GDPR Compliance
1. Data Controller
The data controller for the processing of personal data through GitHub HR is:
- Entity: GitHub HR (operated by Vlad Vrinceanu)
- Email: email.vlad.vrinceanu@gmail.com
- Jurisdiction: Italy, European Union
The data controller determines the purposes and means of processing personal data in connection with the GitHub HR platform.
2. Legal Basis for Processing
We process personal data under the following legal bases as defined by Article 6 of the General Data Protection Regulation (GDPR):
Developer Data — Legitimate Interest (Art. 6(1)(f))
We process publicly available GitHub profile data under our legitimate interest in providing a recruitment technology service. This data is already made public by the developers themselves on GitHub. We have conducted a Legitimate Interest Assessment and concluded that:
- The data is already publicly available and accessible to anyone
- Processing serves the legitimate purpose of facilitating recruitment
- Developers can opt out at any time (see Section 4)
- We do not process sensitive/special categories of personal data
- The impact on developers is minimal given the data is already public
Recruiter Data — Contract Performance (Art. 6(1)(b))
We process recruiter account data as necessary for the performance of the contract between the recruiter and GitHub HR (i.e., providing the service you signed up for).
Payment Data — Legal Obligation (Art. 6(1)(c))
We process payment-related data as required by applicable tax, accounting, and financial regulations. Payment processing is handled by Clerk Billing with Stripe as its processor, which acts as an independent data controller for payment card data.
3. Data Subject Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
- Right to Erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations.
- Right to Restriction (Art. 18): You may request that we restrict the processing of your data in certain circumstances.
- Right to Data Portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21): You may object to the processing of your data based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
To exercise any of these rights, contact us at email.vlad.vrinceanu@gmail.com. We will respond to your request within 30 days.
4. Right to Opt-Out
For developers: If your public GitHub profile has been indexed by GitHub HR and you would like it removed from our database, you may request removal by emailing us at email.vlad.vrinceanu@gmail.com with the subject line "Profile Removal Request" and your GitHub username.
Upon receiving your request, we will:
- Delete your profile from our database within 30 days — including the assessments and code excerpts we derived from it, any saved shortlist entries referencing you, and your presence in past search results
- Add your GitHub username to an exclusion list that our indexing pipeline checks, so your profile is not collected again by a later search
- Confirm the removal to you by email
The exclusion is enforced at the point where profiles are written to our database, not only at the point where they are searched, so it applies to every way a profile could otherwise re-enter the system.
What we keep after erasure: to honour the exclusion we must retain your GitHub username on a suppression list indefinitely — that single record is the only way to recognise and refuse your profile in future. It holds the username and the date, and nothing else. If you later want to be indexable again, write to us and we will remove it.
5. Data Processors
We use the following third-party services as data processors in accordance with Article 28 of the GDPR:
- Convex (Convex, Inc. — United States) — Database hosting and real-time application backend. Stores developer profiles, task data, and pipeline logs.
- Clerk (Clerk, Inc. — United States) — Authentication and user identity management. Stores recruiter account credentials and session data.
- Clerk Billing / Stripe (Clerk, Inc. and Stripe, Inc. — United States) — Payment processing and subscription management. Billing is operated through Clerk Billing, which uses Stripe as its payment processor; Stripe acts as both a data processor and an independent data controller for payment card data.
- Anthropic (Anthropic, PBC — United States) — AI processing of public repository excerpts and job-description text to produce code-quality assessments.
- Voyage AI (Voyage AI, Inc. — United States) — Generates the numeric embeddings used for developer similarity search.
- Vercel (Vercel, Inc. — United States) — Application hosting, content delivery, and serverless function execution.
Each processor is contractually obligated to process data only as instructed by us and to implement appropriate technical and organizational security measures.
6. International Transfers
Our data processors are primarily located in the United States. Data transfers from the European Economic Area (EEA) to the United States are conducted in compliance with GDPR requirements using:
- EU-US Data Privacy Framework (where applicable)
- Standard Contractual Clauses (SCCs) as approved by the European Commission
Our primary database (Convex) operates from the EU West 1 region, ensuring that core application data remains within the European Economic Area where possible.
7. Data Protection Officer
For data protection inquiries, you may contact: email.vlad.vrinceanu@gmail.com
We are committed to addressing your data protection concerns promptly and will respond to all inquiries within 30 days.
Domande su questa policy? Scrivici a email.vlad.vrinceanu@gmail.com