Privacy policy: data and cookies

Controller

Arbeitio collects job ads that companies have published openly for positions in Austria. The controller under the GDPR is the operator of this website. The operator's provider details are given in the legal notice (Impressum), linked in the footer of every page; for anything about data protection you can write to them directly at contact@arbeitio.com.

Data we process

You can search the site without an account and without giving us any details about yourself. We do not set cookies for advertising or marketing. So that the site remembers your settings, it keeps a few details only in your browser's storage. Local storage, which stays until you clear it, holds the colour scheme you picked (light or dark), your "My Jobs" list of the jobs you have marked as applied, the filters you last set in the job feed (never the search term) and the time of your last visit. Session storage, which the browser discards when you close the tab, holds the ad language you chose in the feed, your scroll position in the company list, technical counters that stop the page from reloading endlessly after the site has been updated, and a note that a click on the logo has already been counted for statistics in this session. As long as you are not signed in, none of this reaches us; you can delete it in your browser at any time.

An account is optional. If you create one, you sign in with a link we send you by e-mail or, if you choose to sign in with Google, with your Google account. Our server then keeps your e-mail address with the time it was confirmed, a name if you enter one, and your "My Jobs" list; a list you had kept only in the browser is moved into your account when you sign in and then removed from the browser. If you sign in with Google, we take your name and profile picture from Google and store the identifier and access credentials Google issues for your account. The sign-in link is sent through the e-mail service Resend, a company based in the USA; Standard Contractual Clauses cover the transfer there. On your account page you can download your data as a file or remove your account whenever you like.

With an account you can set up job alerts on your account page. For this our server keeps your e-mail address, up to ten search terms that you type in yourself, whether the alerts are active or paused, and a list of the jobs we have already told you about, with the time we did so, so that no job reaches you twice. Every day we match new ads against your terms and e-mail you the hits; once a week a summary follows of matching jobs that have since closed. These e-mails also go out through Resend. On your account page you can pause the alerts, remove single terms or delete everything at any time; deleting removes your terms and the list of jobs already sent.

Usage statistics and cookies

For visitor statistics we use Umami Cloud, a statistics tool run as a service by an outside provider. Your browser loads the counting script straight from that provider's servers (cloud.umami.is) and sends the measurements there; like any server you contact, Umami sees your IP address and technical details of your browser. What is recorded: the pages you open, with their address including any parameters in it and the page you came from, plus certain actions: opening a job ad and clicking "Apply" (each with the job's identifier and the company name), searches with the terms and place you enter, searches that find nothing, setting and clearing filters, switching the language, clicks in the menu, in the footer, on the logo and on similar jobs, and technical error messages from the browser. Umami works without cookies. We look at the results in summarised form and use them to improve the site. Browsers that declare themselves as automated are left out of the count.

As long as you are not signed in, the site sets no cookies at all. Cookies are only added when you sign in, and only ones that are technically necessary: the Auth.js session cookie (authjs.session-token, with the __Secure- prefix over HTTPS), which keeps you signed in for up to 30 days; the arbeitio.signed_in cookie, which holds nothing but the value "1", tells the site to look up your sign-in, also lasts at most 30 days and is removed again after you sign out; and, while you sign in, Auth.js security cookies that guard against forged requests (CSRF) and bring you back to the page you came from, plus, for a Google sign-in, check cookies for the sign-in flow that expire after 15 minutes. Without these cookies the sign-in you asked for could not work.

Hosting and service providers

The application and its database, which holds accounts and job alerts, run at Railway. Requests to arbeitio.com pass through Cloudflare's network, which caches and delivers the pages. Both providers necessarily handle your IP address and technical details of every request. Our own server counts requests per IP address only briefly in memory, to fend off overload and abuse such as mass requests for sign-in links, and drops those counters after a few minutes; we do not put IP addresses into the database. E-mails are sent through Resend, and visitor statistics run on Umami Cloud. If you choose to sign in with Google, Google receives what it needs for that. To analyse job ads, we send their text through the OpenRouter service to AI language models; no data about visitors goes with it. Messages to our contact address sit in a Microsoft mailbox (Outlook.com). Some of these providers are based outside the EU/EEA, so data may also travel to third countries.

Legal bases and how long we keep data

We process your account, your "My Jobs" list and your job alerts to provide the service you ask for (Art. 6(1)(b) GDPR). Running, securing and delivering the site, the summarised visitor statistics and showing published job ads rest on our legitimate interest in a site that works, is secure and keeps getting better (Art. 6(1)(f) GDPR). E-mail enquiries are handled under Art. 6(1)(b) or (f) GDPR, depending on what they are about.

A sign-in session expires after 30 days at the latest, and a sign-in link is valid for 24 hours. Your account data, your "My Jobs" list and your job alerts stay stored until you remove them yourself or delete your account. Deleting the account also deletes your sessions, the linked Google sign-in data, your list, your search terms together with the list of jobs already sent, and any sign-in links not yet used. What sits in your browser's storage is yours to manage.

Job ads and requests from employers

The ads come from employers' openly accessible career pages and from public job boards, for instance the AMS (Arbeitsmarktservice) or EURES. Where an ad names a contact person with contact details, we show them as they were published; to prepare an ad for the site, its text may be processed by AI language models (see "Hosting and service providers"). If an ad should be taken down or corrected, an e-mail to contact@arbeitio.com is enough.

Your GDPR rights

The GDPR entitles you to find out which personal data about you is processed and to have it corrected, erased or restricted, or handed over to you in a common format. Where processing rests on our legitimate interest, Art. 21 GDPR lets you object to it at any time on grounds arising from your own situation. Where you have given consent, you can take it back at any time for the future. You may also lodge a complaint with the supervisory authority; in Austria that is the DSB (dsb.gv.at), the national data protection authority. For any of these requests, write to contact@arbeitio.com.