Privacy Policy

Who we are

matchremote.io is operated by Johannes Kepp, based in Sweden ("we", "us"). We are the data controller for the personal data described below. For any question or request, contact johanneskepp@gmail.com.

What we collect

• Your email address, to send sign in codes and, if you turn them on, match alerts.
• Your quiz answers (timezone, salary target, skills, experience, work style, industry preferences), used only to score job matches.
• A session cookie (`mr_session`), strictly necessary to keep you signed in. It is httpOnly, cannot be read by JavaScript, and carries no tracking or advertising purpose.
• Basic technical logs (request errors, email delivery status) kept for reliability, not for profiling.

We do not use analytics or advertising cookies. If that ever changes, this policy and, where the law requires it, a consent banner will change first.

Payment data

Subscriptions are billed by Paddle.com Market Limited, our payment provider and the Merchant of Record for every purchase. Paddle collects and processes your billing details and card information directly, we never see or store your full card number. Paddle acts as an independent data controller for that billing data under its own privacy policy, available at paddle.com/legal/privacy.

Why we process your data

• To provide the service (Article 6(1)(b) GDPR, performance of a contract): matching you to jobs, running your account, billing your subscription.
• Legitimate interest (Article 6(1)(f)): keeping sign in secure, preventing abuse of the sign in code system, basic error monitoring.
• We do not send marketing email. Match alert emails are a feature you turn on yourself and can turn off from your account page at any time.

Who we share it with

We use a small number of processors to run the service, each only for the purpose named:

• Supabase, our database host, stores your account, quiz answers, and matches.
• Paddle, our payment provider and Merchant of Record, handles billing and card data.
• Resend, our email provider, delivers sign in codes and match alerts.
• Vercel, our hosting provider, serves the website.

We never sell your data, and we never share it with advertisers. Some of these providers may process data outside the EU/EEA (for example in the United States); where that happens, it is covered by Standard Contractual Clauses or an equivalent safeguard required under GDPR.

How long we keep it

We keep your account, quiz answers, and match history for as long as your account is active. If you ask us to delete your account, we delete your personal data within 30 days, except where we are legally required to keep billing records for longer (Paddle handles those retention obligations for payment data on our behalf).

Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data yourself, any time, from your account page ("right to be forgotten"), or by asking us to do it for you
• Request a copy of your data in a portable format
• Object to or restrict certain processing
• Lodge a complaint with your national supervisory authority. In Sweden, that is the Swedish Authority for Privacy Protection (IMY).

To exercise any of these rights, email johanneskepp@gmail.com. We respond within 30 days.

Children

matchremote is not intended for anyone under 16 years old.

Changes to this policy

If we make a material change to how we handle your data, we will update this page and change the effective date above.