evolcSign in

Privacy notice

Last updated 19 Oct 2026

Who is responsible

The controller is Evolc, operator of evolc.com, jobs.evolc.com and companies.evolc.com. Contact: the request form on this page.

What we process, why, and on what legal basis

  • Company information (names, registration data, financial statements, products, jobs) is mostly not personal data. Sources: public business registers, company websites and public applicant-tracking job feeds.
  • Professional data about company leaders — name, role, company and the public source (official register or the company's own website). Purpose: providing B2B company information. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), documented in a balancing test. We never publish private contact details. You can object at any time.
  • Job applications made with "Apply with Evolc" — your contact details, CV, links, answers and message. Purpose: forwarding your application to the employer you chose and preparing a short structured summary for them. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time. A person reviews every application before it is forwarded; no decision about you is made solely by automated means.
  • Job matching profiles ("Jobs for you") — the LinkedIn profile export, CV or text you give us, your job preferences and your feedback on matches (saved / not for me). Purpose: understanding your experience and ranking jobs for you, with explanations. We strip e-mail addresses, phone numbers and profile links from the text, keep only the extracted text (never the file) and never show your profile to employers unless you apply. An AI model reads the text to build a structured profile and to write match notes; the ranking is a recommendation, nothing is decided about you. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw by deleting your profile on the "Profile & preferences" page.
  • Evolc accounts (optional) — the sign-in methods you add: passkeys (we store only the public key, never your fingerprint or face), a verified e-mail address (we send it one-time sign-in codes) and, if you use them, your Google or LinkedIn account identifier with the name, photo and e-mail address they share; plus the name you enter and your sessions. Purpose: one account that keeps you signed in across Evolc sites and devices. Legal basis: performance of the service you request (Art. 6(1)(b)). We never receive your Google or LinkedIn password, contacts or activity.
  • Sign in with LinkedIn (optional) — your name, profile photo, e-mail address and LinkedIn member identifier, as shared by LinkedIn. Purpose: a verified account that keeps your matches across devices. Legal basis: performance of the service you request (Art. 6(1)(b)). We do not receive your LinkedIn connections, messages or activity and we never post on your behalf.
  • Requests you send us (claims, corrections, opt-outs, privacy requests). Purpose: handling them. Legal basis: legitimate interest and legal obligation (Art. 6(1)(c)).
  • Security: to limit spam we store a salted, one-way hash of your IP address for at most 48 hours. We use no advertising or analytics cookies.

How long we keep data

  • CVs and applications: deleted 180 days after the application, or earlier on request.
  • Job matching profiles: deleted immediately when you delete your profile, and automatically after 12 months without use.
  • Accounts and their sign-in methods: deleted immediately when you delete your account on the account page, and automatically after 12 months without use. Sessions expire after 30 days without an account (90 days when signed in). Unused sign-in codes expire after 10 minutes.
  • Leadership data: deleted when it has not been seen in a public source for 12 months, or on a successful objection.
  • Requests: as long as needed to handle them and to document that we did.

Who receives data

The employer you apply to (only for that position); our hosting providers Cloudflare (web hosting and storage) and Hetzner (servers in the EU), and our AI model provider (for applications and matching profiles), under data-processing agreements. Google or LinkedIn, only when you choose to sign in with them; our e-mail delivery provider, for sign-in codes. Where a provider processes data outside the EEA, Standard Contractual Clauses apply. We do not sell personal data.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent at any time without affecting earlier processing. You can also lodge a complaint with a data-protection authority, for example in your country of residence.