Privacy policy.

remoteli.io is operated by Raven Digital, a private company registered in the Netherlands (KvK 83768106). For the purposes of the GDPR and the UK GDPR, Raven Digital is the data controller of personal data processed through the remoteli.io job board, except where this policy says otherwise.

We can be reached for any privacy question via our contact page.

We collect three kinds of personal data: what you give us, what we observe as you use the product, and what we receive from third parties you connect.

We do not knowingly collect special categories of personal data (health, religion, biometrics, etc.). Please don't put any in a job listing or message — if you do, we will treat it like any other field and you grant us the same processing rights.

We use personal data for a small number of purposes, each tied to a specific legal basis under Article 6 GDPR:

• Run the job board — publishing listings, search, and billing. Legal basis: performance of the contract you signed up under.
• Keep it safe — fraud detection, abuse prevention, blocking bad actors. Legal basis: legitimate interest in a trustworthy product.
• Improve the product — aggregated analytics, A/B tests, debugging. Legal basis: legitimate interest; opt out from Settings → Privacy.
• Tell you things — transactional emails always, marketing only with consent. Legal basis: consent for marketing; contract for transactional.
• Comply with the law — tax records, valid legal requests, court orders. Legal basis: legal obligation.

Personal data is shared in four narrow ways:

1. Other users. When you post a role, job seekers see the role and your company info. Job seekers are never shown to employers — there are no candidate profiles on Remoteli. Applications themselves happen on the employer's own site, not here; we don't receive them or pass them on. That's the whole product.
2. Subprocessors who help us run the service. Listed below. Each is bound by a data processing agreement and processes data only on our instructions.
3. Professional advisors — auditors, lawyers, insurers — under confidentiality, when reasonably needed.
4. Authorities — only with a valid, narrowly-scoped legal request, and only the minimum data required. We publish a transparency report yearly.

The current list lives at remoteli.io/subprocessors. We give 30 days' notice before adding a new one.

Essential cookies keep you signed in, protect forms, run checkout and remember your cookie choice (cc_cookie, 6 months). They are always on.

Analytics only runs after you accept it. Google Analytics then sets _ga and _ga_* (2 years) to count visits and apply clicks, with advertising features switched off, and Sentry records a sample of sessions with all text and inputs masked. Nothing is used for advertising. Change your choice any time under Cookie settings; withdrawing consent deletes the analytics cookies.

Wherever you sit, you have meaningful control over your data. If you're in the EU, UK, Switzerland, Brazil, or California, you have specific statutory rights — but we extend the same controls to everyone.

• Access & export — download a full ZIP of everything we hold from Settings → Privacy → Export. JSON for structured data, original files for uploads.
• Correction — most fields are directly editable. For anything you can't edit, email us.
• Deletion — Settings → Privacy → Delete account. Soft-deleted for 30 days (in case you change your mind), then hard-deleted from primary storage. Backups roll off within 90 days.
• Restriction & objection — pause processing for analytics, marketing, or specific automated decisions.
• Portability — your export is machine-readable JSON, suitable for taking elsewhere.
• Withdraw consent — any time, without affecting prior lawful processing.
• Complain — to us first, please; if we can't fix it, to your local data protection authority. In the Netherlands that's the Autoriteit Persoonsgegevens.

We answer rights requests within 30 days. No charge, no jumping through hoops. If we need to confirm it's really you, we'll do that with the email on the account.

Personal data is processed primarily in the European Economic Area. Some subprocessors and tooling sit in the United States. When data leaves the EEA we rely on:

• The European Commission's Standard Contractual Clauses (2021/914), in the controller-to-processor configuration, plus a transfer impact assessment for each vendor.
• The EU–U.S. Data Privacy Framework where the receiving vendor is certified.
• Additional technical measures: encryption in transit (TLS 1.3) and at rest (AES-256), and minimisation before transfer.

You can request a copy of the SCCs we use via our contact page.

We keep data only as long as it's useful to you or required of us. After that, it's deleted on a rolling basis.

Security is not a checkbox; we treat it as part of the product. Highlights:

• Encryption in transit (TLS 1.3) and at rest (AES-256, AWS KMS-managed keys).
• 2FA available on every account; required for employer admins and our entire team.
• Least-privilege access. Production access is restricted and audited.
• Responsible disclosure: if you find a vulnerability, please report it via our contact page.

If we ever experience a personal-data breach that's likely to risk your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and you without undue delay.

remoteli.io is built for working professionals and is not intended for anyone under 18. We don't knowingly collect personal data from children. If you believe a child has signed up, contact us and we'll close the account and delete the data within 7 days.

We update this policy when the product changes meaningfully or when the law does. For material changes we email everyone at least 30 days before the new version takes effect, and we publish a changelog at the bottom of this page so you can see exactly what moved.

Cosmetic edits — typo fixes, clarifications, renamed sections — happen without notice; the "last updated" date will change.

For anything privacy-related:

• Contact form: remoteli.io/contact
• EU representative under Art. 27 GDPR: not required — we are established in the EU.