Privacy policy
Translation
This is an English translation provided for convenience. The legally binding text is the Russian version; if the two differ, the Russian version prevails.
In short
We keep your email address only for subscription emails: the key, the receipt and a reminder before the paid period ends. Jobs, résumés, contacts and notes live in the browser on your device, and we have no access to them. We never see your card details: payments are processed by YooKassa, or by lava.top when you pay with a card from outside Russia. The website has visit counters, but the foreign ones don’t load until you allow them — and on the English version of the site no counters load at all before you do.
Contents
- Operator
- Key terms
- Consent
- What data is processed
- Purposes and legal bases
- Actions with data
- Retention periods
- Destruction of data
- Transfer to third parties
- Cross-border transfer
- Where databases are located
- Security measures
- Your rights
- Withdrawing consent
- Incidents
- Minors
- Notification of Roskomnadzor
- Cookies and counters
- Changes to the policy
- Contacts
1. Personal data operator
This policy sets out how the personal data of users of the Job Huntly browser extension and the jobhuntly.pro website is processed and protected, and is issued pursuant to part 2 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (152-FZ).
| Operator | Anastasia Vladimirovna Zenkina, a self-employed individual (professional income tax payer) |
|---|---|
| INN (taxpayer number) | 772375205476 |
| jobhuntlyy@gmail.com |
The operator organizes and carries out the processing of personal data independently and is responsible for it. The person responsible for organizing personal data processing is the operator herself.
2. Key terms
- User — an individual who uses the extension or the website.
- Service — the Job Huntly extension and the jobhuntly.pro website.
- Personal data — any information relating to a directly or indirectly identified individual.
- Hash — an irreversible transformation of a value. A hash lets you check whether a value matches one already known, but the value itself cannot be restored from it.
- Local storage — an area of the user’s browser memory on their device where the extension saves its working data.
- Other terms have the meanings given in 152-FZ.
3. Consent to personal data processing
3.1. Consent is given as a separate action — by ticking the corresponding box when subscribing. The box is not ticked in advance. The text of the consent is on the “Consent to personal data processing” page.
3.2. The consent is specific, informed, conscious and unambiguous. Silence or inaction of the user is not consent.
3.3. Refusing consent to the processing of data that is not necessary to provide the service does not lead to a refusal to provide it (Article 16 of the Law of the Russian Federation “On Protection of Consumer Rights”).
3.4. To the extent necessary to perform the contract and the obligations imposed on the operator by law, processing is carried out without separate consent — on the bases set out in section 5.
4. What personal data is processed
| Data | Why | Where it is stored |
|---|---|---|
| Email address | Sending the license key, the receipt and a reminder before the paid period ends; answering requests | The operator’s database, together with the subscription: the key, the receipt and a reminder before the paid period ends are sent to this address. Deleted at the user’s request. The address also remains with the payment service (YooKassa or lava.top) and in the log of the email service that delivers the message. No copy of the email is sent to the operator |
| Hash of the email address | Recognizing a returning user: “paid with the same email — extend the same subscription” | The operator’s database |
| Hash of the license key and hash of the access token | Checking the subscription without storing the secrets themselves | The operator’s database |
| Plan, period, dates and amounts of payments, YooKassa or lava.top payment ID | Accounting for the subscription, protection against crediting the same payment twice | The operator’s database |
| Device ID — a random string the extension creates by itself | The “three devices per key” limit and accounting for the trial period | The operator’s database |
| Counters of used checks and searches and their cost | Enforcing the monthly package and the daily limit | The operator’s database |
| IP address when entering the license key | Protection against key guessing | The operator’s database, deleted automatically after an hour |
| Text of a support request and the reply address | Answering the request | The operator’s mailbox |
4.1. The operator does not process special categories of personal data or biometric data.
4.2. Data in the browser’s local storage — saved jobs, résumé text, found company contacts, notes, settings — is stored only on the user’s device. The operator has no access to it, does not receive it and does not store it. The only exception is section 9: the résumé text and the job text are sent for processing at the moment the user clicks “Check résumé” or “Find contacts” themselves, and are not saved in the operator’s databases.
4.3. The operator does not collect the personal contact details of company employees. The contact search returns only what the company itself published for candidates: the careers section of its website, the company’s LinkedIn page and a general work email address.
4.4. The operator neither receives nor stores bank card details. Card details are entered on the payment service’s side; the operator only receives a notification of the payment result.
4.5. The operator does not make decisions that have legal consequences for the user solely on the basis of automated processing of personal data.
5. Purposes of processing and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing access to the Service, issuing and checking the license key | Email hash, key hash, device ID, the fact of payment | Article 6(1)(5) of 152-FZ — performance of a contract (acceptance of the offer) |
| Sending the key, the receipt and a reminder before the paid period ends | Email address, plan, amount and date of payment, subscription end date | Article 6(1)(5) of 152-FZ and the obligation under 422-FZ |
| Checking how well a résumé matches a job and searching for a company’s public contacts | Résumé text, job text, company name | User consent (Article 9 of 152-FZ) — separate, see section 10 |
| Enforcing paid limits and protection against key guessing | Usage counters, device ID, IP address | Article 6(1)(5) of 152-FZ and the operator’s legitimate interest in protecting the Service |
| Answering requests | Email address, text of the request | Article 6(1)(5) of 152-FZ and consent |
5.1. The operator does not use personal data for advertising mailings and does not share it with advertising networks or analytics platforms.
5.2. Processing is limited to achieving the purposes listed. Processing incompatible with these purposes is not allowed.
6. Actions with personal data
The operator carries out mixed (automated and non-automated) processing: collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access) in the cases of section 9, anonymization, blocking, deletion, destruction.
7. Retention periods
- Email address and its hash, key hash, plan, dates and amounts of payments — for the duration of the subscription and 3 years after the last payment (the limitation period and tax accounting requirements), after which they are destroyed.
- Device ID and access token hash — until that device’s access is revoked or the subscription is destroyed.
- Device ID for the trial period — 30 days from the first launch.
- IP address when entering the key — 1 hour, deleted automatically.
- Usage counters — 12 months, after which they are used only in anonymized form.
- Support requests — 1 year from the date of the last request.
- Résumé and job texts sent for checking — not stored by the operator: they are transmitted at the time of the request and not written to the operator’s databases.
- Data in the browser’s local storage — until the user deletes it or removes the extension. The operator has no access to it and does not control how long it is kept.
If the retention period is not set by contract or law, the data is stored until the purpose of processing is achieved or consent is withdrawn.
8. Destruction of data
8.1. Data is destroyed: when the periods in section 7 expire; when the purpose of processing is achieved — within 30 days (Article 21(4) of 152-FZ); when consent is withdrawn — within 30 days, unless otherwise provided by contract or law; when unlawful processing is discovered — within 10 business days.
8.2. Destruction is carried out by deleting records from the operator’s databases without the possibility of recovery. The destruction is recorded in a certificate; at the user’s request, the operator confirms the destruction.
8.3. Data the operator is required by law to keep (for example, information reflected in fiscal receipts) is not destroyed.
9. Transfer of personal data to third parties
| Recipient | Purpose of transfer | What is transferred |
|---|---|---|
| YooKassa — YooMoney LLC (non-bank credit institution), Russia | Accepting payments, issuing receipts | Email address, payment amount, plan name. Card details are not passed to the operator |
| lava.top — Lavalane LTD, Republic of Cyprus | Accepting payment in US dollars by a card from outside Russia — only if the user chose such payment themselves | Email address, plan, amount and currency of the payment. Card details are not passed to the operator |
| Center of National Intelligent Systems, Russia | Access to language models, accounting of used calls | Résumé text, job text, company name, technical request ID |
| Language model providers — Perplexity AI, Inc. (USA) and Google LLC (USA) | Processing the request by the model: checking how well a résumé matches a job, searching for a company’s public pages | Résumé text, job text, company name |
| Hosting provider — REG.RU, Russia | Hosting the website and the subscription database | Subscription data from section 4 |
| Email service — Mailo Post LLC (Mailopost), Russia | Delivering service emails: the key, the receipt and a reminder before the paid period ends | The buyer’s email address, the subject and text of the email |
| Yandex Metrica — YANDEX LLC, Russia VK Ads counter — VK LLC, Russia | Counting website visits and measuring advertising | Information about website visits from section 18. Form contents are not transferred |
| Google LLC (USA) LinkedIn Ireland Unlimited Company (Ireland) | Counting website visits and measuring advertising — only with the user’s consent | Information about website visits from section 18. Form contents are not transferred |
9.1. Data is transferred to the persons listed only to the extent necessary for the stated purposes and on the operator’s instructions in accordance with part 3 of Article 6 of 152-FZ. The operator requires them to maintain confidentiality and data security.
9.2. The résumé text and the job text are transferred only on the user’s direct action — clicking “Check résumé” or “Find contacts”. Without this action, this data does not leave the user’s device.
9.3. The operator may change the language model provider. The current list of recipients and countries is maintained in this section; users with an active subscription are notified by email at least 10 days before a recipient located outside the Russian Federation is changed.
9.4. Users are advised to remove unnecessary personal data from their résumé (surname, home address, passport details, date of birth, phone number, health information, other people’s data) before using the check. The operator does not ask for such information and does not need it for the Service to work.
9.5. Data may be provided to government authorities in the cases, manner and scope provided by the laws of the Russian Federation.
10. Cross-border transfer of personal data
10.1. Cross-border transfer takes place in three cases:
10.1.1. Résumé check and contact search — the résumé text, the job text and the company name are transferred to servers located outside the Russian Federation, including in the United States of America, a state that does not ensure adequate protection of the rights of personal data subjects.
10.1.2. Website visit counters — information about website visits (section 18) is transferred to the United States of America (Google LLC) and Ireland (LinkedIn Ireland Unlimited Company). Ireland is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and is among the states that ensure adequate protection; the United States of America is not.
10.1.3. Payment with a card from outside Russia — the email address, plan, amount and currency of the payment are transferred to the lava.top payment service (Lavalane LTD, Republic of Cyprus). Cyprus is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and is among the states that ensure adequate protection. The legal basis is the performance of a contract with the user (Article 6(1)(5) of 152-FZ): the transfer happens only if the user chose “Pay in US dollars” in the payment window themselves; when paying with a Russian card, data is not transferred abroad.
10.2. Before starting such a transfer, the operator sends Roskomnadzor (the Russian data protection authority) a notification of the intention to carry out cross-border transfer of personal data (part 4 of Article 12 of 152-FZ) and carries out the transfer taking into account the authority’s decision.
10.3. Transfer in cases 10.1.1 and 10.1.2 takes place only with the user’s separate consent, given in accordance with item 1 of part 4 of Article 12 of 152-FZ. Transfer in case 10.1.3 takes place to perform the contract at the user’s choice, to a state that ensures adequate protection.
10.4. Consent to transferring the résumé and job text is requested in the extension, before the first use of the résumé check or contact search — with a separate checkbox, unrelated to subscribing and not ticked in advance. The text of the consent is on the “Consent to personal data processing” page. Until consent is given, these two features are unavailable, and no requests are sent outside the Russian Federation.
10.5. Consent to foreign counters is requested on the website, on the first visit — with a separate prompt offering an equal choice between “Accept” and “Necessary only”, with no preselected option. Until “Accept” is clicked, Google and LinkedIn scripts are not loaded and not a single request is sent to them. The decision is stored only in the user’s browser and can be withdrawn with the button in section 18.
10.6. If the user does not consent to cross-border transfer, only the résumé check and the contact search are unavailable, and the foreign counters are not loaded. All other features of the Service remain fully available, the subscription is provided on the general terms, and the price does not change.
What you can do
Before sending a résumé for checking, the extension shows the text that will be transferred. Remove everything unrelated to your experience and skills — surname, phone number, address. This information is not needed to assess the match with a job.
11. Where the databases are located
11.1. Pursuant to part 5 of Article 18 of 152-FZ, the recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation is carried out using databases located in the territory of the Russian Federation.
11.2. Location of the databases: REG.RU, Moscow, Russia.
12. Personal data security measures
The operator takes the legal, organizational and technical measures provided for in Articles 18.1 and 19 of 152-FZ:
- appointing a person responsible for organizing personal data processing;
- issuing and applying this policy;
- identifying security threats and applying the protective measures established by Resolution of the Government of the Russian Federation No. 1119 of 01.11.2012;
- storing the license key and the access token only as irreversible hashes; the email address is stored only for service emails about the subscription and is not used for anything else;
- not storing résumé texts, job texts or found contacts on the operator’s side;
- transferring data over the secure HTTPS protocol;
- restricting access to the subscription database: only the operator has access;
- backups and recovery checks;
- detecting and responding to unauthorized access;
- periodically assessing the effectiveness of the measures taken.
13. Rights of the personal data subject
The user has the right to:
- receive information about the processing of their data to the extent set out in part 7 of Article 14 of 152-FZ;
- demand clarification, blocking or destruction of data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- withdraw consent to processing;
- object to processing for the purpose of promoting goods and services;
- appeal against the operator’s actions to Roskomnadzor or in court;
- claim compensation for losses and moral damage in court.
13.1. The request is sent to jobhuntlyy@gmail.com and must contain information that identifies the user (the subscription email address, the license key) and a signature — handwritten or electronic.
13.2. The operator’s response times:
- providing information about processing — 10 business days, which may be extended by no more than 5 business days with notice of the reasons;
- correcting inaccurate data — 7 business days from the day supporting information is provided;
- destruction upon withdrawal of consent — 30 days;
- blocking for the period of verification — from the moment of the request until the verification is complete.
14. Withdrawing consent
14.1. Consent can be withdrawn at any time by email to jobhuntlyy@gmail.com with the subject “Withdrawal of consent”, or in the extension: Settings → Data → Withdraw consent.
14.2. Consent to cross-border transfer is withdrawn separately from the general consent — the rest of the processing continues.
14.3. After withdrawal, the operator stops processing and destroys the data within 30 days, except data it is required to keep by law and data necessary to perform a current contract. Withdrawing consent during an active subscription means it can no longer be provided; settlements are made under section 6 of the offer.
15. Incident response
15.1. If an unlawful or accidental transfer of personal data that violated the rights of data subjects is established, the operator notifies Roskomnadzor of the incident within 24 hours and of the results of the internal investigation within 72 hours (part 3.1 of Article 21 of 152-FZ).
15.2. Users whose data is affected by the incident are notified by email within the same period as the authority.
16. Minors
The Service is intended for persons aged 18 and over. The operator does not intentionally collect data of persons under 18. If such data is found, it is deleted unless a legal representative has confirmed consent to processing.
17. Notification of Roskomnadzor
The operator has sent Roskomnadzor a notification of personal data processing in accordance with part 1 of Article 22 of 152-FZ. Registration number in the register of operators: fill in the number or “notification filed on DD.MM.YYYY”.
18. Cookies and counters
18.1. The jobhuntly.pro website uses visit counters: they show the operator how many people came to the site, from which page, which buttons they clicked and whether they reached payment. This information is needed to measure advertising and improve the website.
18.2. Form contents are not passed to counters. The email address the user enters in the payment window is not available to counters.
18.3. Yandex Metrica records actions on the page (“Webvisor”): mouse movements, scrolling, clicks. The contents of input fields are not recorded — the email field is excluded from recording at the page markup level, and other fields are recorded as placeholder characters. Recordings are stored by YANDEX LLC in the territory of the Russian Federation and are not transferred outside it.
18.4. Counters fall into two groups depending on where the data goes.
| Counter | Operator and country | When it loads |
|---|---|---|
| Yandex Metrica | YANDEX LLC, Russia | When the site opens (on the English version — only after consent) |
| VK Ads counter (top.mail.ru) | VK LLC, Russia | When the site opens (on the English version — only after consent) |
| Google Tag Manager, Google Analytics, Google Ads | Google LLC, USA | Only after consent |
| LinkedIn Insight Tag | LinkedIn Ireland Unlimited Company, Ireland | Only after consent |
18.5. Counters process: IP address, cookie ID, device and browser type, language, screen resolution, the address of the opened page, the referral source, button clicks and the fact of going to payment. Yandex Metrica additionally processes information about actions on the page under clause 18.3.
18.6. Foreign counters do not load before consent. On the first visit, a prompt about counters is shown. Until “Accept” is clicked, not a single request is sent to Google and LinkedIn, their cookies are not set, and they do not know about the visit. This is a separate consent to cross-border transfer under item 1 of part 4 of Article 12 of 152-FZ.
18.7. If you choose “Necessary only”, foreign counters do not load, and the website keeps working fully: buying a subscription, the documents and support are available without any restrictions.
18.8. You can change your decision at any time — it is stored only in your browser and is not sent to any server:
18.9. Technical cookies may be set by the payment service on its own pages — they are necessary for the security of the transaction.
18.10. There are no counters in the extension itself — none of the scripts listed above. The extension uses the browser’s local storage for its own working data: it is not cookies and is not sent anywhere.
18.11. On the English version of the site (pages under jobhuntly.pro/en/), no counters are loaded before you click “Accept” — including Yandex Metrica and the VK Ads counter.
19. Changes to the policy
19.1. The operator may change the policy. The new version takes effect when published at jobhuntly.pro/docs/privacy.html, unless it specifies a different date.
19.2. Users with an active subscription are notified by email of material changes at least 10 days before they take effect.
19.3. Previous versions are provided on request.
20. Contacts and final provisions
For any questions about personal data processing: jobhuntlyy@gmail.com. Full details are on the “Company details and contacts” page.
Supervisory authority: the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), rkn.gov.ru.
This policy is a public document and has been drawn up in accordance with the laws of the Russian Federation.