Privacy Policy

Who is responsible for your data

The data controller under the GDPR is Oleksii Nikitenko, sole proprietor (jednoosobowa działalność gospodarcza), Poland.

For any question about your data, including exercising your rights, write to support@it-community.io.

What we keep

Only what the platform needs to work:

• account data: e-mail, name, your password, which we store only as a strong hash, language and settings;
• your date of birth and phone number, which we ask for at sign-up, and, if you give them, your gender and nationality;
• if you sign in with Google or LinkedIn: your ID with that service, and the name and e-mail from your profile there;
• your profile: photo, headline, experience, projects, education, skills, languages, hobbies, links, city, and any contacts you choose to add;
• your candidate card: salary expectations, availability, work format, and the companies you have hidden it from;
• your short card, your CV and any other files and images you upload;
• applications to vacancies, event requests and registrations, messages in conversations and files in them;
• saves, follows, likes, comments and notifications;
• reports you send, and the people and senders you have blocked;
• for company members: your role in the company, work e-mail, internal notes on applications;
• if you ask to add a company or run its page: the company, your position in it, a work e-mail on its domain and the support conversation about the request;
• a connected Cal.com calendar: encrypted access keys and booking settings;
• technical data: IP address, browser type, request times, error and security logs;
• view statistics for profiles, candidate cards, company pages, vacancies and events, and impressions of vacancy cards and ads.

We do not ask for or collect special categories of data such as health or religion. Please do not put them in your profile or messages unless you want others to see them.

Early access

If you sign up for early access on it-community.io, we keep:

• your first name, last name and e-mail;
• for companies: the company name and, if you gave it, its size;
• whom you sign up as - a professional or a company, the page's language, when you signed up and when you confirmed the address;
• the result of our check: whether the name looks made up, and how many days old the mail domain is;
• the IP address the form was sent from, to stop abuse (kept for up to 90 days).

We need this to confirm your address, to write to you when the beta opens and to weed out made-up sign-ups. We do not add it to newsletters and never sell it. Signing up does not create an account on the platform.

Give your real name and an address of your own that you keep. We check every sign-up: an AI model judges the first name, last name and company name (see «AI features»), and we look up when the mail domain was registered in the public domain registry. The result is only a mark for our team: a person decides, and nothing is refused automatically. We may delete sign-ups with made-up details or a temporary mailbox, or block the address or the domain: a blocked sign-up stays with us marked as blocked, and a blocked address can neither sign up again nor register on the platform.

Why, and on what legal basis

Each use of your data has a basis under Article 6 GDPR:

Where the basis is legitimate interest, you can object to the processing (see «Your rights»).

Who sees what

• Professional profile: a new profile is visible only to you. You choose whether it is listed in the people catalogue and search, available by link only, or visible to nobody. E-mail, phone, age, gender and nationality stay hidden until you switch them on; individual sections can be hidden too.
• Candidate card: in «Anonymous» mode company members see your experience, skills, languages, city, salary expectations and work format under a code, without your name, photo or contacts. In «Open» mode they also see your name, photo and a link to your profile. In «Off» mode the card is not in search. Companies you have hidden it from, and the company you work for yourself, do not see it.
• Applications: with a named application, the company sees your profile and skills. An anonymous application shows only the anonymous card and your message, without files. The company gets your name, contacts and files when you press «Reveal contacts».
• A company's candidate base: company members see the people who applied to its vacancies or whom the company contacted, to the extent you have revealed.
• Conversations: only the sides see them, that is you and the members of the company or organiser who work on that application or event. A company's internal notes are seen only by its members.
• Events: the organiser sees who registered or sent a request.
• Companies: members see each other, and their company's vacancies, events and applications according to their role.
• Short card: anyone with the link can see it.

E-mail

We use your e-mail address only for service messages: confirming your account, resetting your password, confirming a new sign-in address, company invitations, confirming a work e-mail and our decision on a company request. Notifications about applications, requests and messages appear on the platform. We do not send newsletters or ads.

If you signed up for early access, we send an e-mail to confirm the address, a welcome e-mail with a how-to once you confirm it, and then one e-mail when the beta opens.

E-mails are sent through our own mail server, hosted by Hetzner in Finland.

View statistics and advertising

We count views of profiles, candidate cards, company pages, vacancies and events, and how often vacancy cards are shown in lists, so their authors can see statistics: how many views there were in a day, a week or a month. The author sees numbers, not a list of people. Viewing your own page is not counted.

So one person is not counted twice, we use your account when you are signed in, and otherwise a random browser session key or a hash of your IP address and browser made with a secret salt, from which the IP cannot be recovered.

Ads on the platform are the same for everyone and are not chosen based on your data. We only count impressions and clicks, one impression per person per day, using the same hash.

AI features

AI features run only when you press the button. Then we send the model only the text it needs:

• filling in a vacancy or event from a document: the text of the document you pasted or uploaded;
• the first message of an application: the vacancy text and, from your profile, your headline, years of experience, city, skills with years and languages, without your name or contacts;
• reply suggestions: the latest messages of the conversation you have open;
• profile fill («Highlights», «About»): the headline, «About», experience, projects, education, certifications, languages and tags from your profile, and your gender if you gave it - only to get the grammar right; no name or contacts. Up to 10 times a day for each;
• filling in your profile from a CV: the text of the file you uploaded; we do not keep the file itself, and the result is written only after you have looked it over and confirmed. Up to 5 times a day;
• a note to a vacancy or an event invitation you send to a person: the vacancy or event text and, from that person's profile, the headline, years of experience, city and skills, without the name or contacts. The sender presses the button, so your profile data can reach the model when a company or organiser drafts a proposal to you. Up to 30 times a day;
• «Improve the vacancy»: the vacancy's title, level, tags, work format, description, stack and interview process; we keep the model's answer with the vacancy until its text changes. Up to 10 times a day;
• a company's «Highlights»: facts from the company page (description, size, offices, tags). Up to 10 times a day.

One check runs without a button: when you sign up for early access, we send the model your first name, last name and, for companies, the company name, to judge whether they look real. The model does not get your e-mail. We keep its short answer as a mark on the sign-up (see «Early access»).

The request goes to OpenRouter, a service that passes it on to the model provider; currently that is Anthropic's Claude model. Both companies are based in the United States. The model's answer comes back only to you, and we do not keep it separately unless you save or send it yourself. We do not use your data to train models.

Calendar and calls

Connecting a Cal.com calendar is optional: a candidate connects it so a company can offer call times that fit their free hours, a company member so that calls are booked in their own calendar. When you connect it, Cal.com asks permission to read your event types, schedule and bookings and to create bookings. We store the access keys encrypted. You can disconnect the calendar in settings, and the keys are deleted.

A call room can be a Jitsi Meet link (meet.jit.si). We only create the link; when you open it, Jitsi processes the data under its own rules. The «Google Calendar» button only opens Google Calendar with the event filled in; nothing reaches Google unless you act.

Whom we share data with

We do not sell your data and do not pass it to advertisers. Data goes only to services the platform cannot work without, and only as much as they need:

• Amazon Web Services (AWS): the platform's servers, database, messages and file storage, hosted in an EU region;
• Hetzner: the server our e-mails are sent from, in Finland;
• OpenRouter and the model provider (currently Anthropic): texts for AI features when you start them, and the name and company name from an early access sign-up for the check;
• domain registries (over RDAP): only the domain of your e-mail from an early access sign-up, to learn when it was registered;
• Slack: when you confirm an early access sign-up, our team gets a message in its Slack workspace with your name, e-mail, the company name and size, and the result of our check;
• Google and LinkedIn: if you sign in with them, we receive your ID, name and e-mail from them;
• Cal.com: if you connected a calendar, the details of call bookings;
• OpenFreeMap: on the map page your browser loads the map itself from tiles.openfreemap.org, which sees your IP address and the part of the map you look at.

Providers that process data on our behalf do so under a contract and only on our instructions. We may also disclose data where the law requires it, or to protect people's rights and safety.

Transfers outside the EEA

The platform's servers, database and files are hosted in the EU. Some providers, including OpenRouter, Anthropic, Google, LinkedIn, Slack and Cal.com, may process data in the United States or other countries outside the European Economic Area. In those cases the transfer relies on a European Commission adequacy decision (for example, the EU-U.S. Data Privacy Framework for certified companies) or on the standard contractual clauses approved by the Commission. You can ask us for a copy of these safeguards by e-mail.

How long we keep data

• Account, profile and candidate card: for as long as the account exists.
• Early access sign-up: until the beta opens and we have written to you about it, after which we delete it; sooner if you ask. The check's mark is deleted with it. The IP address it was sent from is cleared after 90 days.
• Blocked addresses and domains: until we lift the block.
• Technical and security logs: up to 90 days.
• Sign-in sessions and the IP address in them: until you sign out or the session expires, at most 90 days.
• Backups: rolled over within 30 days, so deleted data leaves them within that window.
• Notifications: a read one for 180 days, an unread one for a year.
• View statistics: kept as counts; the link to the viewer's account is removed when that account is deleted.
• Company data (company page, vacancies, events) belongs to the company and stays when one member leaves or deletes their account.

Deleting your account

You can delete your account yourself: «All settings» → «Delete account». To confirm, we ask for your password, or the account's address if you sign in only with Google or LinkedIn. The account is deleted at once. If you cannot sign in, write to support@it-community.io from the address linked to it - we delete it within 30 days and tell you when it is done.

Deleted together with the account:

• your profile, candidate card and short card;
• your CV and other uploaded files;
• saves, follows and notifications;
• a calendar connection.

Applications and conversations: the company or organiser keeps the history it took part in, but you are shown there as «Deleted user», and the CV and files you attached are removed. We delete this anonymised history 12 months after the last activity in it. Anonymous applications whose contacts you never revealed stay anonymous. When you delete the account, open applications are withdrawn, requests for upcoming events cancelled, and your own upcoming events cancelled with a notice to their participants. If you are the only owner of a company, first hand that role to another team member.

Cookies and browser storage

We use only the cookies the site needs to work. There are no advertising or analytics cookies, trackers or third-party counters on the platform. Fonts are served from our own server. That is why there are no separate cookie settings: everything below is needed for the site to work and remember your choices.

Some interface settings are kept only in your browser; of these, only the random session key is sent to us, with a profile view:

You can delete all of this in your browser settings. Without the session cookies you will be signed out; without the rest the site simply forgets your choices.

Security

Data travels only over encrypted connections (HTTPS). Passwords are stored as a strong hash, calendar access keys are encrypted, and sign-in and password reset are protected against guessing. Access to data is limited to those who need it to run the platform.

If a breach puts your rights at risk, we will notify the supervisory authority and you, as the GDPR requires.

Your rights

You have the right to:

• know what data of yours we process and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict processing, for example while we look into your objection;
• receive your data in a machine-readable format and move it to another service;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting what was done before;
• lodge a complaint with a supervisory authority.

You change or delete most of your data yourself in the editors of your profile, candidate card and short card, and set visibility there too. You can delete your account in settings. For everything else, such as a copy of your data, write to support@it-community.io. We answer within one month; if a request is complex, this can be extended by two more months, and we will tell you. To protect your data we may ask you to confirm that the account is yours.

Complaining to a supervisory authority

Our supervisory authority is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, PUODO). You can also go to the data protection authority of the EU country where you live or work. But please write to us first: it is usually faster.

Age

The platform is not meant for people under 16. If we learn that an account was created by someone under 16, we will delete it.

Changes to this policy

When we change how we handle data, we update this page and the date at the top. We will announce material changes on the platform or by e-mail in advance.

Contact

For questions about your data and this policy, write to support@it-community.io.

These documents are published in English, Ukrainian, Spanish, French, Polish, German and Italian. If the versions differ, the English version prevails.