Privacy policy

This Privacy Policy (the “Policy”) describes how personal data of MatchStaff platform users (the “Platform”, “Service”) is processed and protected. MatchStaff is a free non-commercial project for users worldwide. The Policy follows commonly accepted privacy principles and applicable law to the extent it is mandatory for the Operator and users.

By using the Platform (registration, sign-in, profile completion, publishing requests, messaging), you confirm that you have read the Policy. During the closed beta, the Service is provided to a limited group of users; terms may be refined as the product moves to public access.

The personal data operator is the entity administering the MatchStaff Platform (the “Operator”). For questions about personal data processing, exercising data subject rights, or withdrawing consent, contact:

E-mail: privacy@matchstaff.pro. Requests are reviewed within up to 30 calendar days from receipt unless another period is required by law.

MatchStaff processes personal data you provide at registration and in your profile, as well as data generated when you use the Service:

• account data: email address, password hash (passwords are not stored in plain text);
• IT specialist or company profile data: name/title, stack, rate, experience, work formats, bio, links to GitHub, LinkedIn, portfolio, contacts (phone, Telegram, etc. — at your choice);
• company request content and profile moderation materials;
• Platform chat messages after mutual contact consent;
• technical data: IP address, browser and session information, audit log for security and incident investigation.

Personal data is processed for the following purposes:

• registration, authentication, and account management;
• matching IT specialists with company requests, showing relevant candidates and projects;
• automatic and manual profile moderation, handling reports and disputes;
• contact requests, chat, and notifications (including email when enabled and SMTP is configured);
• performing the terms of service, security, and abuse prevention;
• improving the Service and complying with applicable legal requirements.

Personal data is processed on the following grounds, in line with applicable privacy principles for a free non-commercial project:

• consent of the data subject — at registration, profile completion, enabling notifications, and other actions requiring separate consent;
• performance of a contract to which the data subject is a party, or conclusion of a contract at the data subject’s initiative — providing Platform features under the terms of service;
• legitimate interests of the Operator — security, audit logging, fraud and spam protection where data subject rights are not violated;
• compliance with legal obligations imposed on the Operator under applicable law.

Personal data is stored in a PostgreSQL database on servers operated by the project Operator (directly or through engaged processors). Data is retained for the period of account use and as long as necessary to fulfill legal obligations, resolve disputes, and ensure security, after which data is deleted or anonymized unless law requires otherwise.

To delete an account and related personal data, send a request to the Operator’s contact email (Section 2). Data will be deleted within a reasonable time where possible; some records (e.g. anonymized logs) may be retained as permitted by law.

Data may be disclosed to other Platform users as provided by the Service logic (e.g. opening contacts after a request is accepted, showing a profile in matching subject to privacy settings).

The Operator may engage processors (hosting, email delivery) subject to confidentiality and data-protection commitments. Data may be processed on infrastructure operated by the Operator or its processors; when you follow links to third-party services (GitHub, etc.), those services process data under their own terms.

Session cookies and NextAuth mechanisms are used for account sign-in. They are required for authentication and are not used for ad profiling.

When analytics (PostHog) or error monitoring (Sentry) is enabled, anonymized or technical data may be processed. There is no granular analytics consent toggle in the interface: an informational notice is shown with a list of technologies.

In line with applicable personal data protection principles, you have the right to:

• receive information about processing of your personal data;
• request correction, blocking, or deletion of incomplete, outdated, inaccurate, or unlawfully processed data;
• withdraw consent (where processing is consent-based);
• appeal the Operator’s actions to a competent supervisory authority or a court.

To exercise your rights, email the address in Section 2 with your account email and the nature of the request. The Operator may request reasonable identity verification.

You may request a copy of processed personal data, correction of inaccurate information, or deletion as provided by law. Email privacy@matchstaff.pro with the subject “Data subject request” and include:

• the email address linked to your MatchStaff account;
• request type: export (copy), correction, or other personal data protection request;
• data or profile sections to correct (for correction requests);
• reply contact if different from the account email.

The Operator will respond within up to 30 calendar days. Export is provided in machine-readable or text format (JSON/CSV or description in the reply) for data stored in the Service at the time of the request. You can also submit a request and delete your account in Privacy & data (/settings/privacy); this does not replace the right to contact the Operator by email.

You may withdraw consent to personal data processing by emailing the Operator or requesting account deletion. Withdrawal does not affect processing that may continue on other legal grounds (contract performance, legal obligations).

After withdrawal and account deletion, access to Platform features ends; some data may remain in anonymized form in security logs as permitted by law.

The Operator applies organizational and technical measures: HTTPS, password hashing (bcrypt), restricted server access, masking contacts until mutual consent, and action logging for incident investigation.

The Operator may update the Policy. The current version is published on this page with the last updated date. Continued use of the Service after changes are published constitutes acceptance of the updated Policy unless law provides otherwise.