Privacy Policy

1. Data controller

The GDG MienTrung core team is the data controller for this service. Contact details are at the bottom of this page.

2. Data we collect

Account data from Google (name, email, avatar), used to sign you in.

Profile data you add yourself (headline, skills, GDG member flag), used to present you to employers.

Application data (full name, email, phone, note, CV file or link), shared only with the company whose job you apply to, for that specific recruitment.

Employer data (company profile, members, job posts), published on the board after moderation.

Technical data (request logs with user ids, never emails or phone numbers, plus error monitoring data), used to keep the service running.

Email log (hashed recipient address, event type, delivery status), used to debug delivery issues.

3. Lawful basis

The lawful basis for processing your data is your explicit consent, given at the point of sign-in, upload or submission, consistent with Decree 13/2023/ND-CP on personal data protection.

4. Retention

CV files and application contact details are kept for 12 months after the application date, then deleted or nulled.

Account data is kept until you request deletion. At that point the account is anonymised in place: email and Google id are replaced with placeholder values, the name is set to "Deleted user", the avatar, skills and CV are removed, and related applications are anonymised too.

Moderation history is kept without personal data.

5. Processors

Google (sign-in), headquartered in the United States, global infrastructure.

Vercel (web hosting), headquartered in the United States, global infrastructure.

Railway (API and database hosting), headquartered in the United States, global infrastructure.

Cloudflare (DNS, CDN and R2 file storage), headquartered in the United States, global infrastructure.

Resend (transactional email), headquartered in the United States, global infrastructure.

Sentry (error monitoring, optional), headquartered in the United States, global infrastructure.

6. Sharing your data

Your data is shared only with the company you apply to and with the processors listed above. We never sell personal data.

7. Security

Private files are kept in access-restricted storage with download links that expire after 10 minutes, HTTPS everywhere, HttpOnly session cookies, role-based access control, and a full moderation log.

8. Your rights

You have the right to request access, correction or deletion of your data, to withdraw consent, or to file a complaint.

To exercise these rights, contact us using the details at the bottom of this page. We respond within 30 days.

9. Cookies

The service uses only two strictly necessary session cookies: access_token (15 minutes) and refresh_token (7 days). No advertising or analytics cookies are used.

If analytics is added later, it will either be cookie-less or disclosed here before it ships.

10. Children

This service is intended for people aged 16 and older.

11. Changes to this policy

We may update this policy from time to time. The latest version is always posted on this page with its update date.