Privacy

Referly is operated by Yusif Alakbarzade, . We are the data controller for the personal data described here. You can reach me at alakbarzadeyusif@gmail.com.

From LinkedIn, when you sign in

Your name, email address, profile photo, and your LinkedIn member identifier. That is everything LinkedIn's sign-in gives us — it does not send us your work history, connections, or activity.

From you, on your profile

Headline, short bio, location, current company and job title, skills, an optional link to your LinkedIn profile, and your CV.

From how you use the service

Listings you post, referral requests you send or receive, your answers to screening questions, chat messages, ratings and tags, outcome check-ins, and any reports or blocks you make.

What we don't collect

No advertising or analytics trackers, no behavioural profiling, no location tracking, and no data bought from third parties.

Your CV is the most sensitive thing we hold, so it's worth being precise about it.

When you upload one, we store the file and extract its text. The text is sent to Anthropic's Claude API to write your fit summary when you request a referral. The file itself can be downloaded by a referrer only after they accept your request — before that, they see the summary and your answers, not the document. Downloads use links that expire after two minutes.

You can replace or delete your CV at any time from your profile. If you don't sign in for 12 months, we delete it automatically without you having to ask.

• To run the service — accounts, listings, referral requests, chat, ratings. Basis: performance of our contract with you.
• To write your fit summary using your CV and the role's requirements. Basis: performance of our contract — it's the service you asked for when you clicked Request a Referral. You can decline simply by not uploading a CV.
• To verify people are real via LinkedIn, and to act on reports and blocks. Basis: our legitimate interest in a marketplace that isn't full of fake employers.
• To take payment for featured listings. Basis: performance of contract. Job seekers are never charged.

There isn't any. The AI fit summary is advisory text — it produces no score, no ranking, and no accept or reject decision. It cannot filter you out of anyone's queue. A human referrer reads it and decides, and can disagree with it freely.

This means Article 22 GDPR — the right not to be subject to solely automated decisions — is not engaged, because no decision about you is made automatically. How AI is used here explains this in detail.

Other users see what you'd expect: your public profile, and — if you request a referral from them — your summary, your answers, and after they accept, your CV.

We use these processors to run the service. They act on our instructions:

Anthropic does not use data sent through its API to train its models. Transfers outside the EU are covered by Standard Contractual Clauses in our agreements with each provider.

We do not sell personal data, and we do not share it for advertising.

• Your CV — until you delete it, or 12 months after you last sign in, whichever comes first.
• Your account and everything in it — until you delete it. Deletion is immediate and permanent.
• Payment records — retained by Stripe as long as tax and accounting law requires.

Under the GDPR you can:

• See what we hold — email us and we'll send you a copy within one month.
• Correct it — edit your profile directly at any time.
• Delete it — do it yourself from your profile. No need to ask us, and no waiting.
• Take it elsewhere — ask us and we'll send your data in a machine-readable format.
• Object or restrict — tell us and we'll stop, unless we're legally required to continue.

You can also complain to your data protection authority. In Poland that is the Urząd Ochrony Danych Osobowych (UODO).

We set cookies to keep you signed in, and nothing else. No advertising cookies, no analytics, no third-party trackers. Because sign-in cookies are strictly necessary for a service you asked for, there is no consent banner to click.

Access rules are enforced in the database itself, not just in the interface, so a malformed request can't reach further than the app allows. CVs are stored in a private bucket that is never publicly readable and is only ever served through short-lived signed links.

No system is perfect. If you think you've found a security problem, please email us at alakbarzadeyusif@gmail.com rather than posting it publicly.

If we change how we use your data in a way that matters, we'll tell you in the app rather than quietly editing this page and updating the date.