Legal
Privacy notice
This notice is given under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), which applies in Norway through the EEA Agreement. It is for:
- people whose names may appear in the job postings and company information we collect;
- people who run the websites our crawler visits;
- the developers who use our API;
- people who visit this website.
On this page
1.Who is responsible
The controller is J Wibe, a Norwegian sole proprietorship (enkeltpersonforetak), organisation number 935 681 162, Vestliveien 33, 1415 Oppegård, Norway. Email: support@firmtrail.io. We have not appointed a data protection officer and are not required to.
2.Our service is about companies
We collect information about companies: what they do, their products, the technologies they use, links to their own pages and accounts, and their job postings. We do not collect lists of people. Our structured fields are not meant to hold names, personal email addresses or phone numbers. Personal data appears only incidentally, in the ways described below.
3.What personal data we process, and why
| Data | Why | Legal basis |
|---|---|---|
| Names in job postings. A job description can name a person, for example a recruiter or a hiring manager, because the company wrote it that way. We remove email addresses and phone numbers before storing a posting, but we do not detect names. A department name could also be a name. | Providing job postings, as the company published them, to the users of our API | Legitimate interests (Art. 6(1)(f)): see section 4 |
| Text of company web pages. When we build a company profile, the text of a few of its public pages (for example its About page, which can name founders) is sent to a language model to write a short company description. We do not store the page text; Anthropic deletes it within 30 days. We keep only the extracted company fields. The model is instructed to return no names of people, and emails and phone numbers are removed from what it returns, but names are not detected automatically, so one could slip through. Tell us: we remove the company’s profile, its history included, and stop profiling that company. | Describing companies | Legitimate interests (Art. 6(1)(f)) |
| Sole traders. If a company is a one-person business, facts about the company can be facts about that person. | Describing companies | Legitimate interests (Art. 6(1)(f)) |
| API users. RapidAPI tells us the user name and plan of each caller. We never store, log or export the user name. We store only one-way keyed hashes of it: one while a requested profile is waiting to be built, and one to count the new profiles a user requests per day and month. | Applying each plan’s limits and quotas, and preventing abuse | Contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Operational logs. Which company sites and hosts we visited and how each visit went. Never page text, IP addresses of API users, or user names. | Running, securing and paying for the service | Legitimate interests (Art. 6(1)(f)) |
| Website visitors. When you visit this website, your IP address and the page you ask for pass through bunny.net, which delivers the site and protects it from attacks. | Delivering this website and protecting it from attacks | Legitimate interests (Art. 6(1)(f)) |
We do not store the IP addresses of the users of our API. This website runs on our server at Hetzner and reaches you through bunny.net. We do not use visitors’ IP addresses to identify them. We use no tracking and set no cookies; only if bunny.net has to check that a visitor is not a bot may it set a strictly necessary security cookie. We make no automated decisions about people and do not profile them.
4.Our legitimate interests
Companies publish job postings and company information so that they are read and spread widely. Our interest, and our API users’ interest, is to make that public company information available in a structured form.
We think this does not override the interests of a person named in a posting, given these safeguards:
- We never look for names, and our structured fields are not meant to hold any.
- We remove emails and phone numbers.
- Our terms forbid API users to profile, track or contact individuals using our data.
- We remove data on request.
You can object at any time (section 8).
5.Where the data comes from
- Public job board APIs of the platforms listed on our crawler page.
- Companies’ own websites and careers pages.
- Public DNS records.
- For API users: RapidAPI.
6.Who receives it
| Recipient | What and why | Location |
|---|---|---|
| Users of our API | Job postings and company information. They are independent controllers of what they receive and bound by our terms of use. | Worldwide |
| Hetzner Online GmbH | Hosting of this website and the API, database and backups (our processor) | EU |
| BunnyWay d.o.o. (bunny.net) | Delivers this website, protects it from attacks and hosts our DNS; processes visitors’ IP addresses on servers in the EU only, under a data processing agreement (our processor) | EU |
| Anthropic, PBC | Language model that writes company descriptions from page text (our processor; it does not use the data to train its models) | USA* |
| Grafana Labs | Monitoring: operational logs, metrics and traces (our processor) | EU |
| Hostinger International Ltd | Hosts support@firmtrail.io, and so the requests you send us (our processor) | EU |
| RapidAPI | The marketplace through which the API is sold. It runs users’ accounts, keys and payments as an independent controller under its own privacy policy, and passes our responses through its gateway. | USA |
| healthchecks.io | Uptime alerts; receives no personal data | EU |
* Transfers to Anthropic are covered by its data processing addendum, which includes the EU Standard Contractual Clauses. Ask us for details.
7.How long we keep it
- Job postings are kept while the company lists them. Once a posting has not been seen on its job board for 12 months (because it was taken down, or we stopped collecting that board), it is deleted with its description. Removal on request deletes it at once (section 8).
- Company profiles and our counts of a company’s postings (by department, country, city and seniority) are kept as history, with no time limit, until the company is removed. A department name, written by the company, could be a person’s name.
- Hashed API user identifiers are deleted:
- for the profile queue, when the requested profile has been built or has failed;
- for quotas, at the end of the calendar month they count (so within about 31 days of their last use).
- Website logs. bunny.net keeps access logs for 3 days, stored in Germany, with IP addresses shortened. Requests flagged by its attack protection are logged by bunny.net under its own policy. Our own server stores no visitors’ IP addresses.
- Server logs rotate after a limited volume. Grafana Labs deletes monitoring data after 14 days.
- Backups are kept for about 14 weeks, so deleted data is gone from them within that time.
- Emails to us are kept while your request is open, and deleted within 12 months after it is closed.
Anything is deleted sooner when you ask (section 8).
8.Your rights
You have the right to:
- access the personal data we hold about you, and get a copy;
- rectification of incorrect data;
- erasure;
- restriction of processing;
- object to processing based on legitimate interests;
- data portability, where it applies.
Email support@firmtrail.io. We answer within one month.
- If you are named in a job posting, tell us the company or the posting’s link. We cannot remove a single posting: we remove the job board that holds it, which deletes all its postings and stops us collecting that board.
- We cannot search descriptions for your name unless you ask us to.
- Data removed from our database stops being served by our API within minutes. It is gone from our backups within about 14 weeks.
You can also complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority where you live.
9.Changes
We update this page when our processing changes, and change the date at the top.
Contact
For the crawler, removal requests, privacy questions and API support: support@firmtrail.io.