Privacy Policy
This is a translation for your convenience. If there is any discrepancy, the Lithuanian version prevails. Lithuanian version.
🌐 Language: English
LietuviųEnglishČeštinaDanskDeutschEestiEspañolFrançaisGaeilgeHrvatskiÍslenskaItalianoLatviešuMagyarMaltiNederlandsNorsk (bokmål)PolskiPortuguêsRomânăSlovenčinaSlovenščinaSuomiSvenskaΕλληνικάБългарскиРусскийУкраїнська
Version 2026-10-08
1. Who processes your data
The data controller is [company name, code, address] (“YesRound”, “we”). Contact for privacy matters: privacy@yesround.com.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address, login data | account, login, notifications | performance of a contract (b) |
| CV and the profile built from it (job titles, skills, experience, city, salary expectations) | selecting suitable positions, scores, letters, replies | performance of a contract (b) |
| Application log, statuses, notes, interviews, contacts that you enter | managing your search, reminders, job centre report | performance of a contract (b) |
| Portal notification emails received at your YesRound address | collecting new positions | performance of a contract (b) |
| Gmail access (only if you connect it): permission to read mail, but we read ONLY job portal notifications from known senders (LinkedIn, CV-Online, cvbankas, cv.lt, CV Market and other EU/EEA job portals — StepStone, Indeed, Pracuj.pl, Jobindex, etc.; the full list is available on request); we do not download any other emails. If you yourself enable “Recognise employer replies”, we additionally read emails about your applications (from employers’ application systems, e.g. Greenhouse, Lever, Teamtailor, or with application or interview words in the subject) in order to recognise a confirmation, invitation or rejection; we store only the email’s category and an explanation, not its text. We store an encrypted access token, your Gmail address and email metadata (sender, subject, number of positions found) — we do not store the text of emails | collecting new positions from your job notifications | your consent (a) — withdrawable via “Sources → Gmail → Disconnect” or myaccount.google.com/permissions |
| Payment data (we do not see card data — it is processed by Stripe) | payment, invoices | contract (b), legal obligation (c) |
| LinkedIn contacts export (name, company, job title, profile link; we do not import email addresses) | “who knows you at the company” | your consent (a) — you upload it yourself and delete it with one button; in respect of the contacts — legitimate interest (f) |
| Home address (only the “Travel time” add-on) | calculating travel time | performance of a contract (b) |
| Technical logs (AI request counters, errors) | security, abuse prevention, limits | legitimate interest (f) |
Do not include special category data in your CV (health, religion, political views, personal identification number) — it is not needed for the search. If it is present, we will process it only to the extent that it appears in the text you upload, and we will not use it separately in any way.
Google data. YesRound’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements: we use Gmail data only to extract job postings from job notifications and (if you have enabled it) to recognise the status of your applications; we do not transfer it for advertising or to data brokers, we do not use it to train AI models, and humans do not read it (except at your express request, for a security investigation, or where required by law). The text of portal notifications is transmitted to Anthropic Claude for structuring (see section 3) and is not stored.
3. Artificial intelligence
Letters, CV variants, replies and prompts are written by an AI model (Anthropic Claude) solely from your profile and the text of the job posting. They are auxiliary drafts — check each one. The score (0–100) is calculated by rules, not by AI, and is always shown with the reasons. We take no automated decisions about you that have legal effects (GDPR Art. 22) — we do not take employers’ decisions and we do not assess you on their behalf.
4. Who we share data with
We do not sell data and do not use it for advertising. We use the following processors (under data processing agreements):
- Supabase Inc. — database, login, CV files. EU (Frankfurt); the company is in the USA — standard contractual clauses.
- Vercel Inc. — hosting of the website and server functions. EU (Frankfurt, fra1); the company is in the USA — EU–US Data Privacy Framework / SCCs.
- Anthropic PBC — AI texts (profile from CV, letters, replies, prompts). USA — SCCs; under the commercial API terms, data is not used to train models.
- Stripe Payments Europe Ltd. — payments, invoices. Ireland (EU).
- Postmark (ActiveCampaign LLC) — sending emails and receiving portal notifications. USA — SCCs.
- Hunter (Hunter Web Services SAS) — recruiters’ professional email addresses (only the “Recruiter contacts” add-on). France (EU).
- Google Ireland Ltd. (Maps Platform) — travel time from your home address (only the “Travel time” add-on). Ireland (EU) / USA.
- OpenWeb Ninja (JSearch) — searching for job postings by the job titles and country you are looking for — we do not transfer personal data. USA.
- Careerjet Ltd. — searching for job postings by job title and country; their terms require passing on your IP address and browser type — only when you yourself press “Order” or change the criteria. UK / EU.
- UAB “Verslo žinios” (Rekvizitai.lt) — companies’ financial data (only the “Rekvizitai.lt finances” add-on) — we receive data about companies and do not transfer your data. Lithuania.
Your data reaches employers only when you submit an application (or your enabled Autopilot does so) — to the system they have chosen and subject to their privacy policy.
5. How long we keep data
- Account, profile, CV, applications, contacts, interviews: until you delete your account (in the dashboard “Me → Delete account” — immediately).
- Received portal notification emails (text): 7 days, after which only metadata remains.
- Gmail access token (encrypted) and metadata of notifications read: until you disconnect Gmail or delete your account; the text of emails is not stored.
- AI request counters (for limits): 90 days.
- Recruiter contacts cache: 30 days.
- Travel time cache: 180 days.
- Payment and invoice data (Stripe): 10 years — Law on Accounting.
- Voice rehearsal, prompter: we do not receive or store audio — it is converted into text by your browser’s speech recognition service (Chrome/Edge — under Google/Microsoft terms); we receive only the text, and the prompter’s questions are not stored.
6. Your rights
You may access and download your data (“Me → Download my data”), rectify it, erase it (“Me → Delete account”), restrict processing, object to processing based on legitimate interest, and withdraw consent (e.g. delete LinkedIn contacts). Contact privacy@yesround.com — we reply within 30 days. You may lodge a complaint with the State Data Protection Inspectorate (vdai.lrv.lt).
7. If you are a recruiter or an employer’s representative
If the “Recruiter contacts” add-on is used, we obtain your work email, name and job title from Hunter (publicly available professional data) and show them to a candidate who wishes to approach your company about a job (legitimate interest, GDPR Art. 6(1)(f); information provided under Art. 14). We keep them in the cache for 30 days. You may object or request erasure by writing to privacy@yesround.com — we will add your address to a suppression list.
8. Cookies
We use only strictly necessary cookies for login (Supabase session). We do not use analytics or advertising cookies, so there is no consent banner.
9. Security
Data is held on EU servers and encrypted in transit (TLS) and at rest; access is restricted by row-level security rules — each user sees only their own data. Extension tokens are stored only as a hash.
10. Changes
We will notify you of material changes by email 14 days in advance.