Privacy notice

The data controller is MISMATCH LIMITED, 32 Eden Park, Loughrea, Galway, H62 XT99, Ireland, company number 826262. Write to us about anything here at privacy@mismatchai.com and a person will answer.

Your job search is yours. We store it so you can come back to it, remind you about it, and nothing else. We do not sell it, we do not show it to employers or recruiters, and no employer can find out that you applied to them through us.

One thing does leave your account, and only in a form that cannot be traced back to you: whether an employer replied. That is what the reply-time statistics are made of, and it is explained in full below.

Your account. Your email address and a password, held by Amazon Cognito — we never see the password itself. A display name if you give one, when you signed up, and when you were last here.

What you record about a job. The employer, the role, where you found it, the link and a copy of the job description, the date you applied, which stage it is at, how you ranked it, how excited you are and why, and any notes you write. Interview rounds with their dates, descriptions and your notes on them.

Documents you upload. CVs, cover letters and original job descriptions, with their filenames and sizes. These are files you chose to put here and they usually contain a great deal about you — your history, your address, sometimes more. We store them, we do not read them, and nothing scans them — unless you ask for AI help on a job, which is part of Plus.

When you ask for AI help. Your CV is read by Claude, an AI model made by Anthropic, running inside our own Amazon Web Services account. It picks out your experience, skills and education, and is told to leave out your name, email, phone number, address and links. It then compares that with the job description on the application. What it produces is kept with your account, and deleted when you delete the CV or the application. Nothing is sent to Anthropic, and neither Amazon nor Anthropic uses your CV to train models. It never happens unless you press the button.

What you want from a job. Your answers to the questions about what matters to you, kept so the tracker can be useful about it later.

Reminders and email settings. Whether you want a digest and how often, which day, your time zone, when we last sent one, and an unguessable token that makes the unsubscribe link in each email work without signing in.

Which plan you are on. Free today, for everyone.

• To run the tracker — storing your applications, your documents and your settings, and signing you in. This is us doing what you asked us to do: performance of our contract with you.
• To send the reminders you asked for — the digest. You choose whether it comes at all, and every one has an unsubscribe link.
• To send you news, if you asked for it — your consent, and only your consent. It is off unless you switch it on in Settings, we will never switch it on for you, and turning it off takes effect immediately.
• To produce reply-time statistics — our legitimate interest in showing job-seekers which employers actually answer. What leaves your account to do it is described in the next section, and you can object.
• To keep the service working and free of abuse — our legitimate interest in a service that stays up.

We do not use your data for advertising, we do not build a profile of you, and we do not share anything with employers or recruiters.

Account email — a code to confirm your address when you sign up, and a code if you ask to reset your password. These come because you just asked for them, so there is nothing to turn off.

Your follow-up digest — the applications that need chasing. You choose whether it comes at all and how often, in Settings, and every one carries a link that switches it off without signing in.

News and occasional updates — what we have built and what we have learned about hiring. Off unless you turn it on. We will never add you to it because you signed up, bought something, or agreed to our terms; the only thing that switches it on is you, in Settings, and the only thing needed to stop it is the same switch or the link in any one of them.

These are separate choices. Turning off news never stops your reminders, and turning off your reminders is not permission to send you news.

When you tell us an employer never came back to you, we add one row to a separate table so we can say things like “most people who apply here hear nothing”. Because that figure is only useful if it is built from real searches, this is on unless you turn it off.

What that row contains:

• The employer’s domain— the company’s own web address, never anybody’s email address at it.
• What happened, and how many days after you applied.
• Broad context: the family of role, rough seniority, rough market. Never your job title, your company, or the specific role.
• Two salted hashes standing in for you and for the application — enough to count one person once, not enough to work out who they are, and not reversible.

Your name, your email address, your notes, your documents and the fact that you specifically applied to a given employer never go into it. It lives in a different table from your account, so there is nothing to join the two back together.

To stop, turn off “Share reply times” in Settings. One click, no reason needed, and it takes effect the moment you change it — nothing to save and nobody to email. Rows already written cannot be traced back to you, so they stay in the aggregate.

We never publish a figure resting on so few people that it could point back at any of them.

• Amazon Web Services — your account, your applications and your uploaded documents, all stored in London, and the AI model that reads your CV when you ask it to, which runs in Europe.
• Vercel — runs the website itself.
• Resend — sends the digest. Your address passes through their servers in Ireland. Account email comes from Amazon instead, and if we ever send news it will come from its own address so that a problem with one kind of email cannot stop another reaching you.
• Google — only if you choose to sign in with a Google account, in which case Google tells us your email address and confirms it is yours. You can use an email address and password instead and never involve them.

All of them work on our instructions and none of them may use your data for their own purposes. Nobody else sees it. We have never sold data and the company does not have a business model that would need us to.

Our servers are in London, which is outside the EU. Everything we store — your account, your applications, your notes and your uploaded documents — stays there. Those transfers rely on the European Commission’s adequacy decision for the United Kingdom, which says UK law protects your data to the same standard as ours.

The one thing that does not stay in London is the AI model, and only while it is running. When you ask for AI help on a job, that request is handled in one of seven places: Ireland, Germany, France, Sweden, Italy, Spain or London. Which one depends on where there is capacity at that moment, and we are not told. Six of the seven are inside the European Economic Area, so no transfer out of it happens at all; the seventh is London, covered by the same adequacy decision as everything else. The model keeps nothing — what it produces comes back to your account in London, and that is the only copy.

These are American-owned companies, so their staff can reach the data from the United States when they are supporting us; that is covered by the European Commission’s standard contractual clauses in our contract with each of them.

Your applications, notes and documents stay until you delete them or close your account. A job search is long and people come back to it, so we do not quietly tidy things away.

When you close your account we delete it — the account, the applications, the notes and the files — within 30 days. What survives is the statistical rows described above, which cannot be connected to you, and a note that your address unsubscribed, so we do not email you again by mistake.

Delete a single document and it goes; we keep the five most recent versions of each one and drop the rest.

Everything is encrypted in transit and at rest. Your documents are not public: each one is fetched with a link that we sign, for one file, that stops working shortly afterwards. Every request to our API has to carry a valid signed token for your account, and we check it on the server.

We do not pretend this is impossible to breach. If something happens that puts your data at risk, we will tell you and the Data Protection Commission, rather than hope you do not notice.

Three of these you can do yourself, in Settings, without asking anybody: download everything we hold about you, close your account, which deletes it all, and stop sharing reply times. No forms, no waiting.

You can also correct anything by editing it, restrict what we do with your data, or object to how we use it. For those, email privacy@mismatchai.com and we will answer within a month — the law’s deadline, not a queue we invented, and usually far quicker.

You will never be charged for asking, and asking will never make the service worse for you.

If we get it wrong you can complain to the Irish Data Protection Commission, our lead supervisory authority, or to the regulator where you live — in the UK that is the Information Commissioner’s Office. We would rather you told us first, but it is your right either way.

misMATCH is for people aged 18 and over, and we do not knowingly hold anything about anyone younger.

Only what is needed to keep you signed in and to keep the unfinished site private. No advertising cookies, no tracking cookies, nothing sold to anyone — so there is no banner to click.

Nothing here decides anything about you. No profiling, no scoring, no automated decisions. The reminders are a calendar, not a judgement.

If we change something that matters, we will tell you in the app or by email before it starts, not afterwards. The date at the top always says when this last moved.