Privacy and cookie policy

Who is responsible

ViewSkill is run by the person who runs ViewSkill (name to be added), the data controller for everything described here. Write to [email protected] for any privacy question or request. There is no data protection officer: we are not required to appoint one.

If you use ViewSkill

• Account: email, name, a bcrypt hash of your password or the ID from Google or GitHub sign-in, sign-up date. Needed to give you an account (contract, Art. 6(1)(b)).
• What you run: the role descriptions and job descriptions you type or upload, and the results, briefs and outreach drafts that come back. Needed to provide the service (contract). Uploaded files are read into text and not stored.
• Billing: plan, credits, Stripe customer and invoice IDs. We never see card numbers; Stripe does. Contract, plus legal obligation to keep invoices (Art. 6(1)(c)).
• Emails we send: sign-in links, verification and password resets, billing notices (contract). The newsletter only if you signed up for it (consent, Art. 6(1)(a)); unsubscribe any time.
• Product usage: which features you use while signed in (e.g. a search was run, a plan page was opened), stored on our own servers without cookies, so we can fix and improve the product (legitimate interest, Art. 6(1)(f)).
• Security: IP addresses in rate-limit records, deleted within 48 hours, and server logs, to stop abuse and brute-force attempts (legitimate interest).
• Where you came from (referrer, campaign tags, landing page) and an anonymous visitor ID, only if you accept analytics cookies (consent).

If you are a developer we analyze

ViewSkill reads public GitHub data to show GitHub Score pages and to match developers to recruiters' searches. You did not give us this data, so this section is the notice GDPR Art. 14 requires. We do not message each developer individually; doing so would take disproportionate effort (Art. 14(5)(b)), so this public notice is how we inform you.

What: your GitHub username, name, avatar, bio, location, company, follower count, public repositories (names, descriptions, languages, topics, stars, forks, push dates), your public profile README, and, only when a recruiter asks for contact routes, the email address shown on your public commits and the links on your profile. Never private repositories, never data from other sites.

Source: the public GitHub API.

Why: (1) a GitHub Score page when someone looks up your username; (2) matching and an AI-written skill assessment when a recruiter's search finds you; (3) public contact routes and a draft first message when a recruiter asks for them.

Legal basis: legitimate interest (Art. 6(1)(f)): ours in running a developer-search service, and recruiters' in finding people by the work they publish. We limit the impact: only data you made public on GitHub, professional context only, score pages are kept out of search engines, results are only shown to the recruiter who ran the search, and one email removes you for good.

Your right to object (Art. 21): write to [email protected] with your GitHub username. We delete your score page, cached data, and every saved result and outreach draft that names you, and block your username so you never appear on ViewSkill again. Within 30 days, usually much sooner.

AI and automated decisions

Role descriptions and public repository data are sent to an AI model provider to turn the description into a search and to write the skill assessment. Providers process this under contract and may not use it to train their models.

ViewSkill makes no decisions about anyone. Scores and assessments help a recruiter decide whom to look at; a person always makes the hiring decision, so no decision is based solely on automated processing in the sense of Art. 22. See the Terms.

Who receives data

We do not sell personal data. These providers process it for us, each only for its part of the service:

• Hosting and database: a VPS provider in the European Union.
• Cloudflare: content delivery and protection from attacks (all traffic passes through it).
• Anthropic or OpenAI: AI processing of role descriptions, uploaded job descriptions and public GitHub data.
• GitHub: the source of public developer data, and sign-in if you choose it.
• Google: sign-in if you choose it; Google Analytics only if you accept analytics cookies.
• Stripe: payments and invoices.
• Resend: sending email.
• Sentry, when enabled: error reports, set up not to send IP addresses or other personal identifiers.

Recruiters see results for the searches they run. Authorities receive data only when the law requires it.

Transfers outside the EU

Cloudflare, Anthropic, OpenAI, GitHub, Google, Stripe, Resend and Sentry are based in the United States or process data there. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise (Art. 45 and 46). Write to us for a copy of the relevant safeguards.

How long we keep it

• Account data: until you delete the account. Deletion is immediate and also removes your searches, outreach drafts, API tokens, analytics events and newsletter signup.
• Searches, checks and outreach drafts: 12 months, then deleted automatically (or sooner if you delete them).
• Product analytics events: 13 months.
• GitHub Score snapshots: 12 months after the profile was last looked up. Cached GitHub responses: two days at most.
• Rate-limit records with IP addresses: 48 hours at most.
• Invoices and billing records: 10 years, as tax law requires.
• Newsletter: until you unsubscribe.

Cookies

Necessary cookies keep you signed in and remember your cookie choice; they need no consent. Analytics cookies are only set after you click "Accept all", and you can change your mind any time with "Cookie settings" in the footer.

• Necessary: authjs.session-token, authjs.csrf-token, authjs.callback-url (sign-in; session or up to 30 days). vs_consent (your cookie choice; 6 months).
• Analytics, with consent only: _ga, _ga_* (Google Analytics; 13 months). vs_aid (anonymous visitor ID), vs_src (where your first visit came from), vs_t (marks the visit as recorded) (ViewSkill; 1 year).
• In your browser's storage, never sent to us: whether you dismissed the promo or the GitHub Score suggestion, and the company name you last used in outreach drafts.

Your rights

You can ask for access to your data, correction, erasure, restriction, a portable copy, and you can object to processing based on legitimate interest or withdraw consent at any time (Art. 15-22). Signed-in users can download all their data and delete their account themselves on the account page. For anything else write to [email protected]; we answer within 30 days.

You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live or work.

Other

• ViewSkill is not meant for anyone under 16.
• Security measures are described on the Trust page.
• When this policy changes, the date at the top changes too; significant changes are announced by email to account holders.