Privacy policy

This policy covers herizon.io, the join flow at join.herizon.io, the member portal at portal.herizon.io and the Herizon mobile app, Talent Matcher for employers at match.herizon.io, the partner portal for schools, and the emails we send. Our other products, japply.io and the resume parser API at api.resumeparser.cc, have their own policies on their own sites.

herizon.io sets no cookies of its own. We use the Google Ads tag to measure whether our advertising brings people to the site and to the join flow. It sets Google's advertising cookies and sends your page visits to Google. If you send us a message through the contact form, we store your name, email address and message, email them to the Herizon team and post them to our internal team channel.

The join flow asks for what we need to build your profile and to check that you can join. Nothing is required that is not listed here.

What we collect

• Your name, preferred name, pronouns and email address.
• Where you live now (city and country). Optionally, where you are originally from.
• Your LinkedIn profile and other links you choose to give.
• Your work experience, education and languages.
• Your answers about what you want to learn, your interests, practical limitations and things you want to avoid. These are free text and you decide what to write.
• If you upload a CV: the PDF and the text we read from it, which fills in the form for you.
• The invite link or school tag you joined through, and the steps you took in the form.

Who can join is decided automatically

Whether you can join is decided by software from the country you live in and the invite you used: residents of the EU, EEA, UK or Switzerland and people invited by a partner organisation can join; some invites go to a person on our team for review. If you are turned away, we keep your email address, name and country so we can recognise a repeated attempt, and we tell our team. You can ask a person to review the decision through the contact form.

AI reads your answers

We use OpenAI's models to read your CV text and your answers and turn them into a structured profile: a summary, a one-line description, skills and highlights. Text goes to OpenAI; your CV is not sent as an image. We do not use your data to train anyone's models.

Your profile

Your profile holds the data from the join flow plus what you add in the portal: a photo, a status line, your skills and skill checks, your courses, whether you are open to mentoring, your date of birth if you add it, and your email preferences. Your CV, if you uploaded one, is kept with your profile so you and our team can reuse it.

What other members see

The member directory shows your display name, photo, one-line description, country, languages, interests, completed courses, when you joined and when you were last active. Your LinkedIn link and your current job are shown only if you switch them on. Chat rooms are visible to the members in them. Direct messages are visible to the two people in the conversation.

Public profile

You can publish a public profile page at a link you share. It is off by default, and you choose which sections it shows. A skill check you pass has its own page that shows your name, the skill and the evidence to anyone who has the link.

Floria, the AI assistant

Conversations with Floria are stored, and they are sent to OpenAI to generate the replies. Floria keeps a short memory note about you: your goal, your situation, what is blocking you, what you have tried, and what you agreed to do next. You can read and erase that note in the portal at any time. Our team reads Floria conversations to improve her answers and to step in when a member needs a person.

Chat moderation

Messages posted in chat rooms are copied to a private channel our team uses for moderation, together with the sender's email address. Direct messages are not copied.

Following your employment

We measure our work by how many members find work. Once a month we search the public web for your LinkedIn profile address (only the address, not your name) through the search service Serper.dev, and we use OpenAI to read the search result and detect a new job title or employer. We also ask you directly. The result is stored in your employment history. You can ask us to stop this through the contact form. Published numbers are totals only and never identify you.

Activity and devices

The portal records which pages you open and when you were last active, so we can see what is used and what is not. If you allow push notifications on your phone, we store your device token and send notifications through Expo's push service; the text of a notification can include a member's name, for example when someone asks you to mentor them.

AI and automated steps

AI writes the first draft of your profile summary, grades course assessments, and ranks candidates for employers in Talent Matcher. If you let two or more assessments expire in a program that has them, software removes you from that program's candidate pool. A person on our team can look at any of these outcomes if you ask.

Logging in

You log in with a code or link sent to your email. The code lasts ten minutes and a session lasts sixty days. We keep the email address and IP address of each login request for one day to stop abuse. A Herizon staff member can open the portal as you to help with a problem; every such session is logged and ends after thirty minutes.

Employers who use Talent Matcher see candidate profiles without a name, email address or LinkedIn link: the summary, highlights, city, last job title, languages, checked skills and an AI ranking against their role. When an employer shortlists you, they see your name, email address and LinkedIn link so they can contact you. Being listed is part of the program you joined through; ask us through the contact form to be removed from the pool at any time.

From employers we collect the company's details, the work email address of each user, billing details, and a summary of the company website that OpenAI writes from the public site. Talent Matcher sets a session cookie that lasts thirty days.

If you joined through a partner school's link, staff at that school can see in the partner portal that you joined, your name and email address, your study programme, your application status and your progress in that school's program. The partner portal sets a session cookie that lasts seven days.

When you join, we add you to the Herizon community newsletter. Every email has an unsubscribe link, and you can change every email preference in the portal. Unsubscribing keeps your email address on a suppression list so we do not email you again by mistake. Login emails and other emails about your account are sent regardless of newsletter preferences.

For newsletters we record whether the email is opened and which links are clicked, using a small image and links that pass through crm.herizon.io. We store the time, the link and your email program's identification string, not your IP address. We use this to see which content is useful and to stop sending to addresses that never read our emails: after a long silence we ask once whether to keep sending, and if there is no answer we stop. Some email programs load images automatically, so an open does not always mean you read the email.

We never sell personal data. We share it with the services that run Herizon, each for one purpose:

• Hetzner (Helsinki, Finland): servers, database and encrypted backups.
• Cloudflare: network in front of every Herizon site.
• Resend: sends our emails.
• OpenAI: reads CV text, profile text, Floria conversations, course assessments and employment search results, as described above.
• Serper.dev: web search for the monthly employment check.
• Google: the Ads tag on the website and join flow, location suggestions in the join form, and sign-in for Herizon staff.
• Expo: push notifications to the mobile app.
• Stripe: payments for paid courses and coaching; receives your email address and the amount.
• Slack and Discord: our internal team channels receive new-member notices, chat room messages for moderation, contact form messages, account deletions and support requests.
• Opintopolku (Finnish study records): for programs that need proof of studies, with your identifier.

Several of these providers process data outside the EU. Where they do, the transfer rests on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, whichever the provider offers.

• To provide the service you asked for (your profile, courses, mentoring, chat, Talent Matcher, the partner portal): performance of a contract.
• To measure and report our results, moderate chat, keep the service secure and improve it: our legitimate interest as a non-profit whose purpose is employment. You can object at any time.
• Advertising measurement with the Google Ads tag and optional profile fields: your consent, which you can withdraw.
• Keeping records we are required to keep, for example of payments: legal obligation.

• An unfinished join form: 14 days after you last touched it.
• A join form that was never verified by email: 60 days.
• A CV uploaded for parsing before you joined: 14 days.
• Login request records: 1 day.
• Your profile, CV, messages, Floria conversations and employment history: for as long as you are a member. We do not delete inactive accounts automatically.
• After you delete your account: a record of the deletion (name, email, country, reason) for up to 90 days, then it is erased. Your email address stays on the suppression list so we do not email you again.
• Backups: encrypted daily copies kept on servers in Finland.

You can delete your account yourself in the portal settings. That removes your profile, messages, Floria memory and the rest of your member data. If you were part of a school program, the school keeps its own record of your participation.

Under the GDPR you can ask us for a copy of your data, correct it, erase it, restrict or object to how we use it, take it with you in a machine-readable form, withdraw consent, and ask a person to review an automated decision. Send requests through the contact form; we answer within one month. If you are not happy with our answer you can complain to the Finnish Data Protection Ombudsman at tietosuoja.fi.

Herizon is for adults looking for work. Do not join if you are under 18. If we learn that someone under 18 has joined, we delete the account.

When our systems change, this page changes, and the date at the top moves. We do not email every change; for changes that affect you materially we tell members in the portal.