, your payout details and the programme's records (your link's visits, sign-ups, the payments of the people you brought and your commission) to decide your application, pay you, prevent fraud and meet our legal and tax duties. Payout details are stored encrypted and shown only to the person who pays you. We keep these records for as long as the law requires for accounting and tax, even after you stop. People you bring are never named to you.

Verified employer: if you ask for the check, we receive your company's registration details and formation documents, any director's letter, your ID check and notes of our contact with the company. They are encrypted and kept. Only the people who review them can open them, every opening is recorded, and job seekers and other employers never see them. We may run a document through an AI model to read it in English for the reviewer. A person makes every decision.

7 Who sees your data

Your application is shown only to the employer whose vacancy you applied to, inside their findjobs.ge account (see Your application and the employer). Public listing content is public, including on our Telegram channels and in machine translations. Reviews appear without your name.

Providers that process data for us, each only for its own part: Cloudflare (hosting, the database and storage, email routing, the bot check on forms, voice message transcription, translation and some AI models); OpenAI (the AI features listed under Automated processing); Stripe (payments); Resend and our own mail server in the EU (email delivery); Telegram (the bot and channels, if you use them); Apple (Sign in with Apple, and notifications to the iPhone and Mac apps); Google (Sign in with Google, notifications to the Android app through Firebase Cloud Messaging, address suggestions for employers through Google Maps, the ads described under Cookies, and our backups in Google Drive, which are encrypted before they leave our systems so Google cannot read them); and Photon by Komoot (address suggestions when Google's are unavailable). We never sell personal data. We disclose data to an authority only where the law requires it, and if the platform changes hands, the data passes to the new owner under this policy.

8 Cookies

Cookies we set ourselves, all first-party and none used to build an advertising profile. Sign-in: one for job seekers (fj_cand, 90 days) and one for employers (fj_employer, 30 days), a few that last only minutes while you sign in (fj_sc, fj_ticket, fj_oauth), and security cookies on our staff panel. Preferences: your language (fj_lang, one year), which side of your account you last used (fj_view, one year), the fields of the listings you opened on this device (fj_cats: at most six, 90 days, so the "For you" pick on the board can show similar work; it holds no listing ids and no name), and small markers that you dismissed a reminder or a banner (fj_sec_nudge, fj_svy, fj_fdb, fj_fdn, fj_sfdb), kept only while that reminder is paused. Support: fj_support (30 days), which ties a support chat to your browser so you can come back to it. Security: fj_h, set only when our bot check asked your browser to show it is a browser, and fj_did, the device code described under Security (two years). Attribution: fj_pr, the shared link you arrived through (60 days, so the person who shared it can be credited), and fj_gclid, the Google ad you arrived from (90 days, see below); neither is set for visitors in the European Economic Area, the United Kingdom or Switzerland. Analytics run entirely without cookies, and company pages count their readers for the day without keeping anything on your device.

Your browser also keeps some things in its own storage (local storage, session storage and IndexedDB), and none of it is sent to us on its own: your light or dark theme, which listings you already opened, where you were on the board, unsent drafts of a posting, the CV builder's draft, the details you typed in the application form and the CV you attached there, so your next application is quicker, and whether you dismissed a prompt. You can clear them at any time in your browser's settings.

If you arrive from one of our Google ads, we keep the ad's click id in our own cookie (fj_gclid) and Google sets its conversion cookie, so we can count that the ad led to an application or a posting; we send Google no name, no CV and no email, ad personalization signals are disabled, and visitors who do not come from an ad never load this tag. Visitors in the European Economic Area, the United Kingdom and Switzerland are never served that tag, ad click or not, so there is nothing there to consent to.

Ads: some public pages (the board, listing pages and articles) can carry ads served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. You can opt out of personalized advertising in Google's Ads Settings (https://www.google.com/settings/ads), and out of some third-party vendors' use of cookies for personalized advertising at https://www.aboutads.info. We pass Google no name, no CV and no email. Visitors in the European Economic Area, the United Kingdom and Switzerland, and employers signed in on Pro, are shown no ads at all, and there are never ads in account pages, applications or checkout.

You can block or delete cookies in your browser's settings. Blocking fj_cand or fj_employer signs you out; everything else keeps working without them.

9 Security

Everything travels over TLS. CV files are encrypted at rest (AES-256). Access to personal data is restricted and logged: moderation staff never see candidate documents, and staff accounts require a passkey or one-time code on top of their sign-in. Job seeker accounts are protected by a passkey or an authenticator app on top of the email step, employers can add the same, and sessions expire on their own.

To stop one person from running several accounts, after a ban or to get around the rules, we compare the accounts on the platform with each other. We use the identity check, the card fingerprint Stripe gives us, contact details, Telegram usernames, CV files, a device code our server gives the browser you sign in with (a cookie named fj_did), the phone the app is installed on, the browser type and the network address you sign in from. They are kept as one-way codes. Only the owner of findjobs.ge sees the result, and nothing is decided automatically: a person looks at every case.

10 How long we keep it

Applications and CVs, including an application waiting in an inbox nobody has opened and one you withdrew: we do not delete them on a schedule. They are kept with the listing they were sent to, together with the delivery record of each notification, and six months after a listing leaves the board its applications move to our archive. You can ask us to delete yours at any time (see Your rights). Identity documents and the face photos taken with them: kept encrypted, every opening logged, until you ask us to delete them. Sign-in sessions: 90 days for job seekers, 30 days for employers. Accounts: kept until you ask us to delete your data; a closed account is shut, not deleted. Employment records and reviews: kept while the review is published. Support mail and security logs: kept as long as needed for security and legal obligations. Aggregate traffic counts contain no personal data and are kept.

11 Your rights

Ask for a copy of your data, correct it, delete it, or object to a use: info@findjobs.ge. A person reads the request and carries it out by hand. We answer within ten working days, or tell you within that time why we need up to ten more. You can also withdraw a consent at any time and ask a person to review any automated result about you. Closing your account signs you out everywhere and stops our emails to you, but it deletes nothing by itself: ask us to delete your data and we will, except what the law requires us to keep.

You can also complain to the Personal Data Protection Service of Georgia (personaldata.ge). Visitors from the EEA have the equivalent GDPR rights, including data portability.

12 Children

The platform is for people aged 16 and over. We do not knowingly accept younger users and close such an account when we learn of it.

13 Where data lives

Our infrastructure runs on Cloudflare's global network and a mail server in the EU, so data may be processed outside Georgia. Some providers named above are based in the United States (OpenAI, Stripe, Google, Apple, Resend) or elsewhere outside Georgia and the EU. Those transfers rest on the providers' data protection terms, which include standard contractual clauses, or on being necessary for the service you asked for.

14 Changes

The date above always shows the current version; meaningful changes are announced on the site.

15 Contact

info@findjobs.ge. A person reads every email.