Legal
Privacy
What we collect, why, and how to make us delete it.
Last updated: 11 August 2026
No trackers
No analytics, no advertising, no profiling.
Nothing sold
Your data is never sold or shared for ads.
Delete it yourself
Instant and permanent, from your profile.
Database in the EU
Your account and files are stored inside the EU.
The short version
We hold your LinkedIn name and email, whatever you put on your profile, and your CV. Your CV is read by an AI model to write a fit summary, and can be opened by a referrer only after they accept your request. We don't sell anything, we don't run ad trackers, and you can delete everything yourself, instantly, from your profile page.
Who is responsible
Referly is operated by Yusif Alakbarzade, Bonifraterska 13, 00-203 Warsaw, Poland, who is the data controller for the personal data described here. Reach us at support@referlyhq.com and we'll answer.
What we collect
From LinkedIn, when you sign in
Your name, email address, profile photo, and your LinkedIn member identifier. That is everything LinkedIn's sign-in gives us, it does not send us your work history, connections, or activity.
From you, on your profile
Headline, short bio, location, current company and job title, skills, an optional link to your LinkedIn profile, and your CV.
From how you use the service
Listings you post, referral requests you send or receive, your answers to screening questions, chat messages, ratings and tags, outcome check-ins, and any reports or blocks you make. If you ask to be told when a role with no referrer yet gets one, we keep that you asked, and nothing else: no note, no CV, no answers. Only Referly staff can see who asked, and the referrer who eventually arrives sees you only if you then choose to ask them.
What we send you
Email, when something happens: somebody asks you for a referral, somebody decides on a request you sent, a message is waiting, a referral you made is due a check-in, or a role you asked to be told about has found its referrer. Never more than one message email a day, and nothing at all when nothing has happened. No newsletter, no product announcements, no marketing of any kind. Every one of them has a link that turns them all off without signing in, and the same switch is on your profile.
What we don't collect
No advertising or analytics trackers, no behavioural profiling, no location tracking, and no data bought from third parties.
Your CV, specifically
Your CV is the most sensitive thing we hold, so it's worth being precise about it.
When you upload one, we store the file and extract its text. The text is sent to our AI provider to write your fit summary when you request a referral. The file itself can be downloaded by a referrer only after they accept your request. Before that, they see the summary and your answers, not the document. Downloads use links that expire after two minutes.
You can replace or delete your CV at any time from your profile. If you don't sign in for 12 months, we delete it automatically without you having to ask.
Why we process it, and on what basis
- To run the service: accounts, listings, referral requests, chat, ratings. Basis: performance of our contract with you.
- To write your fit summary using your CV and the role's requirements. Basis: performance of our contract, it's the service you asked for when you clicked Request a Referral. You can decline simply by not uploading a CV.
- To verify people are real via LinkedIn, and to act on reports and blocks. Basis: our legitimate interest in a marketplace that isn't full of fake employers.
- To email you when something happens on a referral you are part of. Basis: performance of our contract, since being told is the service working rather than an extra. You can switch it off at any time and everything still happens inside Referly.
- To keep a report after the reported account is deleted, holding that person's name and LinkedIn identifier and nothing else of theirs, for two years. Basis: our legitimate interest in preventing abuse. Without it, deleting an account would erase every complaint made about it, and anyone could clear their own record by signing up again.
- To take payment for featured listings. Basis: performance of contract. Job seekers are never charged.
Automated decision-making
There isn't any.
The AI fit summary is advisory text. It produces no score, no ranking, and no accept or reject decision, and it cannot filter you out of anyone's queue. A human referrer reads it and decides, and can disagree with it freely.
This means Article 22 GDPR, the right not to be subject to solely automated decisions, is not engaged, because no decision about you is made automatically. How AI is used here explains this in detail.
How long we keep it
Your CV
Until you delete it, or 12 months after you last sign in, whichever comes first.
Your account and everything in it
Until you delete it. Deletion is immediate and permanent.
Reports other people made about you
Two years, and they outlive your account. If someone reported you, deleting your account does not erase the report: it keeps your name and your LinkedIn identifier, and nothing else of yours. Otherwise anyone could clear their record by signing up again. After two years a closed report is deleted and an open one loses your name.
Payment records
Held by our payment processor as long as tax and accounting law requires.
Your rights
Under the GDPR you can:
- See everything we hold: it's all on your data page, live, with nothing held back. Or email us and we'll send a copy within one month.
- Correct it: edit your profile directly at any time.
- Delete it: do it yourself from your profile. No need to ask us, and no waiting. One exception, and it is the only one: if somebody has reported you, the report stays, with your name and LinkedIn identifier on it. See how long we keep it.
- Take a copy with you: download everything we hold as one file from your data page. It's a standard format, so another service can read it if you ever want to move.
- Tell us to stop: ask us to stop using your data for something, or to leave it untouched while a question is being sorted out, and we will, unless the law says we have to keep it.
- Complain about us: if you think we have handled your data badly, you can take it to the data protection authority in the country you live or work in. You do not have to raise it with us first, though we would rather you did, because we can usually fix it faster.
Security
Access rules are enforced in the database itself, not just in the interface, so a malformed request can't reach further than the app allows. CVs are stored in a private bucket that is never publicly readable and is only ever served through short-lived signed links.
No system is perfect. If you think you've found a security problem, please email us at support@referlyhq.com rather than posting it publicly.
Changes
If we change how we use your data in a way that matters, we'll tell you in the app rather than quietly editing this page and updating the date.