Privacy policy

This version corrects errors in the previous one: where the data is located, how analytics and deletion work, and which providers may process data outside the EU/EEA. It also describes processing that was missing: the candidate profile and contact with employers, easy-apply, the CV check, the purchase of a single CV or a single cover letter, the email list from the free tools, withdrawal notices, tips by email and the logs of email preferences and sendings, free periods and the gift, shared links, organisations, emails you send us, enquiries from businesses, and the contact persons and interview invitations in your applications. New is the counting of visits to the pages on the website, which uses no cookies and stores nothing in the browser.

1. Data controller

The data controller for personal data collected through Søknadsbasen is Marcus Jenshaug, Holmestrandgaten 1a, 3112 Tønsberg. Contact: marcus@jenshaug.no.

2. What data we collect

We collect the following categories of personal data:

• Account details: name, email address, password (hashed via Supabase Auth, which we run ourselves).
• Profile and CV content: education, work experience, skills, references, profile picture, cover letters and other content you enter yourself.
• Job application data: jobs you track, companies, deadlines, notes and follow-ups.
• Contact persons at employers: name, role, email address and phone number you enter in your applications, and the interview invitations you paste in.
• Use of the service: when you last visited and last logged in, and how far you have come with your CV and applications.
• Your email preferences: what you have said yes and no to, and which emails we have sent you.
• Free periods: codes calculated from your email address and your card, and the dates of trials, gifts and free months.
• Candidate profile and contact with employers, only if you make the profile visible: headline, county, industry, experience and skills, contact requests and messages.
• Applications you send with easy-apply: a copy of the CV, the cover letter and the answers to the questions in the ad.
• Shared links and collaboration: the links you create, how many times the CV link has been opened, and the names and suggestions from those you invite to help you.
• Organisation: which organisation you are a member of, your role, and whether you share data with it.
• The CV check and the purchase of a single CV or a single cover letter: the CV text, the result, the email address and what you buy.
• The email address you provide in the free tools when you use them without an account.
• The gift after the move in October 2026: the email address it was given to.
• Withdrawal notices: what you write when you withdraw from a purchase, and what we do with the case (see section 3).
• Emails you send us, and our replies.
• Contact persons in businesses that enquire about Søknadsbasen: name, email address, phone number, position and the message.
• Payment details: card numbers and payment details are never stored with us, they are handled by Stripe (see section 6). We store only the Stripe customer ID, the subscription status and the renewal date.
• Technical data: IP address, browser type and device type may end up in the server logs, and in error messages that go to Sentry.
• Visits to the website: which page you view, which website linked here, the campaign parameters (utm) in the address and whether you use a mobile or a computer, together with a key that changes every day. Your IP address and browser are used to create the key, but are not stored. Applies to the pages on the website, not the app.
• Analytics data, only if you consent: which pages you visit, which buttons and links you click (without the text on them), and when you register, log in or download a PDF. With this come browser, operating system, screen size and approximate location, calculated from the IP address. The events are linked to a random ID in your browser, and to your user ID when you are logged in. The addresses are sent without the keys to shared documents and without anything else from the query string than campaign parameters (utm). The IP address is not stored, and the content of your CV and applications is never sent.

What you have to provide. To create an account you must provide a name, an email address and a password, and confirm the email address. No law requires this, but without them we cannot give you an account you can log in to, and then you cannot use the app. If you use the CV check, the cover letter generator or the job match without an account, you must provide an email address to see the result. If you buy something, Stripe requires your email address and payment details. Everything else you enter is voluntary, but without it we cannot build your CV or follow up your applications for you.

3. Purposes, legal bases, retention and recipients

The legal bases refer to Article 6(1) of the GDPR. Section 4 explains what happens when you delete your account, and section 6 who the recipients are.

• Your language choice: when you expressly choose a language, we remember the language code in a necessary cookie (sb-language) in this browser. If you are logged in, we also store the language code and the time of the last change on your account, so the choice can be used on other devices. Opening a language link does not change the account setting and does not translate your documents. Legal basis: letter b, contract: delivering the service in the language you choose. How long: the cookie lasts one year from your last language choice, or until you delete it in the browser. The account setting is stored until you choose another language or delete the account. Recipients: Hetzner Online GmbH.
• Help with your account and content: authorised administrators can see contact details, stored CVs, applications, AI usage, emails in the inbox and your subscription in order to help you. When needed they can open the workspace as you and make agreed changes. CV access in the administration does not change the CV. Legal basis: letter b, contract, when we help you with the service. How long: the access creates no separate copy of the content. The data follows the retention periods for the account, AI usage, emails and invoicing in this overview. Recipients: authorised administrators at Søknadsbasen, Hetzner Online GmbH, and Stripe for the subscription.
• Delivering the service: the account, the CVs, the cover letters and the applications you follow up, the AI features when you use them, and the match scoring, which gives jobs a score based on your main CV when you have asked for it. Legal basis: letter b, contract. How long: until you delete the account. Recipients: Hetzner Online GmbH, and Anthropic when you use AI.
• Contact persons and interview invitations in your applications: if you add a contact person at an employer, we store the name, role, email address and phone number you enter, on the application and on the interview round. If you paste in an invitation, the text is sent to Anthropic, which reads out the time, the format, the meeting link and the contact person. Nothing is stored until you have checked it and added the round, and then the invitation is stored as a message in the timeline. The contact person also appears in the messages the AI writes for you. Legal basis: letter f, legitimate interest: you need to know who you have been in contact with to follow up the application, and we need it to help you with that. How long: until you delete the contact person, the message, the round, the application or the account. Recipients: Hetzner Online GmbH, and Anthropic when you paste in an invitation or let the AI write a message.
• Invoicing and payment handling. Legal basis: letter b, contract, and letter c, legal obligation. How long: invoicing data for five years after the financial year (the Norwegian Bookkeeping Act, section 13), also after the account has been deleted. Recipients: Stripe.
• Security, troubleshooting and abuse prevention: server logs and error messages. Legal basis: letter f, legitimate interest. How long: no fixed deletion deadline yet. Recipients: Hetzner Online GmbH, Sentry.
• Email belonging to the account and the agreement: confirmation of the email address, login and new password, the welcome, receipts and notices about the subscription. Legal basis: letter b, contract. The confirmation after a purchase: letter c, legal obligation. How long: the content is not stored. Which emails we have sent is in the email log (see below). Recipients: Resend.
• Tips by email, only if you have said yes: tips about your job search, adapted to what you do in the app, and occasionally an offer on Pro, at most one a week. We use your name, when you last visited and last logged in, whether the CV has been entered and when it was last changed, jobs and letters you have saved, how many applications you have sent, and the municipality in your job preferences. Legal basis: letter a, consent. How long: until you withdraw the consent. If you have not visited for a long time and do not reply when we ask whether you want to continue, the consent expires. Recipients: Resend.
• When you last visited: the time of the first visit on the last day you visited while logged in. We use it for simple usage statistics, to choose tips when you have said yes to them, and to see whether you can get a free month (see free periods below). Legal basis: letter f, legitimate interest in running and improving the service. How long: as long as you have an account. Recipients: none.
• Log of your email preferences: what you have said yes and no to, when, where in the app or from which email, and which consent text you saw. The choice in the registration form is first stored with a code calculated from the email address, and moved to the account when the address is confirmed. Legal basis: letter f, legitimate interest in being able to show what you have consented to (GDPR Article 7(1)). How long: as long as the consent applies, and three years after you withdrew it or deleted the account. After deletion, only a code calculated from the email address remains, not the address itself. A choice from registration that is never moved to an account is deleted after 14 days. Recipients: none.
• Log of emails we have sent you: which email it was (the template and the version), when it was sent, whether it arrived, and when you first visited afterwards, which shows whether the email was useful. The content is not stored. Legal basis: letter f, legitimate interest in the same email not going out twice, in keeping the pace we have promised, and in seeing whether the emails are useful. How long: tips and notifications for three years, other emails for 13 months. If you delete the account, only a code calculated from the email address remains. Recipients: none.
• Product and usage analytics with PostHog: to understand how the service is used and make it better (only with consent). Legal basis: letter a, consent. How long: see section 4: PostHog does not delete by itself. Recipients: PostHog.
• Counting of visits: to see how many people visit the pages on the website, which pages they view and where they come from. Your IP address and browser are used only in memory to create a key that changes every day, and are never stored. We store the page, where you came from (the website that linked here and the campaign parameters in the address), whether you use a mobile or a computer, and the key. To prevent artificial inflation of the numbers, we also use a separate code from the IP address with the same daily salt. This code and the counter exist only in the server's memory until the next minute, and are not passed on or stored in the database. The counting uses no cookies and stores nothing in your browser. Legal basis: letter f, legitimate interest in knowing how many people use the website, where they come from, and in protecting the counting against abuse. How long: the salt the key is made with is deleted at the first visit after midnight, and no later than 02:15 the same night. Without the salt, the key cannot be linked to anyone. The page views are deleted when they are 13 months old. Recipients: none.
• Visible candidate profile: only if you turn it on: headline, county, industry, experience and skills are shown without a name to employers who use Søknadsbasen. The profile is shown only while you have Pro. Legal basis: letter a, consent. How long: until you hide or delete the profile, or delete the account. A hidden profile is shown to no one, but is stored until you delete it. Recipients: employers with an account with us, without name and contact details.
• Contact requests and unlocking: an employer asks for contact, and you get a notification in the app and by email. If you accept, or have turned on automatic approval, the employer gets your name, email address and CV, and you can message each other. Legal basis: letter a, consent, to the visible profile and to each request you accept. The log: letter f, legitimate interest in being able to show who has been given access. How long: the requests and unlockings are deleted when you delete the candidate profile or the account, the messages when you delete the account. A log of which employers have viewed, contacted or unlocked your profile remains with your user ID, but without name and email. Recipients: the employer, which is itself the data controller for what it receives. Resend sends the email notification.
• Applications with easy-apply: we send the employer a copy of the CV, the cover letter and the answers to the questions in the ad, and calculate how well the CV covers the requirements in the ad. Legal basis: letter b, contract: you ask us to send the application. The employer becomes an independent data controller for the application it receives. How long: with the employer in Søknadsbasen until the job or the employer account is deleted, or until you delete your account. If the employer has downloaded the CV, the employer's own routines apply to that copy. Recipients: the employer. If the employer uses AI to assess the application, an extract of the CV and the cover letter goes to Anthropic, and the employer is then the data controller.
• Shared links and collaboration: if you create a link to your CV or your job search, anyone with the link can see what you share, and for the CV link we count how many times it has been opened. If you invite someone to help you with your CV, a letter or an application, we store the name the helper provides and the suggestions the helper makes. Legal basis: letter b, contract: you ask us to share. The name the helper provides: letter f, legitimate interest in showing you who the suggestions come from. How long: the links and invitations, with the names and suggestions from the helpers, are stored until you delete the account. A link you have stopped shows nothing. Recipients: those you give the link to.
• Organisations: if you get Søknadsbasen through an organisation, for example a career centre, its administrators see your name, email address and profile picture, and whether you share data with the organisation. If you turn on sharing ("Share data with" and the name of the organisation), they also see your applications (employer, position, status and dates) and the titles of your CVs. Legal basis: letter b, contract, for the membership. Letter a, consent, for the sharing, which you can turn off at any time. How long: until you are no longer a member of the organisation, or delete the account. Recipients: the administrators in the organisation, which is itself the data controller for what it receives.
• The CV check: AI analyses the CV you paste in or upload, and gives a score and suggestions. If you only view the analysis without an account, we do not store the CV, only the email address (see the email list below). With an account, the CV text and the result are stored on the account. The email address is standardised to lower case. In the correction of older rows on 13 October 2026, the old spelling is kept in the same row, only to be able to undo the correction without data loss. It is deleted together with the CV check. Legal basis: letter b, contract: you ask for the analysis. How long: until you delete the account. Recipients: Anthropic.
• Creating and delivering a single CV or a single cover letter you buy for NOK 99: if you proceed to payment, we store the CV text, the result and the PDF you uploaded, or the job and the letter, the email address if you have provided it, and a secret link you download with. This is stored before you pay, and remains also if you do not complete the payment. Legal basis: letter b, contract, and letter c, legal obligation for the accounts. How long: no fixed deletion deadline yet, not even for what was stored without you paying. If you ask us to, we delete it. If you create an account with the same email address, a purchased CV is linked to the account and deleted with it. The payment is accounting material for five years after the financial year. Recipients: Stripe, Resend and Anthropic.
• The email list from the free tools: if you use the CV check, the cover letter generator or the job match without an account, we store the email address, which tool you used and some of the result, such as the score and the job you were aiming for. We use it to monitor how the tools are used, and send no marketing to it without your consent. Legal basis: letter f, legitimate interest. How long: no fixed deletion deadline yet. If you ask us to, we delete the address. Recipients: none.
• Voluntary CV tips and offers after the free tools: if you choose CV tips and offers yourself in the CV check, the cover letter generator or the job match, we may send up to two emails about CVs, job hunting and our paid services. At least one week passes between the emails. The result and any purchases do not require marketing consent. We send no extra confirmation email and do not sign up old leads. The sequence stops on registration, unsubscribing, a known email block or after 30 days. A tool choice does not change the email preferences on an existing account. Legal basis: letter a, consent, for the tips. Letter f, legitimate interest in documenting consent and unsubscribing under Article 7(1), for the log. How long: the address in the tips sequence is removed when the sequence ends, or at the first daily clean-up after 30 days. A code calculated from the address, tool, text version, dates, reason for ending and unsubscribe key is kept for three years after ending or expiry. The sending log is kept for three years. This is independent of the email list from the free tools, and the documentation may remain after account deletion. Recipients: Resend for sending, authorised administrators with us for customer support.
• Account matches and follow-up status for the free tools: administrators match the email address from the free tool against registered accounts, CV purchases, access and email preferences. This shows whether you have created an account and whether the existing tips sequence can consider a follow-up. Upper and lower case count as the same, but addresses are not merged based on plus signs or email provider. The matching does not sign you up for email and creates no new CV. Legal basis: letter f, legitimate interest in customer support and in understanding the transition from free tools to an account. The tips themselves require consent under letter a. How long: the matching is calculated when the administration is opened and is not stored as a separate customer link. The data keeps the retention periods for the account, free tools, CV purchases and email preferences. Recipients: authorised administrators with us, no new external recipient.
• Free periods and offers of a free month: when you get a trial, a gift or a free month, we store a code calculated from your email address, which type of free period it was, and when it started and ended. If you are offered a free month when you cancel, we also store a code calculated from the card's fingerprint at Stripe, so the same card is not offered it again within a year. The codes are HMAC-SHA256 with a secret key, and the address is not in the log. Before the code is calculated, we convert the address to lower case and remove everything from + to @, and full stops in Gmail addresses. Who is offered it is decided automatically by fixed rules, based on when you last visited, whether you have paid for Pro before, and which free periods you have had, and it has no legal effect for you. Legal basis: letter f, legitimate interest in preventing the same person from getting free periods several times, for example with new accounts. How long: as long as you have an account. The card code is deleted one year after the offer. If you delete the account, only the code, the type and the dates of free periods you have used remain, for 24 months after the period ended. Offers you did not use are deleted after 13 months, and when the account is deleted. Recipients: Stripe, for the discount when you get the next month free instead of cancelling.
• The gift after the move in October 2026: for those who lost their account or could not get in after we moved the service: the email address the gift was given to, why, when it was redeemed and how long it lasts. If you have not redeemed it, you get one reminder by email in November 2026. Legal basis: letter f, legitimate interest in giving what we promised, and in reminding you once. How long: 30 days after the gift has been used up or has expired. If you delete the account, the gift is deleted immediately. Recipients: Resend.
• Withdrawal notices: when you withdraw from a purchase, on the form, by email or by letter, we store the name, email address, what the notice concerns, the purchase date, your comment and when the notice arrived, the link to your account, the status of the case, our notes and the IDs for the refund and the subscription in Stripe. The IP address is stored only as an HMAC hash, to limit how many notices can be sent per day. Legal basis: letter c, legal obligation (the Right of Withdrawal Act, section 20 third paragraph and section 24), to receive, acknowledge and refund. Letter f, legitimate interest, for keeping the notice and for the IP hash. How long: three years after the case is closed, because the general limitation period is three years (the Norwegian Limitation Act, section 2). The IP hash is deleted once a day has passed, the next time someone sends the form or we open the overview of notices. If you delete the account, the notice remains without the link to the account. Recipients: Resend, Stripe, Hetzner Online GmbH and the email provider for marcus@jenshaug.no.
• Emails you send us: emails to an address at soknadsbasen.no, for example replies to our emails, are stored with sender, recipient, subject and the full text in our inbox, together with the replies we send from there. We store read or unread, starring, folder, whether the message is automatic, the provider's message ID and which administrator sent a reply. The email address is matched against account and access when the administrator opens the message, without storing a separate customer link. Legal basis: letter f, legitimate interest in replying and following up. If the enquiry concerns the agreement with you, also letter b. How long: no fixed deletion deadline yet. The emails are not deleted when you delete the account. The same applies to the administrator ID on sent replies. The account lookup is not stored. If you ask us to, we delete the emails. Recipients: Resend, which receives and sends the emails, and authorised administrators with us.
• AI help with replies in the inbox: when an administrator asks for a suggested reply, the subject, the text version of the email and the administrator's draft are sent to Anthropic. The suggestion must be checked by the administrator and is never sent automatically. Legal basis: letter f, legitimate interest in giving useful and efficient customer support. How long: the suggestion is not stored separately with us. If the administrator sends it, it follows the retention period for emails you send us. Anthropic stores the content in the USA and deletes it as a rule within 30 days. The content is not used for training. Recipients: Anthropic and the administrator who asked for the suggestion.
• Enquiries from businesses: if a business asks about Søknadsbasen, we store the name, email address and phone number of the contact person, the position, the name of the business, the message and the notes from the follow-up. Legal basis: letter f, legitimate interest in answering the enquiry and selling the service to businesses. How long: no fixed deletion deadline yet. If you ask us to, we delete the data. Recipients: sales representatives who follow up businesses for us, and Resend, which sends the notification of the enquiry.

About the tips. The tips are chosen automatically based on what you have done in the app, for example whether the CV has been entered and when you last visited. The selection has no legal effect for you and does not affect your access. You can unsubscribe in every email and on the page for email preferences in the app.

4. How long we keep data

• Active account: as long as you have an account with us.

• When you delete the account: the account, the CVs, the applications, the cover letters, the CV checks, the files, the shared links, memberships in organisations and the gift are deleted immediately. If you have a subscription, we stop it in Stripe, so you are not charged again, and we ask PostHog to delete the person and the events. This remains, and the list in section 3 says for how long:

  • invoicing data with us, and the customer and invoice details with Stripe,
  • withdrawal notices, without the link to the account,
  • the log of which employers have viewed, contacted or unlocked your profile, with the user ID, but without name and email,
  • the logs of your email preferences and emails we have sent you, with a code calculated from the email address instead of the address,
  • free periods you have used, as a code and dates,
  • documentation of tool tips and unsubscribing, as a code, text version and dates, for three years after the tips sequence ends or expires,
  • the login log in Supabase, with the email address and the IP addresses you have logged in from. It has no fixed deletion deadline yet.

  What is not linked to the account, we delete when you ask us to: the email list from the free tools, purchases you made without an account, emails you have sent us, our replies with the administrator ID, and enquiries from businesses.

• Backups: Hetzner Online GmbH takes a backup of the server every day, and the database is backed up every day with Coolify, which we run the server with. Both keep the seven most recent copies. What you delete may therefore remain in a backup for up to seven days.

• Invoicing data: kept for 5 years under the Norwegian Bookkeeping Act, section 13, even if the account is deleted.

• Server logs and error messages: we have not yet set a fixed deletion deadline for the server logs or for the error messages in Sentry.

• The counting of visits: the salt the key is made with is deleted when the day is over, and then the key cannot be linked to anyone. The page views are deleted when they are 13 months old. They are not linked to the account and are not affected by you deleting it.

• Analytics data in PostHog: PostHog does not delete the events by itself. On the free plan, which we use, PostHog only shows events from the last year, but older events are not deleted for that reason. If you delete the account, we ask PostHog to delete the person and the events. Otherwise we delete them when you ask us to. If you withdraw your consent, nothing more is sent.

• Text sent to the AI features: Anthropic deletes it as a rule within 30 days. If it is flagged for a breach of Anthropic's usage policies, it may be stored for up to two years, and it may be stored longer when the law requires it.

5. Where the data is stored

The app, the database and the files run on one server at Hetzner Online GmbH (Germany), in the data centre in Helsinki, Finland. That is where your account, CVs, cover letters and applications are.

Analytics data, only with consent, is stored at PostHog Cloud EU on servers in Frankfurt, Germany.

Some providers are US companies or have operations outside the EU/EEA, and data may then be processed there: Anthropic (AI), PostHog (analytics), Resend (email), Stripe (payment) and Sentry (error tracking). Google receives your IP address when the browser fetches fonts and company logos. Section 6 shows what each of them receives, where they process it, and what the transfer is based on.

6. Data processors and other recipients

These data processors process personal data on our behalf:

• Hetzner Online GmbH (Germany): operation of the app, the database and the files, on one server in the data centre in Helsinki, Finland, and the daily backups of the server.
• Stripe Payments Europe, Limited (Ireland): payment. Card numbers and payment details go straight to Stripe and are never stored with us. Stripe is certified as a PCI Service Provider Level 1. Stripe also processes data for its own purposes, for example to detect and prevent fraud, and is then itself the data controller. Stripe may transfer data to the USA, and this is based on the EU-US Data Privacy Framework and the EU standard contractual clauses.
• Plus Five Five, Inc. (Resend, USA): sends and receives email, such as receipts, login links, notifications, tips you have said yes to, and replies to our emails. Resend processes the data mainly in the USA. The transfer is based on the EU-US Data Privacy Framework and the EU standard contractual clauses.
• Anthropic Ireland, Limited (Ireland): optional AI assistance (CV improvement, job analysis, cover letters, the CV check, and invitations and messages when you follow up an application). The text is sent when you use an AI feature yourself, and when an employer you have applied to with easy-apply uses AI to assess your application. An extract of the CV and the cover letter is then sent, and the employer is the data controller for it. Anthropic stores the data in the USA and may process it in the USA, Europe, Asia and Australia. The text is deleted as a rule within 30 days (see section 4) and is not used to train AI models. The transfer is based on the EU standard contractual clauses.
• PostHog, Inc. (USA), PostHog Cloud EU: product and usage analytics, only if you consent in the banner. The data is stored on servers in Frankfurt, Germany, but PostHog may process it in the USA and in other countries where the company or its subprocessors operate. The transfer is based on the EU-US Data Privacy Framework. Section 2 says what is collected, and section 9 how you withdraw your consent.
• Functional Software, Inc. (Sentry, USA): error tracking. When something fails on the server, the error message may be sent to Sentry, and it may in some cases contain personal data. Sentry may store and process the data in the USA. The transfer is based on the EU-US Data Privacy Framework.
• The email provider for marcus@jenshaug.no: receives emails you send us, and the notifications of new withdrawal notices.
• Sales representatives who follow up businesses for us: receive the enquiries from businesses, with the name, email address and phone number of the contact person and the message.

If you want a copy of the EU standard contractual clauses that the transfers are based on, you can ask for it at marcus@jenshaug.no.

These also receive data, but do not process it on our behalf:

• Employers who use Søknadsbasen: receive the anonymous candidate profile if you have made it visible, your name, email address and CV when you accept a contact request, and the applications you send with easy-apply. The employer is itself the data controller for what it receives.
• Organisations you are a member of: the administrators see your name, email address and profile picture, and your applications and the titles of your CVs if you have turned on sharing. The organisation is itself the data controller for what it receives.
• Those you share links with: anyone with a link you have created can see what you share, until you stop the link.
• Google: the fonts in the CV templates are fetched from Google Fonts, and the company logos on jobs and applications are fetched from a service at Google. Your browser then sends your IP address to Google, and for the logos also the address of the employer's website. Google states that Google Fonts does not set cookies and does not use the data to build profiles or for targeted advertising. Google may process the data on servers in countries other than Norway.
• The push service in your browser: if you turn on push notifications, the notifications go via the push service to your browser or phone. The content is encrypted, so only your device can read it.

We never sell personal data on and do not use it for third-party marketing.

7. Your rights

You have the right to:

• access the data we hold about you,
• have incorrect data corrected,
• have the account and associated data deleted,
• have the processing restricted, for example while we check whether data you believe is wrong is correct, or while we consider an objection from you (Article 18),
• download your data in a readable format (data portability),
• withdraw consent to analytics, tips by email, a visible candidate profile and sharing with an organisation at any time, without this affecting the lawfulness of what happened before,
• complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

Contact us at marcus@jenshaug.no to exercise your rights. We reply without undue delay, and no later than one month after we received your request. If the matter is extensive, or we receive many requests, the deadline may be extended by up to two months, and we will then let you know within a month.

You change the consent to analytics yourself with "Privacy choices" (see section 9). You unsubscribe from tips by email with the link at the bottom of every email, or on the page for email preferences in the app. Tool tips without an account have their own unsubscribe link in every email and require no login. You change visibility to employers under "Visible to companies" in the menu in the app, where you can also delete the candidate profile. You turn off sharing with an organisation under "My organisation".

8. The right to object

You can object at any time to processing we do because we have a legitimate interest (Article 6(1)(f)), on grounds relating to your particular situation. This applies to server logs and troubleshooting, the counting of visits, when you last visited, the logs of your email preferences and emails we have sent you, the free periods, the gift and the reminder about it, the email list from the free tools, the matching of account matches and follow-up status for the tools, the log of which employers have viewed your profile, the storage of withdrawal notices, the name a helper provides, emails you have sent us, AI help with replies in the inbox, enquiries from businesses, and your name and role when a user has entered you as a contact person in an application. We then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend a legal claim (Article 21(1)).

You can also stop the counting of visits yourself, without anything being stored on your device: if you enable Global Privacy Control or "Do Not Track" in your browser, we do not count your visits.

If we process data about you for direct marketing, such as the tips by email, you can always object, and then we stop (Article 21(2) and (3)). The link at the bottom of every email is enough.

Send your objection to marcus@jenshaug.no.

9. Cookies

We use technical cookies that are necessary for login and session handling. In the payment field, in the checkout for Pro and when an organisation changes its card, Stripe uses cookies and your IP address to prevent fraud. Your choice in the consent banner is stored in the browser. Analytics (PostHog) stores a cookie and an ID in the browser only after you have consented in the banner. We do not use third-party marketing cookies.

The counting of visits (see section 3) uses no cookies and stores nothing in your browser. It is therefore not part of the consent choice.

You can change your choice at any time, as easily as you gave it, with the "Privacy choices" button. It is in the footer on the pages on the website, such as the front page, the prices and the guides. In the app it is on the profile page under Privacy: tap your name at the bottom of the menu, or "You" on mobile.

If you withdraw your consent, the analytics stop immediately, and PostHog's cookie and the IDs in the browser are deleted, also in other tabs you have open. If you give consent again later, you get new IDs. The only thing that remains is that you have said no, so you are not asked again. The choice applies to the browser you are using.

10. Security

All communication is encrypted with TLS. Passwords are stored hashed (never in plain text). Servers are located in secure data centres in the EU/EEA.

11. Changes to this policy

We may update this policy when the service or the law changes. Material changes are announced by email at least 14 days in advance. The current version is always available on this page.

12. Contact

Questions about privacy or general contact: marcus@jenshaug.no.