Privacy Policy.

This policy explains how The Cycling Brief processes personal data when you use our website and services. We are based in the EU and process data in the EU.

1. Data controller

The controller is Tiago Torres. For any privacy question or to exercise your rights, contact us at hello@thecyclingbrief.com.

2. What data we collect and why

Account

Email address and a password (stored only as a secure hash), and your account type (candidate or recruiter). Used to create and manage your account and sign you in. Legal basis: performance of our contract with you.

Candidate profile

Where you choose to provide it: your name, location and country, current role and professional background, cycling knowledge and experience, target segment, skills, preferred job types and locations, languages, relocation availability, and up to five industry tags. Used to match you with listings and to present your profile to a recruiter when you apply. Legal basis: performance of contract and your consent.

Recruiter / company profile

Company name, description, website, logo, industry segment, country and location, and your listings. Used to publish your public company page and manage your listings. Legal basis: performance of contract.

Activity

Applications, saved jobs and notifications. Used to provide the core features of the Platform.

Technical data

IP address, browser and device information, and security and activity logs. Used to keep the Platform secure and working. Legal basis: our legitimate interest in security and reliability.

Communications

If you opt in, we send you email notifications about listings that match your tags. You can turn these off at any time in your profile or via the unsubscribe link. Legal basis: consent.

3. Curated (organic) listings

Some listings are curated from companies’ public careers pages. These describe jobs, not the personal data of our candidates, and link out to the original source.

4. Who we share data with

We do not sell your data. Candidate profiles are private and only shown to a recruiter when you apply to their listing. We use a small number of trusted service providers (sub-processors) who process data on our behalf under contract:

• Supabase, database, authentication and storage, hosted in the EU (Ireland).
• Vercel, application hosting (EU region).
• Resend, sending transactional and notification emails.

When paid features launch, a PCI-compliant payment provider will process payments; we will not store full card details. This list is kept current as our providers change.

5. International transfers

We aim to keep personal data within the EU/EEA. Where a provider processes data outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

6. How long we keep data

• Active account: for as long as your account exists.
• After deletion: we delete or anonymise your personal data, keeping only what the law requires (e.g. billing records) for the applicable statutory period.
• Applications: retained while relevant to the selection process and for a limited period afterwards.
• Security and activity logs: a limited period, then deleted.

7. Cookies

We use only essential cookies needed to sign you in and keep your session secure. We do not use advertising cookies. If we add analytics, we will use a privacy-friendly, cookieless tool.

8. Platform administration

A limited number of platform administrators can access data where needed to operate, support and moderate the service. Access is restricted and logged.

9. Automated processing

Matching between listings and profiles is based on overlapping tags and is informative only. We do not make automated decisions that produce legal or similarly significant effects about you.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with your supervisory authority (in Portugal, the CNPD).

To exercise any of these, contact us at hello@thecyclingbrief.com. We will also inform you of any security incident that is likely to affect your rights.

11. Changes to this policy

We may update this policy; the current version is always published on this page, with the date shown above.