Privacy policy

Shortlist estimates how likely you are to get an interview for a job posting and suggests truthful changes to your CV. To do that it has to read your CV and the postings you give it. This page says what Shortlist keeps, why, who else sees it, for how long, and what you can do about it.

Who is responsible

Shortlist is run by a private individual, who is responsible for your data (the controller):

cocco
ffrancesco.bonacini@gmail.com

Write to that address about anything on this page.

What Shortlist keeps

• Your account: your Google account's id, email address and name, which Google sends when you sign in. Nothing else from Google: not your contacts, mail or files.
• Your CV: the files you upload (PDF, Word or a LaTeX project), the text read from them, the profile built from that text and any corrections you make. Every upload is kept as a version. A transcript of records is read once to list its courses and is not stored; the courses are kept only if you add them to your profile.
• What you tell Shortlist about yourself: your context, the messages of the context interview, your answers under gaps and requirements, and what you want from a job.
• Jobs: the postings you add or analyze (their text, link and signals such as the number of applicants), their status as you track it, the analyses, and your decisions on the suggested CV changes, including tailored CV versions you save. When you add a job by its link, Shortlist's server fetches that page.
• From the browser extension, if you install and connect it: on LinkedIn, the posting of a job you analyze, and the jobs LinkedIn recommends to you (title, company, location, its LinkedIn id), sent while you browse LinkedIn. While you look at a LinkedIn job, the extension sends its LinkedIn id to Shortlist to show on its icon whether you analyzed it; that check is not stored. To check those recommendations against your profile, Shortlist's server fetches their public posting pages from LinkedIn (at most 60 a day); LinkedIn sees the server's address, not yours. On other sites the extension reads a page only when you ask it to analyze that page, after you allowed it for that site.
• Costs of your use: each call to the AI model made for you, with its size and cost, to run the free trial. An upgrade request keeps your email address and your note.
• Security records: your sessions and extension tokens are stored only as one-way hashes. Your IP address is used to limit sign-in attempts and is held in memory only, never stored.

CVs often hold more than a job needs: a photo, a date of birth, nationality, sometimes health or religion. Shortlist does not need any of that, and you can leave it out. Whatever is in the CV you upload is processed as described here.

Why, and on what basis

• To provide the service you signed up for: storing your CV and jobs, running analyses, the CV editor, the interview. Under the GDPR this is the performance of a contract (Art. 6(1)(b)).
• To keep Shortlist secure and working: limits against abuse, the free trial's budget, error records, backups. This is our legitimate interest (Art. 6(1)(f) GDPR) in running a safe and affordable service.

Shortlist shows no ads, sells nothing about you, uses no analytics or tracking, and never contacts employers. Analyses are estimates for you alone: nobody else sees them and nothing is decided about you with them.

Who else processes your data

• OpenAI (United States) runs the AI model. For each analysis, follow-up, interview message or CV parse, it receives the parts needed: your CV and profile, your context, and the posting. Shortlist asks OpenAI not to store its answers, and OpenAI does not use API data to train its models. OpenAI may keep API data for up to 30 days to detect abuse, then deletes it. The transfer to the United States is covered by OpenAI's data processing terms with the standard contractual clauses.
• Hetzner (Hetzner Online GmbH, Germany) hosts the server, the database, the uploaded files and the encrypted backups, in its Falkenstein data centre in Germany.
• Google handles signing in. Google learns that you signed in to Shortlist, and nothing about your CV or jobs.

Nobody else receives your data, unless the law requires it.

Cookies and storage in your browser

One cookie keeps you signed in, for 30 days or until you sign out; a second one lasts ten minutes while you sign in. Both are needed for the site to work, so no consent banner is shown. The CV editor remembers its layout in your browser's local storage. Nothing else is stored in your browser.

How long it is kept

• Everything above, until you delete it or your account.
• Deleting your account (Settings, “Delete my account”) removes your data and files at once, except: the encrypted backups, which hold it until they expire after 30 days; the cost records of model calls, kept without any link to you; and a one-way hash of your Google account id with how much of the free trial you used, so that signing up again does not start a new trial.
• Error records of the server hold no user id or request contents and are deleted after 30 days.
• The server's logs, which can contain error messages, are rotated: at most 30 MB per part of the service are kept, the oldest overwritten first.

Security

Connections are encrypted (HTTPS). Backups are encrypted, and their key is not on the server. Uploaded LaTeX is compiled in an isolated sandbox without network access. Only the owner can open the admin page, and only from their own address. No system is perfectly secure; if a breach puts you at risk, you will be told.

Your rights

You can, at any time:

• see and download everything Shortlist holds about you: Settings, “Download my data” (a ZIP with your data and files);
• correct it: your CV, profile, context and jobs can be edited in the app;
• delete it: Settings, “Delete my account”;
• object to processing based on legitimate interest, or ask for it to be restricted, by writing to the address above.

You can complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of the country where you live or work.

Age

Shortlist is for people aged 16 or older.

Changes

If this policy changes, the date at the top changes, and changes that matter are announced on the site before they apply. See also the terms of use.