Who is responsible for your data
WorkDecoded is a subscription service for preparing career decisions. The controller of your data is the operator of the service shown below.
Contact: the contact page
What data we process
Account data: name, email, password (stored only as a hash), language, country and time zone.
Career information you add: profile, experience, education, achievements, job offers, applications, interviews, workplace situations, salary reviews and the documents you upload.
Payment data: payments are processed by Stripe. WorkDecoded never sees or stores your card number; it only keeps your subscription status and the identifiers Stripe returns.
Technical data: necessary session and language cookies, and anonymous usage events (for example, that a page loaded or checkout opened) with no personal identifiers.
Only if you accept marketing cookies: Google Ads and Meta identifiers to measure our advertising. When you subscribe, Meta may receive your email in hashed form to attribute the conversion.
Why we use them and on what legal basis
To provide the service you subscribe to (performance of a contract): your account, your workspace, the analyses and billing.
To meet legal obligations, such as keeping payment records.
To protect the service against abuse and fraud (legitimate interest): rate limits and technical logs.
If you create your account and do not activate a plan, to send you a few emails reminding you how to complete it (legitimate interest, related to the service you started to sign up for). There are at most about five, they stop as soon as you activate your plan, and each one includes a one-click unsubscribe link.
Analytics and ad measurement, only with your consent, which you can withdraw at any time from "Cookie settings".
We do not sell your data, share it with your employer or recruiters, or use it to train third-party models.
Who they are shared with
Stripe, to process payments and the subscription.
The hosting provider where WorkDecoded runs.
The email provider we use to send your account emails.
Google (Google Tag Manager and Google Ads) and Meta, only if you accept the corresponding cookies.
Some of these providers may process data outside the European Economic Area; when they do, they rely on the safeguards required by law (such as the European Commission’s standard contractual clauses).
How long we keep them
For as long as you keep your account. If you delete your account, we erase your information and documents immediately.
Payment records are kept by Stripe for as long as tax and accounting rules require.
Your rights
You can access, correct, take away (portability) and erase your data. From Settings → Your data you can download a full copy (data and documents) or delete your account yourself.
You can also object to or request restriction of processing by writing to us through the contact shown above.
If you believe we have not handled your request properly, you can complain to the data protection authority in your country (in Spain, the Agencia Española de Protección de Datos).
Security
Passwords are stored using hashing algorithms, never in readable form. The documents you upload are kept in private storage that is not reachable from the web and can only be downloaded from your account.
Changes to this policy
If we change this policy, we will update the version date. If the change is significant, we will let you know in your account.