Privacy policy
Last updated: 26 September 2026 (job emails, feedback, partner links, sponsored jobs, email statistics)
1. Controller
Lennart Schreiber
Calle de los Sargos 4
30383 Los Nietos (Cartagena), Murcia, Spain
Email: kontakt@webzap.eu
We have not appointed a data protection officer, as we are not legally required to.
2. What we collect
- Your email address and the text you write in the “I want to…” field.
- Your chosen email frequency (daily, weekly or paused).
- Search criteria derived from your text by our language model (see section 3).
- Jobs we sent you and your feedback on them (👍/👎 and the reasons you chose).
- Email statistics (only with your consent): whether you opened our emails and which links you clicked, recorded by our email provider Brevo.
- Timestamps of when you signed up, confirmed and last edited your entry.
- Server logs: when you visit the site, our web server records your IP address, date and time, the page requested, and your browser's user agent.
- Abuse protection: to limit sign-ups per visitor, the application keeps a one-way hash of your IP address in memory (never on disk) for at most one hour.
Please do not enter your name or other personal details in your text – no phone number, address, health information, or data about other people. We only need what describes your job search intent (field, interests, experience, preferred location, conditions).
3. Purposes and legal basis
- Sign-up and job matches (email address, text, frequency, timestamps): to confirm your sign-up via double opt-in, to send you job opportunities matching your description at the frequency you chose, and to send you the links to manage your entry. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR) by using the deletion link in your confirmation email or by writing to us.
- Server logs: to operate the website securely and to detect and fend off abuse. Legal basis: our legitimate interest in a secure, working service, Art. 6(1)(f) GDPR.
This is the only purpose. The service is free of charge. We do not sell your data, share it with third parties for their own purposes, or use it for analytics.
Job matching. Our server compares open job postings with the search criteria derived from your text (rules, no AI provider involved) and emails you the best new matches at the frequency you chose. Your 👍/👎 feedback is used to improve your future matches – for example, “not this company” stops jobs from that company.
Sponsored jobs – a one-way street. To keep the service free, companies can pay us to include their job in our emails. We select, on our own server, which subscribers' criteria match the job; the company never receives your email address, your text, your feedback or any other data about you – at most aggregated numbers (e.g. “your job was included in 120 emails, 14 people rated it 👍”). Sponsored jobs are always labelled “Sponsored” (Art. 20 LSSI-CE).
Partner links. Some job links come from partner job search engines (currently Adzuna, Jooble and/or Careerjet) and are labelled “Partner link”. These links contain our partner ID: when you click one, you leave our email and visit the partner's website, which learns that the click came from us and may pay us a small fee. From that moment the partner processes your visit (e.g. your IP address and cookies) as an independent controller under its own privacy policy. We never pass your email address or other data to partners.
Email statistics. With your consent (given with the sign-up checkbox), Brevo records whether you opened our emails (using a small image) and which links you clicked. We use this only to count how our emails are used and to pause and eventually remove subscribers who haven't opened or clicked any email for a long time (about six months). Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 22(2) LSSI-CE); you can withdraw it at any time by email, and it ends when you unsubscribe or delete your entry.
Analysis of your text. To find matching jobs, we automatically convert your text into structured search criteria (e.g. job titles, field, location, remote preference, salary expectation, deal breakers). This is done by an open-weight language model that runs on our own hardware in Spain. Your text is not sent to AI providers such as OpenAI and is not used to train any model. The resulting criteria are stored encrypted with your entry and shown on your manage page; if they are wrong, edit your text and they are derived again. Our hardware is not always online, so this can take some hours. If we ever want to use an external AI provider, we will update this policy and ask for your consent first.
We do not make automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR).
4. How we protect your data
- All connections use TLS (HTTPS), including the connection to the machine running our language model.
- Your email address and text are stored encrypted (AES, via Fernet) in our database. Links in our emails contain random tokens that we store only in hashed form.
- There are no user accounts or passwords. Each email contains personal links (random tokens) to confirm, manage or delete your entry; a new manage link can be requested on the site and replaces the old one.
- The website sets no cookies, uses no analytics or tracking, and loads no fonts, scripts or images from third parties. Our emails contain open and click statistics only as described in section 3 (“Email statistics”).
5. Recipients and processors
We use the following service providers, all acting as processors on our behalf under a data processing agreement (Art. 28 GDPR):
- netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany – hosting of the server that runs this website and stores the database (data centre in Germany). Privacy policy
- Sendinblue SAS (trading as Brevo), 17 rue Salneuve, 75017 Paris, France – delivery of our emails. Brevo receives your email address and the content of the emails we send you (which can include your text), and keeps delivery logs (e.g. delivered, bounced) and, with your consent, open and click statistics. Privacy policy
- Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA – encrypted tunnel connecting our web server to our own hardware that runs the language model. Your text passes through Cloudflare's network in transit; Cloudflare does not store it. Privacy policy
Partner job search engines (Adzuna, Jooble, Careerjet) are not our processors and receive nothing from us; they only see your visit if you click a labelled partner link (see section 3): Adzuna, Jooble, Careerjet. Sponsoring companies receive no personal data at all.
We do not share your data with anyone else. Your data is stored in the EU (Germany and Spain). Cloudflare is a US company certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR); in addition, Standard Contractual Clauses apply. Brevo processes data primarily in the EU; if it or one of its sub-processors processes data outside the EU/EEA, this is secured by an adequacy decision or by Standard Contractual Clauses (Art. 46(2)(c) GDPR).
6. How long we keep your data
- Unconfirmed sign-ups are deleted automatically after 48 hours.
- Confirmed sign-ups, including the derived search criteria, the jobs we sent and your feedback, are kept until you delete them or withdraw consent, or until we discontinue the service. Setting the frequency to “paused” keeps your entry but stops all emails. If you sign up again with the same address, your previous entry is replaced.
- Server logs are deleted after 14 days at the latest.
7. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can exercise most of them yourself, instantly, via the manage link in your emails: see everything we store (access), edit your text (rectification), download it as JSON (portability), pause emails, or delete everything (erasure). Lost the link? Request a new one. For anything else, email kontakt@webzap.eu.
You also have the right to lodge a complaint with a supervisory authority, in Spain the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid – www.aepd.es – or the authority of your place of residence.
8. Is providing data required?
No. Providing your email address and text is voluntary, but without them we can't send you job matches.
9. Minimum age
WebZap Jobs is intended for people aged 16 or older.
10. Open source
You can check exactly how your data is handled: the complete source code is public at https://github.com/Kipperlenny/webzap-jobs.
11. Changes
We may update this policy when the service changes. The current version is always available on this page. For material changes affecting your data, we will notify you by email.