Privacy Policy

1. Who We Are

JobCroissant is operated by Rolework, the controller responsible for the personal data described here. Contact us at jobcroissant@rolework.com or write to:

Rolework
60 rue François 1er
75008 Paris
France

Our services are intended for adults aged 18 or older who have reached the legal age of majority in their place of residence. They are not directed at minors. If you believe a minor has provided personal data through our services, contact us so we can review the situation and take appropriate action.

2. Information We Collect

Candidates: account and contact details, authentication information, optional profile information and resumes, saved jobs, and job alert preferences.

Recruiters: professional contact details, organization information, job listings, public company profiles, orders, invoices, payment status, and billing or tax information.

We also process messages you send us and technical information needed for security, service operation, and measurement. Most information comes from you. Listings may also come from authorized recruiters, recruitment systems, or publicly accessible employer career pages.

Required form fields identify information needed to provide the requested service. Please avoid adding unnecessary sensitive information to resumes, listings, or messages.

3. Why We Use Personal Data

To provide requested services: manage accounts, store resumes, save jobs, deliver matching alerts, publish vacancies, and administer credits, subscriptions, and payments. The legal basis is performance of a contract or steps requested before entering one.

For legitimate interests: communicate with organizational contacts, support users, maintain relevant listings, measure service use, and prevent fraud or misuse. We consider the impact on your rights and use proportionate safeguards.

For legal obligations: maintain accounting records and respond to lawful requests. We rely on consent where required, including for optional external media. Simply browsing the site does not constitute consent to every use of your data.

4. Resumes and Applications

Saved resumes are private, with access restricted to you and authorized personnel supporting the service. They are not a public or searchable recruiter directory. Document access uses controlled, time-limited download links.

Applications currently take place through the employer’s website or email address. Clicking Apply does not automatically send your saved resume. The receiving employer controls its recruitment process and handles information under its own privacy notice.

We do not make automated hiring decisions. Job alert matching uses your selected criteria; it does not assess your suitability for employment.

5. Alerts, Emails, and Public Listings

We send requested job alerts and necessary account, security, billing, and service messages. You can manage or unsubscribe from alerts using the available controls. Alert definitions are automatically deleted during scheduled cleanup once they are more than six calendar months old. This does not delete your account, resume, or separate email records.

Job descriptions, employer profiles, logos, and contact information included in published listings are public. Listings purchased with a credit are republished on our LinkedIn page with promotional text and included in email alerts for candidates whose selected criteria match. Public listings are made eligible for Google for Jobs where the applicable technical requirements are met. Third-party platforms control indexing, display, ranking, and availability; social reach, search placement, email readership, and application volume are not guaranteed.

Promotion uses public listing content, not private candidate resumes. Third-party copies and search caches may remain after a listing is removed. Contact us to correct personal information in a listing we have sourced elsewhere.

6. Payments and Service Providers

Stripe processes card payments; we do not store full card numbers. Bank transfer administration involves payment references, invoice details, and payment status.

Providers support hosting and infrastructure (Vercel and Supabase), email delivery (Mailgun), security (Cloudflare), payments (Stripe), and job classification (OpenAI). Classification concerns listing content, not automated candidate selection. Providers receive the information necessary for their functions.

We may also disclose relevant information to banks, professional advisers, or authorities when necessary and lawful. In a proposed merger, acquisition, or business transfer, necessary information may be reviewed under confidentiality safeguards or transferred with the service. Any new controller remains subject to applicable data protection law and notice requirements.

7. Cookies and Measurement

Essential cookies support functions such as authentication and security. Optional external media, such as YouTube or X embeds, require your choice before loading. The external-media preference is stored for up to 180 days. You can change it through available embed controls or clear the relevant browser cookies.

Job statistics and Vercel website audience measurement operate independently of the external-media choice, including after Reject all. Job statistics use a random browser cookie, njb_job_visitor, for up to six months, with a fixed maximum of 180 days from creation and no renewal; it is not linked to your account. References to six months for this cookie in the technical disclosure below describe this same 180-day maximum, not six calendar months. Recruiters receive aggregate counts, not a list identifying applicants.

Vercel audience measurement is cookieless. It receives sanitized page URLs and technical visit information, not your resume or form contents. Its request-derived visitor identifier is discarded after 24 hours. The technical disclosures below explain these two measurement systems and their controls. To object to the processing of your personal data for job statistics or website audience measurement, email jobcroissant@rolework.com and specify which measurement your request concerns and the reasons relating to your situation. We will assess your request under applicable law, explain the outcome and any lawful grounds for continuing the processing, and stop or restrict the relevant processing where required. The response periods in Section 11 apply. Sending a request does not automatically change your browser settings, and the external-content preferences do not disable these measurement systems.

8. International Processing

Our providers may process information outside the European Economic Area. Where a transfer is subject to GDPR restrictions, an applicable legal transfer mechanism is required, such as an adequacy decision or standard contractual clauses with any necessary safeguards.

Contact us for information about the locations and safeguards applicable to a particular service or transfer.

9. Retention

We retain account information and documents for as long as needed to provide the service, then assess deletion or restricted retention when an account is closed. Support correspondence and security records are kept as necessary for their purpose, legal obligations, or disputes.

Invoices and accounting records are generally retained for ten years under French law. A vacancy’s 49-day publication period is not a promise to delete all associated records after 49 days. Cookie expiry likewise does not determine how long aggregate statistics are retained.

Some records must remain after a deletion request for legal reasons. Backup copies may persist until their normal replacement or expiry.

10. Security

We use safeguards including restricted access, protected authentication credentials, private document storage, and encrypted connections. No system is completely secure. Protect your account credentials and report suspected unauthorized access promptly.

11. Your Rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.

Send requests to jobcroissant@rolework.com. We may request proportionate identity verification and normally respond within one month, with a lawful extension where necessary. Requests about information held by an employer should also go to that employer.

You may complain to the French data protection authority, the CNIL, or another competent supervisory authority.

12. Changes to This Policy

Last updated: September 29, 2026. We update this policy when our practices or legal requirements change and provide additional notice of material changes where required.