e-kariyerim

Privacy Policy

Last updated: 9 October 2026

What data we collect and why

e-kariyerim is a personal tool that helps you track your job applications. To provide the service, we process the following data:

  • Account details: email address and password (stored hashed); first and last name are optional — the sign-up form does not ask for them, you can add them under Settings. If you sign in with Google, LinkedIn or GitHub, that account's identifier is stored instead of a password (see below). When you sign up, we send a 6-digit code to your address to verify it; the account cannot be used until the code is entered.
  • Application data you enter or import: company, job listing, application status, dates, and notes. If a posting you save with the browser extension also carried the company's LinkedIn or kariyer.net page, that page's address is stored with your account; once at least two different people point at the same page, the company website read from it is shown on the public company page. Who pointed at it is never shown anywhere, and the record is deleted with your account.
  • Reminders derived from this data (follow-up suggestions, no-response alerts, and for an interview date you enter, a reminder the day before and a “how did it go?” question the day after).
  • If you turn on Gmail Scanning (an opt-in browser-extension feature), the subject line and a short snippet of a detected status-update email — used to detect a status change and, for a job not yet tracked, to read off the company/role — are stored on your account and, for that detection, sent to OpenAI. This content is first evaluated locally in your browser; only a message that looks job-application-related ever reaches us. See "Cross-border data transfer" below.
  • An HR contact you keep for an application or a job you track: name, email address and LinkedIn profile URL. You can enter these yourself; in addition, when you match a status-update email to an application and confirm it, that email's sender address may be filled in as the HR email — automated mailboxes (no-reply and the like) and job-platform addresses are never stored for this, and an address filled this way is labelled "from an incoming email" in the interface. Only you can see it; it is never shown to other users, never included in any analytics, never sent anywhere, and it is deleted along with the application or your account. We never email that address on our own — in the interface it is only a link. When you record an interview you may also note who you are meeting; those names likewise stay in your account only, are used for the thank-you draft, and are deleted with the interview or your account.
  • Request log: for every request in which you send something to the site — sign-up, sign-in, adding or editing an application, importing, uploading a CV, a company review, a salary entry, a candidate experience, a blog comment, feedback and the like — the IP address of your connection, the request path, its outcome and the time. This log is kept solely for the security of your account, for fighting abuse and for our legal obligations (such as a properly made request from a competent authority); it is never shown on any screen, report or data export, and it is deleted together with your account. The same log is kept on the surfaces that need no sign-in (CV scan, benchmark, the "no reply" report on company pages) and for failed sign-in attempts; as those belong to no account, they are deleted after 12 months. What is not logged: page views and the step reports sent to the visit counter (see "Visit counter").
  • If you use the weekly job matching (a paid feature): the job titles (up to three) and the location you save as your search criteria. They are stored on your account and, once a week, used as a search on LinkedIn and kariyer.net — see "Cross-border data transfer" below. The postings found are kept for you for a limited time; which ones you already applied to is worked out from your own applications and never stored as a separate record. If you also give consent, the fit score computed for each posting, its short reasoning and the matched/missing criteria are kept on your account too — see "Weekly job matching".

Apart from the request log, this data is used solely to provide you with application tracking and personal analytics features; the request log serves only the security and legal purposes listed above.

CVs you upload

Uploading a CV is entirely optional; the rest of the service works without one. When you do upload a CV:

  • The file is stored in a bucket closed to the public on Google Cloud in the European Union region (europe-west1) — the same region as your account and application data. Even a guessed address cannot reach it; the bucket is not exposed to the internet at all.
  • Only you, while signed in, can reach the file. Every download is checked against your own account and streamed through the e-kariyerim server; no shareable or time-limited link is ever produced. It is never shown to other users, to employers or to job boards.
  • The contents of your CV are never sent to any third party, AI services included. The one exception is the paid feature described under "Weekly job matching" below, which you turn on yourself and consent to separately; then only the text of your default CV is sent, and only for scoring. The file is not read, converted to text or analysed; it is only stored and handed back to you. The first-page preview you see on the My CVs page is rendered in your own browser, not on the server.
  • A CV you delete is deleted permanently — the storage-side recovery window is deliberately turned off. Deleting your account deletes all of your CVs with it.
  • If you choose to, you can measure an uploaded CV's ATS readability (the button on the My CVs page). These are the same checks as the sign-in-free CV scan and they run on our server; nothing is sent to an AI model. The report (score, findings, the lines they point at and the text extracted from the file) is produced only when you ask, kept next to that CV, visible only to you, and deleted together with the CV. The data export carries the score and the date it was measured.
  • The lawful basis is your explicit consent, and it is taken separately for every upload: you tick the consent box before choosing a file, the box is never pre-ticked, and it clears again after each upload. You can withdraw consent at any time by deleting the file, and deleting your account deletes all of your CVs with it.

A CV can carry more than your work history — a photo, a date of birth, or health or military-service information — which is why we ask for your explicit consent before each upload. What goes into it is your decision: none of those fields are needed for the service to work, and you can delete the file at any time.

CV scan (without signing in)

On the public CV scan page you can upload a PDF or Word file and see what an applicant tracking system reads from it. This is separate from, and different to, "CVs you upload" above:

  • The file is not stored anywhere. It is never written to disk on the server and never placed in storage; it exists in memory for the length of the request and is gone once the response is sent. The text of your CV is not kept either.
  • Three things survive a scan: your IP address (in memory for 2 hours to enforce the scan limit; and, as the security record described under "Request log" above, for 12 months — never linked to the score), an anonymous score (a number from 0 to 100, with no record of which file it came from or whose it was), and a scan counter.
  • All eight checks behind the score run on our own server: the score is never asked of an AI model, so it cannot be inflated by an instruction written inside the CV. Unless you tick the optional box, the contents of your CV are not sent to any third party.
  • If you ask for notes on the writing (the second, optional box): the text of your CV is sent to Google Cloud Vertex AI — in the EU region our infrastructure already runs in, with the same processor; no new country is involved. It goes through paid Vertex, which does not train on the content. The notes do not affect the score, the text is still stored nowhere, and with the box unticked no model is involved at all.
  • The excerpts and the raw text you see on the result screen exist only inside the response to your own request; they are not recorded and never written to logs.
  • The legal basis is your explicit consent, taken separately for every scan: the box is never pre-ticked and is cleared again after each scan. The second box, for the content notes, is separate and genuinely optional — the scan works fully without it and your score is identical. Since nothing is stored, there is no retention to withdraw; not running the scan is enough.

Weekly job matching (a paid feature)

With the Pro plan and the search criteria you saved, new LinkedIn and kariyer.net postings are searched every Monday (for the criteria going to the two sites see "Cross-border data transfer"). Each posting found is compared with your default CV and scored — only if you separately consent:

  • What is sent: the text of your default CV (not the file; the first 15,000 characters) together with the text of one posting. Recipient: Google Cloud Vertex AI, in the EU region our infrastructure already runs in (europe-west1) and with the same processor — no new country and no new processor is involved. It goes through paid Vertex, which does not train on the content and does not keep it.
  • What we keep: for each posting a 0–100 fit score, a sentence or two of reasoning, the lists of matched and missing criteria and the skills the posting asks for — on your account, next to the posting. The CV text itself is written nowhere: it is read again from your stored file every week and lives in memory for the length of the request. To track the cost of the calls, how many tokens were spent for which feature is also recorded against your account; that record holds no text and survives account deletion (detached from your identity).
  • The lawful basis is your explicit consent, given when you first save your criteria through a box that is never pre-ticked; the moment it was given is recorded and shown on the criteria page. Criteria cannot be saved without it, because there is no version of the feature without scoring.
  • Withdrawal: delete your criteria — the search and the scoring stop at once, that week's list and scores are deleted, and your CV is never sent again. Deleting your account has the same effect.

Payments (Pro plan)

When you buy the Pro plan, the payment is taken on the secure payment page of PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.

  • Your card number, expiry date and security code never reach e-kariyerim; they are entered on PayTR's page and processed there.
  • What we send PayTR: your e-mail address, the name, address and phone number you enter at checkout, the IP address of the connection you start the payment from, the chosen plan and the amount.
  • What we keep: the order record (plan, amount, date, outcome), the name, address and phone number you entered for the invoice, the result PayTR reported and, if any, the failure reason. The IP address of PayTR's server call that reports the result is recorded too and never shown anywhere.
  • Payment and invoicing records are kept for the retention period the tax legislation requires. If you delete your account, these records are detached from it (the link to your identity is removed) but not deleted until that period ends.
  • Refunds are made only through our own system, via PayTR's refund service, to the card you paid with; your request and its outcome are kept on the order record.
  • PayTR is the data controller for the data it processes itself; its privacy notice is published at paytr.com.

Legal basis: performance of the contract (KVKK art. 5/2-c) and compliance with a legal obligation (art. 5/2-ç).

Feedback you send

The feedback button in the bottom-right corner of every page is entirely optional. When you send a message:

  • Your message, the topic you picked (bug/idea/question) and, if you chose one, how you said it was going are stored against your account.
  • Technical context is stored with it: the path of the page you opened the panel from (for example /en/applications), your language and theme, and your browser details. Only the path of the address is taken — query parameters (an application id, say) are dropped both in your browser and on the server.
  • The contents of your applications, CVs and emails are not sent with feedback, and no screenshot is taken.
  • The reply address is optional and can be left blank; it is used only to get back to you, never for marketing.
  • Feedback is stored in our own database; the canonical record is ours.
  • Your message and the technical context above are also opened as a tracking record in a private repository on GitHub, so we can follow it through. Your name, your account email address and your reply address are not sent there — only the record's id goes, so seeing who wrote it means looking it up in our own database.
  • Recipient: GitHub, Inc. (Microsoft, United States). This is a transfer abroad; see the "Transfers abroad" section below.
  • Deleting your account deletes your feedback from our database. The tracking record on GitHub never carried your identity, so after that deletion it can no longer be traced back to you; if you would like that record removed as well, just write to us.

Lawful basis: legitimate interest — fixing and improving the product against what users report.

Company reviews you write

Writing a review of a company is optional and needs an account. When you do:

  • Your review — your overall rating, the optional area ratings, the ready-made statements you picked and your relationship to the company (current employee, former employee, intern) — is stored against your account, together with its moderation status and any note a moderator wrote. There is no free text in a review since 16 September 2026; if you wrote one before then, its title, pros and cons stay stored for you and are no longer shown to anyone else.
  • Published reviews never show your name, email or account; readers see the ratings, the statements, your relationship to the company and the month it was written. The month rather than the day, on purpose: a date is one more clue to who wrote it.
  • If an application to this company you track on e-kariyerim ended "accepted" and was added at least 14 days before your review, the review shows an "Accepted application" label. Readers get only that yes/no — not which application or its dates. Delete the application and the label goes with it.
  • A moderator who looks at your review — after a report, or for a review from before the switch — can see the account behind it. That is what makes moderation possible, and it is the only place your identity meets your review.
  • If you report someone else's review, the report (reason, your note, the time) is stored against your account and shown to the moderator. The review's author never sees who reported it.
  • Marking a review helpful is stored as one row per review per account, so it can be undone and cannot be counted twice. Nobody sees who marked what — the review's author included: the author is told in the app only how many people found it helpful that day (they can switch this off). So that one person toggling a mark on and off is not counted twice, the fact that an account first marked a contribution is kept for 90 days.
  • Reviews, reports and helpful marks are stored in our own database and are not sent to any third party.
  • Deleting your account deletes your reviews, your reports and your helpful marks. Reviews you wrote disappear from the company pages and from the company's score; this is also what your data export contains.

Lawful basis: your explicit action — you choose to write, report or mark — and, for moderation, legitimate interest: keeping what is published about a named company fair and lawful.

Salary information you share

Sharing your salary at a company is optional and requires an account. When you do:

  • Your entry — the occupation you picked from the list, total years of experience, employment type, whether you are a current or former employee, the years of the period you drew the salary in, monthly net salary with its currency, and the annual bonus if any — is stored linked to your account. There is no free text: the occupation comes from a catalogue based on ISCO-08.
  • Entries are shown only to signed-in users; the public company page says only how many entries there are.
  • Readers see an experience band (0–1, 2–4, 5–9, 10+) rather than your exact years, and the period of the salary in years rather than a date or a month. Deliberately: together with an occupation, the exact years and date would give away who wrote it at a small company.
  • A published entry never shows your name, e-mail or account, and contains nothing you typed. Only we can see the account behind an entry. If a reader finds your entry helpful you are told only how many did, never who; and the author of an entry you mark is never told it was you.
  • If an application to this company you track on e-kariyerim ended "accepted" and was added at least 14 days before your entry, the entry shows an "Accepted application" label. Readers get only that yes/no — not which application or its dates. Delete the application and the label goes with it.
  • Entries are stored in our own database and are not sent to any third party.
  • You can delete an entry from My contributions at any time. Deleting your account deletes all of them; your data export includes them with the exact years.

Legal basis: your explicit action — you choose to share.

The candidate experiences you share

Rating a company's hiring process is optional and needs an account. When you do:

  • Your entry — your overall rating, the areas you rated, the statements you picked from the ready-made list and, if you answered them, the outcome, length, number of stages and interview types — is stored against your account. There is no free text: every published sentence is one of our own fixed statements.
  • Entries are shown on the public company page: the ratings, the statements and the process tags. The score, the area averages and the process statistics appear once a company has at least three entries.
  • Readers see the quarter only (2026 Q3), never the day or the month; a job title, an interviewer or a team name is never asked. Deliberately: a company knows whom it interviewed, and a month with a title would give away who wrote it at a small company.
  • A published entry never shows your name, e-mail or account. Only we can see the account behind it. If a reader finds your entry helpful you are told only how many did, never who; and the author of an entry you mark is never told it was you.
  • If an application to this company you track on e-kariyerim was added at least 14 days before your entry, the entry shows a "Tracked application" label. Readers get only that yes/no — not which application, its dates or its status. Delete the application and the label goes with it.
  • Entries are kept in our own database; nothing is sent to any third party.
  • You can delete an entry at any time from My contributions. Deleting your account deletes all of them; your data export includes them with their exact dates.

Legal basis: your explicit action — you choose to share.

The comments you write on blog posts

Commenting on a blog post is optional and needs an account. When you do:

  • Your comment is kept as plain text, tied to your account, with when it was written and edited and its moderation status. Every comment is visible only to you until an admin approves it; a comment that is not approved is never published.
  • A published comment shows your first name and the initial of your last name (for example "Selin Y."); an account with no name shows "A reader". Your e-mail address, your account and anything else about you are never shown. Everyone who reads the post sees that name — know this before you write.
  • An approved comment can be neither changed nor deleted: others have replied to it. While it waits for approval you can edit it from My contributions or under the post.
  • The admin who reviews your comment sees the account behind it; that is what makes moderation possible, and it is the only place your identity meets your comment. If you report a comment, the report (reason, your note, time) is kept against your account and shown only to admins; the comment's author never sees who reported it. A "helpful" mark is kept as one row per comment and account and shown to nobody; the comment's author is told only how many people found it helpful.
  • Every request that writes, edits, replies to or reports a comment records the connection's IP address in the request log (the "Request log" item above). It is never shown anywhere; it is kept only for a legal request or an abuse investigation.
  • Comments, reports and helpful marks are kept in our own database and sent to no third party.
  • Deleting your account deletes all your comments — and the replies they received; your data export includes your comments.

Legal basis: your own explicit action — you choose to comment.

Your profile photo

Adding a profile photo is optional. When you add one:

  • You crop the photo in your browser; our server saves it again as a 256×256 pixel image and keeps only that. The file you uploaded is not kept, and file details such as location (GPS), device and capture data are removed.
  • Your photo appears in the menu in the top bar and on your profile page. On blog comments it appears next to your name, to everyone, only if you turn on "Show my photo on my blog comments"; that setting is off by default.
  • Salaries, company reviews, candidate experiences, silence reports and response rates are anonymous: your photo is never shown there, under any setting.
  • Your photo is served from a random address unrelated to your account. When you change or remove it, or stop showing it on comments, the address changes and the old one stops working; a browser that already saw it may keep it in its cache for up to a day.
  • A photo on a blog comment can be reported as "Inappropriate profile photo". An admin can remove the photo; your comment stays.
  • Every request that uploads or removes your photo or changes where it is shown records the connection's IP address in the request log (the "Request log" item above). It is never shown anywhere.
  • The photo is kept in our own cloud storage, in a space closed to the public, and sent to no third party.
  • You can remove the photo at any time; deleting your account deletes it too. Your data export includes the photo's address and where you chose to show it.

Legal basis: your own explicit action — you choose to add a photo and to show it on comments.

Sign in with Google

Sign in with Google is an optional login method, an alternative to registering with email and password. When you use it, we receive only the following from Google:

  • Your Google account's permanent identifier (so we can recognise your account even if your email address changes).
  • Your email address, as verified by Google.
  • The first and last name on your Google profile (pre-filled in the sign-up form; you can change them before saving).

We do not access, and never request permission for, your Gmail, contacts, Drive or any other data in your Google account. We do not store the access tokens Google issues us; they are discarded as soon as sign-in completes.

If the verified email address of your Google account already belongs to an e-kariyerim account created with a password, the Google sign-in is linked to that account and signs you into it; your password keeps working. If that account's email address was never verified, its password, other sign-in methods, open sessions and extension keys are removed before linking; the account passes to you, whom Google has just shown to own the address.

You can remove the permission on Google's side at any time under Google Account → Security → Third-party apps. Deleting your e-kariyerim account also removes the link to Google.

Sign in with LinkedIn

Sign in with LinkedIn is an optional login method, an alternative to registering with email and password. When you use it, we receive only the following from LinkedIn:

  • Your LinkedIn account's permanent identifier (so we can recognise your account even if your email address changes).
  • Your email address, as verified by LinkedIn — if LinkedIn shares it. LinkedIn does not always do so; in that case we ask you to enter an email address yourself when you complete your sign-up, and we send a verification code to that address; the account cannot be used until the code is entered.
  • The first and last name on your LinkedIn profile (pre-filled in the sign-up form; you can change them before saving).

We do not access, and never request permission for, your connections, messages, posts or any other data in your LinkedIn account. We do not store the access tokens LinkedIn issues us; they are discarded as soon as sign-in completes.

If the email address verified by LinkedIn already belongs to an e-kariyerim account created with a password, the LinkedIn sign-in is linked to that account and signs you into it; your password keeps working. If that account's email address was never verified, its password, other sign-in methods, open sessions and extension keys are removed before linking; the account passes to you, whom LinkedIn has just shown to own the address. An email address you typed in yourself is never used to link to an existing account.

You can remove the permission on LinkedIn's side at any time under Settings & Privacy → Data privacy → Other applications → Permitted services. Deleting your e-kariyerim account also removes the link to LinkedIn.

Sign in with GitHub

Sign in with GitHub is an optional login method, an alternative to registering with email and password. When you use it, we receive only the following from GitHub:

  • Your GitHub account's numeric identifier (so we can recognise your account even if you change your username or email address).
  • Your GitHub account's primary email address, as verified by GitHub — if GitHub shares one. An account that keeps its address private shares none; in that case we ask you to enter an email address yourself when you complete your sign-up, and we send a verification code to that address; the account cannot be used until the code is entered.
  • The display name on your GitHub profile, split into a first and last name (pre-filled in the sign-up form; you can change them before saving).

We ask GitHub for two permissions only — read your profile and read your email addresses. We do not access, and never request permission for, your repositories (public or private), your code, your issues or anything else in your GitHub account. We do not store the access tokens GitHub issues us; they are discarded as soon as sign-in completes.

If the email address verified by GitHub already belongs to an e-kariyerim account created with a password, the GitHub sign-in is linked to that account and signs you into it; your password keeps working. If that account's email address was never verified, its password, other sign-in methods, open sessions and extension keys are removed before linking; the account passes to you, whom GitHub has just shown to own the address. An email address you typed in yourself is never used to link to an existing account.

You can remove the permission on GitHub's side at any time under Settings → Applications → Authorized OAuth Apps. Deleting your e-kariyerim account also removes the link to GitHub.

Cross-border data transfer

Your data goes abroad in three cases. The first is Gmail Scanning: if you turn it on, the subject line and a short summary of each detected status-update email are sent abroad to work out what it means for your application.

  • Recipient: OpenAI, L.L.C. (United States) — our API provider.
  • Purpose: to classify the email's application-status signal, and — for a job not yet tracked — to read off a company name and job title; this only runs when a simpler, local rule-based check doesn't already recognize the email.
  • Legal basis: this only happens for Gmail Scanning you turn on yourself in the browser extension; nothing is sent unless you use this feature.
  • Withdrawal: turn off Gmail Scanning in the browser extension's Settings page. Or delete your account, to stop this entirely.

The subject and snippet are also stored on your account (visible to you when reviewing a suggestion) — never the full email body.

The second is feedback: when you send feedback from inside the app, your message and its technical context are copied to a private repository on GitHub so it can be tracked. Recipient: GitHub, Inc. (Microsoft, United States). Your name, your account email address and your reply address are not sent. Lawful basis: legitimate interest — tracking and fixing what users report. See the "Feedback you send" section above for the detail.

The third is the weekly job matching (a paid feature): once a week, the job titles and the location you saved as criteria are sent as a search query to LinkedIn, and the public job postings it lists are fetched. Recipient: LinkedIn Ireland Unlimited Company (Ireland; LinkedIn Corporation, United States). The same search also goes to kariyer.net in Türkiye (Kariyer.net Elektronik Yayıncılık ve İletişim Hizmetleri A.Ş., Istanbul); that is not a cross-border transfer and is mentioned here for completeness. What is sent is the search itself — a job title and a place — and nothing else: not your name, not your account, not your CV. Lawful basis: this only happens for criteria you saved yourself, while your paid plan is active; delete the criteria or let the plan lapse and it stops. Withdrawal: remove your criteria from the job matching settings, or delete your account.

Error monitoring

We use the error monitoring service Sentry so that we can diagnose crashes and unexpected errors, on both the website and the API. When an error occurs, the following goes to Sentry:

  • The error itself: its message and the technical stack trace.
  • The address of the page the error happened on, plus browser and operating system details.
  • The IP address of your connection.

Recipient: Sentry (Functional Software, Inc.). The records are processed on Sentry's European Union (Germany) infrastructure.

Legal basis: legitimate interest — keeping the service secure and available, and finding and fixing faults.

We deliberately keep session replay and performance tracing switched off: your screen is not recorded, your browsing behaviour is not tracked, and your form contents are not sent. Your application data, your CV and email contents are never included in an error record.

Error records are deleted when Sentry's retention period expires; the error records themselves are never written to the product's own database. (The one place the product's database does keep your IP address is the "Request log" item above.)

Visit counter

We count how often public pages are opened, and how often a few steps are taken on the site, on our own server. Each time, only this is recorded:

  • What happened: a page was opened, or one of these steps — a sign-up button was clicked; a sign-up was started, completed, or its password was not accepted; a free tool showed its result (a CV score, a benchmark answer sent, the first figure in the offer comparison, a "no reply" report sent from a company page); a share button was clicked.
  • The address of the public page it happened on (everything after the question mark excluded) and the page's language.
  • Which site you found us from — the domain only.
  • A daily counter — how many times that combination of four was seen that day.

When a step is counted, its content is not sent: your CV file and score, the offer figures you type, your benchmark answers, what your report says, your email address or your password never reach this counter. All the counter knows is that the step was taken and on which page.

Recipient: none. The data stays on our own server; it is sent to no analytics service and to no other third party.

No stored row can be linked to a person — no visitor id, no session id, no IP address, no browser details — so there is no personal data here. Should it be assessed otherwise, the basis is legitimate interest (KVKK art. 5/2-f, GDPR art. 6/1-f): measuring whether the service is used at all.

No cookie is used, nothing is written to your browser, and there is no profiling or ad targeting. If your browser has “Do Not Track” switched on, nothing is counted. See “Visit counter” in the Cookie Policy for the details.

Retention: the rows are aggregate counts holding no personal data, so they are kept indefinitely.

Cookies

We only use cookies the service needs in order to work; there are no advertising or analytics cookies, which is why you never see a cookie consent banner. What each cookie does, how long it is kept and how to delete it is listed one by one in the Cookie Policy.

Browser extension

What the browser extension reads on your own device, what it stores, and what it sends is described in a separate document: Browser Extension Privacy Policy If you haven't installed the extension, that document doesn't apply to you.

Retention period

Data tied to your account is kept until you delete your account; no automatic time-based deletion is applied to it. There are two exceptions. First, sign-ups that could never be used because their email address was not verified: they are deleted entirely if not verified within 7 days. Second, request-log entries that belong to no account (an anonymous CV scan, a benchmark answer, a failed sign-in attempt): those are deleted automatically after 12 months.

Your rights

You can export a copy of your data or permanently delete your account at any time. You can do this from the Account Settings page. Deleting your account permanently removes every piece of data belonging to it — your applications, your tracked jobs, your CVs, your imports, your reminders, your email suggestions and notifications, your company reviews, the salary entries you shared, your candidate experiences, your blog comments, the feedback you sent and your request log. The request log is not part of the export file; to access your own entries, write to privacy@ekariyerim.com.

Aggregate response data (the sector table and a company page's "Response" tab)

The applications you track feed aggregate figures detached from your identity: a sector's or a company's response rate, first-reply time, post-interview silence, ghosting rate, promise keeping and rejection notice rate. When they do:

  • Only the company, the application date, the status, the dates of status changes and, if you give them, two optional answers are aggregated: the reply date the company promised and how you learned of a rejection. Your notes, interview dates and the names of the people you met, HR contact, CV, e-mails and name never enter any aggregate.
  • Only applications recorded as they happened count: those added at most 7 days after the day you applied — by hand, with the extension, from an email suggestion or through an import alike. Older applications brought in from LinkedIn in bulk never enter the aggregates. An application that is still open does not count either if you have not used the site in the last 90 days: the open applications of someone who stopped tracking do not mean the company never answered. An automatic email update or a bulk change you undid counts as never having happened.
  • The sector table is public and names no company. A sector row is not shown until at least 5 different people have 30 applications between them, and it stays closed while one person accounts for more than half of them.
  • A company page's "Response" tab shows nothing until that company has at least 20 applications in the last 12 months from at least 5 different people, and stays closed if one person accounts for more than a third of them. Below the threshold it does not say how many applications or people are missing.
  • The "I heard nothing back" report on a company page needs no account and is tied to none: only the company, stage, wait, any reply promise and the month are stored. The report holds no name, email, free text or IP address. To stop the same company being reported from the same connection within 30 days, a one-way key derived from the connection address is held in temporary memory for 30 days and then expires by itself. Reports are never mixed into the rates; no figure is shown for a company until it has at least 5 reports from at least two different quarters, and that figure stays off together with the "Response" tab.
  • A company's name can come up in the company directory's search even before it has any contribution, once at least three different people have applied to it. How many applied, and who, is never shown.
  • An aggregate cannot be walked back to one person's application: the pages show only rates, medians and a count of people, and individual application rows never leave the server.
  • You can take your applications out of the aggregates at any time with the switch in Settings › Privacy; it is on by default. Turned off, your applications leave the sector table, companies' "Response" tabs and the applicant count that lists a company in the directory (the tables are cached for at most an hour). Your own statistics are not affected.
  • Deleting your account deletes your applications, and the next calculation drops them from the aggregates too (the tables are cached for at most an hour).

Legal basis: legitimate interest — letting candidates see how much a sector or a company replies to applications; below the threshold no personal data is processed at all, above it it is shown only in aggregate. You can object to this processing with the switch in Settings › Privacy.

Contact

For questions, you can reach us at privacy@ekariyerim.com.