Privacy Policy

1. Who operates SubFormal

SubFormal is operated by Olga Lipinskaya, who is the data controller for the personal data described in this Privacy Policy.

2. Account and authentication information

You can browse job opportunities on SubFormal without creating an account.

Some features, including posting comments, require you to sign in.

SubFormal uses Firebase Authentication to provide account authentication. Depending on how you create or access your account, authentication may be provided using Google Sign-In or an email address and password.

SubFormal stores account information including:

• your Firebase user identifier (UID);
• your email address;
• your display name, if provided; and
• your account role.

This information is used to authenticate you, maintain your SubFormal account, provide account-based features, and protect the service against misuse.

Firebase Authentication may also process technical information such as IP addresses and user-agent information for authentication, security, account management, and abuse prevention.

SubFormal does not sell your account information or use it for advertising.

3. Comments and public content

Signed-in users may post comments relating to job opportunities.

When you post a comment, SubFormal stores information including:

• the comment;
• the job opportunity to which the comment relates;
• your Firebase UID;
• your email address; and
• the date and time the comment was created or updated.

Your email address is not displayed publicly as part of your comment.

Comments displayed on SubFormal may show your display name. If no display name is available, the service may display the comment as being posted by “Anonymous.”

Comments are public content. You should not include personal, confidential, sensitive, or other information in a comment that you do not want other users to see.

4. Job searches and browser storage

SubFormal may use browser storage to provide functionality on your device.

Search terms, selected filters, and related search state may be stored temporarily in your browser's session storage so that your search can be preserved while you navigate the service.

If you start writing a comment but do not submit it, the draft may be stored locally in your browser so that it can be restored when you return to the relevant job opportunity.

SubFormal does not send these locally stored search states or unsubmitted comment drafts to its backend for analytics.

Browser storage used for these purposes is intended to provide functionality requested by you and is not used for advertising or behavioral tracking.

5. Usage analytics and advertising

SubFormal does not collect usage analytics through Google Analytics, Firebase Analytics, or similar analytics services.

SubFormal does not use advertising trackers or behavioral profiling to track users across websites or services.

SubFormal does not sell personal data for advertising purposes.

6. Job opportunities and external websites

SubFormal displays information about job opportunities obtained from external sources.

When you follow an external link, including an application or source link, you leave SubFormal and interact directly with the relevant third-party website.

SubFormal does not control how those third parties collect or process your personal data. Their own privacy policies and terms apply to your interaction with their websites.

SubFormal does not receive information that you submit directly to an employer or another third party after leaving SubFormal unless that information is separately provided to SubFormal.

7. Service providers and data storage

SubFormal uses third-party services to operate the service, including Google services such as Firebase Authentication, Google Cloud, and Google BigQuery.

SubFormal uses Google BigQuery to store account information, comments, and other information necessary to operate the service.

SubFormal's BigQuery dataset is located in the European Union.

Firebase Authentication may process authentication information in the United States, including information necessary to authenticate and manage your account.

Google and its subprocessors may process information in other countries where they maintain facilities, subject to applicable data-protection requirements.

8. International data transfers

Because SubFormal is available worldwide and uses international service providers, personal data may be processed outside the country where you live.

In particular, some authentication information may be processed in the United States.

Where applicable data-protection law requires safeguards for international transfers, SubFormal relies on appropriate transfer mechanisms made available by its service providers, which may include applicable adequacy decisions or frameworks, standard contractual clauses, or other legally recognized safeguards.

9. Legal bases for processing

Where the EU GDPR, UK GDPR, or another law requiring a legal basis for processing applies, SubFormal processes personal data only where an appropriate legal basis exists.

SubFormal processes account and authentication information where necessary to provide the account and service features you request.

When you submit a comment, SubFormal processes the comment and related account information in order to provide the discussion functionality you have chosen to use.

SubFormal may also process limited account, comment, and technical information where necessary for its legitimate interests in operating, securing, moderating, maintaining, and preventing misuse of the service, provided those interests are not overridden by your applicable rights and interests.

Where processing is based on consent, you may withdraw that consent in accordance with applicable law.

10. Data retention and account deletion

SubFormal retains your account information while your account remains active and as necessary to provide the service.

You may request deletion of your SubFormal account.

If you request account deletion, SubFormal will, within 30 days:

• delete personal data associated with your SubFormal account from systems under SubFormal's control;
• initiate deletion of your Firebase Authentication account; and
• delete or irreversibly anonymize comments associated with your account so that they are no longer linked to your account, Firebase UID, or email address.

When you delete an individual comment, it may temporarily remain in SubFormal's systems in a soft-deleted state.

Soft-deleted comments are permanently deleted or irreversibly anonymized within 30 days.

Certain information may be retained for longer where required by law or reasonably necessary for security, prevention of abuse, or the establishment, exercise, or defense of legal claims.

Information retained by service providers following a deletion request may also remain temporarily in backup or other systems according to their applicable retention processes.

11. Your privacy rights

Depending on where you live and the law that applies to you, you may have rights concerning your personal data.

These may include the right to:

• request access to personal data held about you;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of certain processing;
• object to certain processing;
• receive certain personal data in a portable format where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint with an applicable data-protection or privacy authority.

Not all rights apply in every jurisdiction or in every circumstance.

To exercise a privacy right relating to information controlled by SubFormal, please use the contact details in Section 17 below.

European Economic Area

If the EU GDPR applies to you, you have the rights provided by the GDPR and may lodge a complaint with a competent data-protection supervisory authority.

Because SubFormal is operated from Denmark, the Danish Data Protection Agency (Datatilsynet) is the supervisory authority for SubFormal's establishment in Denmark.

Depending on the circumstances, you may also have the right to lodge a complaint with the supervisory authority in the EEA country where you live or work, or where an alleged infringement occurred.

United Kingdom

Where the UK GDPR applies, you may have the rights provided by the UK GDPR and the Data Protection Act 2018.

You may also lodge a complaint with the United Kingdom's data-protection regulator, the Information Commissioner's Office (ICO).

Switzerland

Where the Swiss Federal Act on Data Protection (FADP) applies, you may have rights concerning personal data processed about you, including applicable rights of access and correction.

The federal data-protection authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

Other countries

If you live outside the EEA, United Kingdom, or Switzerland, applicable privacy law in your jurisdiction may provide additional rights.

SubFormal will honor applicable privacy rights where required by law.

12. United Kingdom representative

SubFormal is operated from Denmark.

Where SubFormal is required under the UK GDPR to maintain a representative in the United Kingdom, the representative's contact details will be made available in this Privacy Policy.

Until separate UK representative contact details are provided here, privacy questions and requests concerning SubFormal may be sent using the contact details in Section 17.

13. Security

SubFormal uses reasonable technical and organizational measures appropriate to the nature and scope of the personal data it processes.

Authentication is provided using Firebase Authentication, and access to account-based backend functionality is authenticated before protected operations are performed.

However, no online service can guarantee absolute security.

You are responsible for maintaining the security of credentials associated with your account.

14. Automated decision-making and AI

SubFormal does not use personal data to make automated decisions about users that produce legal or similarly significant effects.

SubFormal does not use users' account information or comments to train general-purpose artificial intelligence or machine-learning models.

15. Children

SubFormal is not directed to children and is not intended for use by anyone below the minimum age at which they may lawfully use the service or provide relevant personal data under applicable law.

If SubFormal becomes aware that personal data has been collected from a child in circumstances where the processing is not permitted by applicable law, appropriate steps will be taken to delete the information.

16. Changes to this Privacy Policy

This Privacy Policy may be updated when SubFormal's functionality, data practices, service providers, or legal obligations change.

The “Last updated” date at the top of this Privacy Policy indicates when it was most recently revised.

If a change materially affects how personal data is processed, SubFormal will take reasonable steps to provide appropriate notice where required by applicable law.

17. Contact

For questions, privacy requests, account-deletion requests, or concerns relating to this Privacy Policy or the processing of personal data, contact:

Olga Lipinskaya
Denmark
mentoskop.admin@gmail.com