On this page
The short version: you can browse JobThing without an account and without cookies. We only put analytics cookies on your device and record your sessions if you accept. We email you only if you switch it on. You can download or delete your data yourself in settings.
Who is responsible
The controller for your personal data is:
- Aura Web Solutions
- KvK number: 95073930
- Email for privacy questions and requests: [email protected]
We are based in the Netherlands and the GDPR (AVG) applies.
What we process, why, and on what legal basis
| Purpose | Data | Legal basis | Kept |
|---|---|---|---|
| Running your account: sign-in, saved jobs, alerts, application notes, and the filters you last used on the job board, so it opens the way you left it | Email, first name, profile picture, Clerk id, what you save and type, the filters you last used on the job board | Contract (art. 6(1)(b) GDPR): you asked for an account and we need this data to provide it | Until you delete your account |
| Knowing where people hear about JobThing: the optional question at the end of sign-up setup | Your answer (a choice from a short list, and a short free text if you pick other), which you can leave blank | Consent (art. 6(1)(a) GDPR): you choose to answer, and skipping it changes nothing. The choice, not the free text, is also sent to our analytics tool if you have accepted analytics | Until you delete your account |
| Emails you switched on: job alerts and the other emails in settings | Email address, first name, your alerts and email preferences, delivery status | Job alert emails: contract (art. 6(1)(b) GDPR), because you ask for them when you save an alert with email ticked; you can untick it then or switch it off later. The other emails in settings: consent (art. 6(1)(a) GDPR and art. 11.7 Telecommunicatiewet), off until you switch them on. Every email has a one-click unsubscribe | Until you switch it off or delete your account. The email provider keeps delivery logs for a limited time |
| Counting visits without cookies: which pages are used, whether pages load and break, in memory only | Pages visited, device and browser type, country and city (looked up from your IP address, which our analytics tool then discards and does not store), errors | Legitimate interest (art. 6(1)(f) GDPR): keeping the site working and understanding which pages help. Nothing is stored on your device, nothing links your visits together, and you can object | Analytics events: kept for as long as we need them for product analytics, and at most for the retention period of our analytics provider's plan |
| Analytics with cookies and local storage, and session recordings, only if you accept | Everything above, plus a random id kept on your device so we can recognise you when you return, and a recording of how you use the pages (what you type is masked; browser console messages are captured) | Consent (art. 6(1)(a) GDPR and art. 11.7a Telecommunicatiewet). You can withdraw it at any time from the cookie settings link in the footer | Analytics events: kept for as long as we need them for product analytics, and at most for the retention period of our analytics provider's plan. Session recordings: 30 days. The random id stays on your device for up to 12 months or until you withdraw consent |
| Linking product events to your account (for example saving a job) when you are signed in and have accepted | Your Clerk id and the event, such as job saved. We do not send your email address or name to our analytics tool | Consent (as above) | Kept for as long as we need them for product analytics, and at most for the retention period of our analytics provider's plan, and deleted with your account |
| Security and abuse prevention: bot checks at sign-up, rate limits, server logs | IP address, request details, a bot-check token | Legitimate interest (art. 6(1)(f) GDPR): keeping the service safe | Server logs: a short period, in days. The bot check keeps nothing about you after it runs |
| Answering your requests and complaints, and keeping the records the law asks for | What you send us and our reply | Legal obligation (art. 6(1)(c) GDPR) and legitimate interest | As long as needed to deal with the request, then deleted |
Vacancies come from employers' public postings and the IND public register. That is information about companies and roles, not about candidates. We never see your application; it happens on the employer's site. We do not make decisions about you by automated means and we do not sell personal data or use it for advertising.
Who processes data for us
We use these processors under data processing agreements. They may only use the data to provide their service to us.
- Clerk (Clerk, Inc., United States): Sign-in and account management. Holds your email, name, profile picture and sign-in details.
- PostHog (PostHog, Inc., United States cloud): Product analytics, error tracking and, with consent, session recordings.
- Railway (Railway Corporation): Hosting of the website and the database. Also keeps standard server logs.
- Resend (Resend, Inc.): Sends the emails you switched on. Sees your email address, first name and the email content.
- Cloudflare (Cloudflare, Inc.): Content delivery and security, the Turnstile bot check at sign-up, and cookieless web analytics.
Company logos are fetched by our own server from the companies' public websites and are served to you from jobthing.nl. Your browser does not contact any logo or favicon service, so no third party sees your ip address because of a logo.
Transfers outside the EU
Clerk, PostHog, Resend and Cloudflare are united states companies, and some of your data is processed in the united states. We rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses in the provider's data processing agreement, together with the safeguards each provider describes. You can ask us for a copy of the safeguards that apply.
Cookies and similar storage
We count page loads per day on our own server, grouped by page and by the kind of site that linked to us. We also count how often each job page is opened per day, in the same aggregate way: a number per job, nothing more. This stores no cookie, no IP address and nothing that identifies you.
We follow art. 11.7a of the telecommunicatiewet: cookies and similar storage that are not strictly necessary only start after you accept. Before you choose, analytics runs without cookies and nothing is recorded. Rejecting is as easy as accepting, and the choice is stored for 6 months.
| Name | Who | What for | Lasts | Type |
|---|---|---|---|---|
| __session, __client_uat, __refresh_*, __clerk_* | Clerk (sign-in) | Keeps you signed in and the account secure | Session to 1 year | Strictly necessary. Only set when you sign in or start signing in. No consent needed |
| Cloudflare Turnstile (browser storage, no cookie we set) | Cloudflare (bot check at sign-up) | Tells people from bots | Short-lived | Strictly necessary for security. No consent needed |
| jt_consent | JobThing | Remembers your cookie choice and its version | 6 months | Strictly necessary: it only records your choice. No consent needed |
| jt_lang | JobThing | Remembers whether you chose English or Dutch with the language switch | 1 year | Functional, only set when you pick a language. No consent needed |
| jt_theme | JobThing | Remembers whether you chose the light or dark theme with the theme button | 1 year | Functional, only set when you pick a theme. No consent needed |
| jobthing.pending (session storage) | JobThing | Remembers the save you tried before signing up, so it completes afterwards | Until you close the tab | Functional, you asked for it. No consent needed |
| ph_*_posthog (cookie and local storage), __ph_* | PostHog | Random id so we can recognise returning visitors, and the recording session | Up to 12 months | Analytics. Only after you accept. Removed if you withdraw |
Change your choice at any time: . Withdrawing consent removes the analytics id from your device and stops recording.
Your rights
Under the GDPR you have the right to:
- see what we hold about you (access) and get a copy;
- have wrong data corrected (rectification);
- have your data deleted (erasure);
- limit how we use it (restriction);
- take your data with you in a machine-readable file (portability);
- object to processing based on our legitimate interest;
- withdraw consent at any time, without it affecting what happened before. Unsubscribing or changing the cookie choice does exactly that.
Most of this you can do yourself. In settings you can download your data as a json file and delete your account, which also deletes your sign-in account and asks our analytics tool to delete your profile. For anything else, or if you do not have an account, email [email protected]. We answer within one month.
If you think we handle your data wrongly, please tell us first so we can fix it. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country.
Security and changes
Data is encrypted in transit and access to the database is limited to the people who run the service. If a data breach puts your rights at risk, we tell you and the authority as the law requires. When this policy changes in a way that matters, we update the date above and, where needed, ask for your choice again.