Privacy

Privacy and data control

English translation of the Norwegian page. Translation dated 15 October 2026.

This is an English translation provided for convenience. The Norwegian page and the Norwegian privacy policy (personvernerklæring) are the binding versions, and if they differ, the Norwegian text applies.

Where your data lives, and what we do with it.

Søknadsbasen is built in Norway and runs on a server in the EU. This page shows exactly where your data travels, which systems see it, and what we never do. The legal privacy policy is at /en/privacy.

How your data flows

You, where you are: your browser or the PWA. CV data is edited locally and synchronised to the server when you save.
Hetzner Online GmbH, Helsinki, Finland (EU): the app, the database, the login and the files run on our own server. Your data (CVs, cover letters, pipeline) lives here. The database and the login are Supabase, which we run ourselves on the server.
Stripe, Ireland (EU): only for payment. We send no CV data here, only name, email and billing information. Stripe may transfer data to the USA.
Resend, USA: email: receipts, login links and notifications, and replies you send us. Resend processes the emails mainly in the USA.
Anthropic Claude, stored in the USA (only when AI is used): AI generation of cover letters and CV summaries. Receives the text you ask the AI to work on when you use an AI feature, for example an interview invitation you paste in to add an interview round, and an extract of your CV and cover letter when an employer uses AI to assess an application you sent with easy-apply. The employer is then the data controller. Anthropic stores the text in the USA and deletes it as a rule within 30 days. It is not used for training.
PostHog, Frankfurt, Germany (only with consent): page views and clicks, without the text on the page and without keys in the addresses. Only if you say yes in the banner. PostHog is a US company and may process the data in the USA.

In addition, error messages from the server go to Sentry (USA), and your browser fetches fonts and company logos from Google, which then receives your IP address. Everything is in the privacy policy.

What we never do

Always. We let authorised administrators see account details, CVs, applications, AI usage, email and subscription in order to help you. They can open the workspace as you and make agreed changes. CV access in the administration does not store a new copy or change the CV. The data keeps its original retention periods.
Always. We remember your language only when you choose it yourself. A necessary cookie (sb-language) lasts for one year from your last choice. If you are logged in, the language code and the time of the change are also stored on your account until you change the choice or delete the account. The choice is included in the data export. A language link does not change the account setting or the content of your documents.
Always. We match the email address from the free tools against accounts, CV purchases and email preferences for customer support and an overview of sign-ups. The link is not stored separately and gives no consent to tips. Email addresses in older CV checks are standardised to lower case. The original spelling is kept in the same row for rollback and is deleted together with the CV check.
Always. We store customer conversations in the inbox with recipient address, read status, folders and the ID of the administrator who sent the reply. Lookups against a user account are not stored as a separate link. The emails have no fixed deletion deadline yet and are not deleted automatically with the account. If you ask us to, we delete them. When the administrator chooses AI help, the subject, message text and draft are sent to Anthropic. The suggestion is never sent automatically. Anthropic deletes the text as a rule within 30 days and does not use it for training.
Always. We send CV tips and offers after the free tools only if you actively choose it. Up to two emails over 30 days, at least one week apart, without an extra confirmation email. The result and purchases do not require this. Old leads are not signed up. Resend delivers the emails. Unsubscribing requires no account. At the end, or at the first daily clean-up after expiry, the address is removed from the tips sequence. A code, text version, tool, dates, reason for ending and unsubscribe key document the consent for three years, also after account deletion. The sending log is kept for three years. The email list from the free tools has its own retention period. You can object to the documentation.
Never. We never sell CVs, cover letters or contact information to recruitment agencies, data analytics companies or anyone else.
Never. We never use your data to train AI models. Neither our own AI nor third parties'.
Never. We never move your database, login or files out of the EU. Your data is stored in Helsinki, Finland.
Never. We never use marketing cookies or tracking pixels from Meta, Google Ads, TikTok or the like.

Matching and assessment of applications

The match scoring is profiling under Article 4(4) of the GDPR. If you press "Match me" on the jobs page, the AI (Anthropic) extracts keywords from your main CV, and we calculate a score for how well the CV fits each job. The score is also calculated for new jobs that arrive later. It is used only to sort and show jobs for you, no employer sees it, and it is not used for decisions about you.

If you send an application with easy-apply, we calculate how well the CV covers the requirements in the ad, and the employer can ask the AI for an assessment of the application. That is also profiling. The employer is then the data controller, and the terms for employers require that a person assesses the application before a decision that has legal or similarly significant effects for you.

What we always do

Always. We let you download your CVs, applications with messages and interview rounds, tasks and cover letters as one JSON file from your profile, and your CVs as PDFs. At any time, as many times as you want.
Always. We delete your account, content and files the moment you delete the account, stop the subscription in Stripe so you are not charged again, and ask PostHog to delete the person and the events. Backups are taken every day, and the seven most recent are kept, so what you delete may remain there for up to seven days. Invoicing data with us and with Stripe, withdrawal notices and the log of which employers have viewed your profile remain. So do the logs of your email preferences and emails we have sent you, the free periods you have used, with a code instead of the email address, and the login log in Supabase. The privacy policy says for how long.
Always. We send tips and offers by email only if you have said yes, and you can unsubscribe in every email.
Always. We encrypt the traffic between you and us (HTTPS).
Always. We use analytics (PostHog) only if you have said yes in the banner, and let you withdraw it just as easily, with the "Privacy choices" button in the footer.
Always. We count visits to the website without cookies and without storing anything in your browser. The IP address and the browser are used only for a key that changes every day, and are not stored. A separate code from the IP address with the same daily salt limits abuse. The code and the counter exist only in the server's memory until the next minute, and are not stored in the database or passed on. If you enable Global Privacy Control or "Do Not Track" in your browser, we do not count you.
Always. We follow the GDPR. You have the right of access, rectification, erasure, restriction and data portability, and we make it easy to use these rights.
Always. We say who may process data outside the EU/EEA: Anthropic (AI), PostHog (analytics), Resend (email), Stripe (payment) and Sentry (error tracking). The privacy policy shows what each of them receives, and what the transfer is based on. Norwegian privacy requirements are the minimum, not the ambition.

The right to object

You can object at any time to what we do because we have a legitimate interest: the server logs, the counting of visits, when you last visited, the logs of your email preferences and emails we have sent you, the free periods, the gift and the reminder about it, the email list from the free tools, the log of which employers have viewed your profile, the storage of withdrawal notices, emails you have sent us and enquiries from businesses. We then stop, unless we have compelling grounds that override your interests, or need the data for a legal claim. You can always object to direct marketing, such as the tips by email, and then we stop. You also stop the counting of visits yourself, with Global Privacy Control or "Do Not Track" in your browser. Send your objection to marcus@jenshaug.no. Section 8 of the privacy policy has the details.

Who is behind it

Søknadsbasen is run by Marcus Jenshaug as a private individual. No investors, no board, no requirement to monetise user data. The income comes only from what job seekers and employers pay for the service.

Questions about data or privacy? marcus@jenshaug.no.