What we collect
When you post a job, we collect your email address, company name, and job details. When you apply for a job, we collect your name, email, and any files you upload (resume, cover letter).
How we use it
Your information is used solely to facilitate job postings and applications. We do not sell your data to third parties.
Payment processing
Payments are processed securely by Stripe. We do not store your credit card details.
Data storage
Data is stored on Cloudflare's infrastructure within the European Union for GDPR compliance.
How long we keep your data
Job postings and applications are retained for as long as the job is active plus 12 months for recordkeeping. Draft posts and expired jobs are deleted after 90 days. Scraped public job listings are retained while the source job is live and removed when delisted. You can request earlier deletion at any time.
Third-party services we use
We share the minimum data necessary with the following processors to operate Ergazo:
- Cloudflare — hosting, CDN, database (D1), file storage (R2). All data is stored in the European Union.
- Stripe — payment processing for job postings. Stripe receives your email and billing details directly; we never see your card number.
- Resend — transactional email delivery (receipts, magic edit links, application notifications).
- Meta Platforms (Facebook, Instagram) — we use the Meta Graph API to publish job listings and educational content to our own Facebook Page and Instagram Business account. We do not read your personal Meta data, and we do not use Facebook Login to sign users into Ergazo.
- Google — we fetch public company logos via Google's favicon service using the company's public website domain. No user data is sent.
Facebook and Instagram integration
Ergazo operates a Facebook Page and linked Instagram Business account that re-publish job listings and educational content. We hold a long-lived Page access token for our own Page, stored encrypted as an environment secret on Cloudflare — it is not associated with any visitor to Ergazo. We do not request Facebook Login permissions from site visitors, do not read user timelines, friend lists, messages, or any other personal Meta data, and do not advertise on Meta platforms. Visitors who interact with our Page or Instagram posts on Meta are subject to Meta's own Privacy Policy.
Who we share data with
Personal data is shared only with the processors listed above, strictly to operate Ergazo. When you apply to a job, your application is forwarded to the employer's contact address (see "Application forwarding" below — this is the core purpose of the service). We do not sell, rent, or trade personal data. We may disclose information if legally required by a Cypriot or EU authority.
Application forwarding
When a job listing offers email applications, the address shown on Ergazo is a per-job forwarding alias of the form apply-{token}@ergazo.com — never the recruiter's real address. Sending an application to that alias triggers the following:
- Cloudflare Email Routing receives your message and passes it to our worker.
- Our worker composes a new email from the alias to the recruiter, with Reply-To set to your address so the recruiter can write to you directly. Your message body and any attachments are forwarded as-is.
- We send you a confirmation email with a reference ID. If the recruiter's mailbox bounces, we retry and then notify you with a delivery-failed email.
What we store, and for how long:
- The alias-to-recruiter mapping (job_apply_aliases): kept while the job is active, deleted when it closes.
- Delivery metadata (apply_forward_log): your email address, status (forwarded / bounced / failed), timestamps. Auto-purged after 7 days. The 7-day window exists only to support bounce notifications.
- Per-job application counter (jobs.apply_forward_count): permanent, but it's about the job, not you.
What we do NOT store: the body of your message, the subject line, your attachments (CV, resume, cover letter). These are held only in memory for the seconds it takes to forward.
Once your application reaches the recruiter, the recruiter and their company become independent data controllers for the data you sent — Ergazo is not responsible for how they handle it. Their privacy policy applies from that point.
You can check the delivery status of an application at /api/applications/status?ref={reference}&email={your-email}, or request immediate purge of your forwarding-log row by contacting privacy@ergazo.com.
Children
Ergazo is not directed at children under 16 and we do not knowingly collect data from minors. If you believe a minor has submitted personal data, contact privacy@ergazo.com and we will delete it.
Your rights
You can request deletion of your data at any time by emailing privacy@ergazo.com.
Cookies
We use essential cookies to keep the site working. With your consent, we also use analytics cookies (Google Analytics, Plausible) to understand how visitors use the site, and marketing cookies (Meta Pixel) for advertising. You can manage your preferences at any time via the cookie settings in the footer.
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced on the Ergazo homepage.
Contact
Data controller: Ergazo, Cyprus. For privacy inquiries, data access, or deletion requests: privacy@ergazo.com