Privacy Notice

ProX is currently operated by Ethan, as an individually-run project based in Finland. A registered Finnish business entity is in progress; this notice will be updated with full legal registration details once that is complete.

Contact: privacy@proxjob.com

Account data: your email address, authentication credentials (via Supabase Auth), and account preferences such as language and notification settings.

Sign in with Google: if you choose this option, Google shares your name, email address and whether the email is verified with us. We never receive your Google password, and we do not use your Google profile picture in ProX. Google handles the sign-in itself under its own privacy policy.

Profile & career data: anything you add to your ProX profile — name, headline, location, work experience, education, skills, certifications, projects, languages, achievements, and any CV or portfolio content you create.

Uploaded documents: if you import a CV, we process the file (PDF/DOCX/TXT) to extract this information into your profile.

Usage & activity data: job applications you track, jobs you save, job-match analyses you run, cover letters you generate, and related activity within the product.

Reach-out drafts: if you use Reach out, we store the company, role, recipient name (if you type one), channel, the message text and a follow-up date with the application you save, visible only to you, until you delete it or your account. ProX does not send the message and does not ask for the recipient's email address or phone number. The private link created for it is an ordinary share link (see Share links) and expires after 30 days.

Public marketplace data: if you choose to publish your profile to Talent, the specific fields you select become visible to anyone, including people without a ProX account.

Messages sent through ProX: if you contact someone through ProX (for example a recruiter writing to a Talent profile), we collect your name, your organisation if you give it, your email address, your message, and a one-way hash of your IP address that we use only to limit abuse. You don't need a ProX account to do this.

Endorsements and review comments: if you write an endorsement or a review comment for someone through a ProX link, you don't need an account. We collect your name, your job title and relationship to the person if you give them, your email address, what you write, and a one-way hash of your IP address that we use only to limit abuse. If the person chooses to show your endorsement, it is displayed with your name, title, relationship and text, never your email address.

Feedback: if you send us feedback, we store your message, an optional screenshot, the page you were on, your browser type and, if you are signed in, your account, so we can fix problems and reply to you. You do not need an account to send feedback. We also email a copy of each message and screenshot to the ProX team; if you were signed in, that email includes your name, your account email address and your profile link.

Share links: for each link you create we count how many times it has been opened and when it was last opened. We do not record who opened it. To avoid counting reloads, link-preview bots and your own previews, we keep a keyed one-way hash of the visitor's IP address and browser type for up to 1 day; the IP address itself is not stored. Failed password attempts on a protected link are recorded with a one-way IP hash for up to 1 day to limit guessing.

Sign-up source: if you open ProX through a link that carries a campaign tag (for example ?ref=… or utm_…), we store that tag once, when you create your account, so we can see which channels bring people to ProX. We do not use cookies for this and the tag is deleted with your account. If you share your personal invite link, it contains a random code tied to your account; we count how many people sign up through it and show you only that number, never who they are.

Fair-use counters: we keep daily counts of how many AI requests each account makes, for about 35 days, to apply fair-use limits.

Technical data: our hosting and infrastructure providers process your IP address and request details while delivering ProX and protecting it from abuse. Our own rate limits use only one-way hashes of IP addresses.

To provide the core service (creating your profile, generating CVs, tracking applications) — necessary to perform our contract with you (Art. 6(1)(b) GDPR).

To power the AI Assistant, job-match analysis, and cover-letter generation — based on your explicit request each time you use these features, using your own profile data (Art. 6(1)(b)).

To publish your profile to Talent — only with your explicit opt-in; you choose which fields are visible and can unpublish at any time (Art. 6(1)(a), consent).

To send you job-match email notifications based on your career goals — you can opt out anytime in Settings (Art. 6(1)(a)/(f)).

To keep the service secure and working correctly — legitimate interest (Art. 6(1)(f)).

To count views of your share links and show you the numbers, to apply fair-use limits to AI features, and to handle feedback you send — legitimate interest (Art. 6(1)(f)).

To show an endorsement or review comment you wrote, as agreed when you submitted it and only if the person you wrote about chooses to display it (Art. 6(1)(a)).

To deliver messages sent through ProX, confirm the sender's email address, and prevent spam and abuse, including limits on how many messages one sender can send — legitimate interest (Art. 6(1)(f)).

We use the following processors to run ProX. None of them are permitted to use your data for their own purposes.

Supabase — database, authentication, and file storage, hosted in the EU (Stockholm, Sweden).

Google (Gemini API) — processes profile and job-description content you submit to AI features (CV improvement, job matching, cover letters, resume import). Under Google's Gemini API terms for customers in the European Economic Area, Google does not use this content to improve its products and processes it as our processor. Data may be processed outside the EU/EEA; see Google's own terms for details. AI features run only when you use them; nothing is sent to Google in the background.

Resend — sends transactional and notification emails on our behalf.

Vercel — hosts and serves the application.

Upstash — a Redis service we use only for rate limiting. It receives one-way hashes of IP addresses and short-lived counters, no profile content.

Messages you send through ProX are shown to the person you are contacting: your name, your organisation, your message, and a label showing how your email address was checked.

We also pull public job listings from third-party sources (EURES, Jooble, and similar job boards) to populate the Job Market. This is one-directional: we do not send your personal data to these sources.

Where a processor (such as Google, Vercel, Resend or Upstash) may process data outside the EU/EEA, we rely on that provider's own safeguards, such as Standard Contractual Clauses, as required by Chapter V of the GDPR.

We keep your data for as long as your account is active. You can permanently delete your account and all associated data at any time from Settings — this immediately removes your profile, CVs, applications and published listings, and the files you uploaded (profile photo, portfolio images and screenshots attached to feedback). The exceptions are described below. Some data may be retained briefly in backups before being purged.

Feedback: when you delete your account, any screenshot you attached is deleted with it and the feedback you sent is disconnected from your account, but the text of the message (with the page and browser type) is kept. We delete all feedback automatically after 12 months at the latest, and earlier on request, whether or not you have an account: contact us at privacy@proxjob.com.

Messages sent through ProX by people without an account: messages whose email address was never confirmed are deleted after 30 days, the one-way IP hash is removed after 30 days, and every message is deleted after 24 months at the latest, or earlier if the person you contacted deletes the message or their ProX account (details of blocked or reported senders are kept until the 24-month limit to prevent abuse). The same 30-day limit applies to IP hashes stored with endorsements and review comments.

Under GDPR you have the right to: access the data we hold about you; correct inaccurate data; delete your data; export your data in a portable format; object to or restrict certain processing; and withdraw consent at any time, without affecting processing carried out before the withdrawal.

You can exercise most of these directly from Settings (data export as JSON, account deletion). For anything else, contact us at privacy@proxjob.com.

You also have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi) or your own country's supervisory authority.

If you sent a message through ProX without an account and want to access or delete it, contact us at privacy@proxjob.com. We may keep limited details where needed to prevent abuse.

ProX uses only strictly necessary and functional cookies: your login session (via Supabase Auth), your language preference, and — if you open a password-protected shared link — a short-lived cookie that remembers you've unlocked it. We do not use analytics, advertising, or tracking cookies.

ProX is not directed at children. It is intended for people old enough to be building a professional career, and we do not knowingly collect data from children.

We may update this notice as ProX develops, especially once formal business registration is complete. We'll update the date above whenever we do, and tell you about significant changes in the app or by email.

Questions about this notice or your data: privacy@proxjob.com