Privacy Policy

1. Introduction

Sellframe Ltd (company number SC472357), a company registered in Scotland, United Kingdom, is the Data Controller responsible for your personal data processed through 4dayweek.io. We are registered with the Information Commissioner's Office (ICO) under registration number ZA781833.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). This policy applies to all users of 4dayweek.io, including job seekers, employers, and visitors.

If you have any questions about this privacy policy or how we handle your personal data, please contact us at phil@4dayweek.io.

2. Information We Collect

We collect and process the following categories of personal data, depending on how you interact with our service. We only collect information that is necessary for the purposes described in this policy.

Account Information

When you create an account, we collect:

• Email address
• Password (stored as a bcrypt hash - we never store your plaintext password)
• Google OAuth identifier (if you sign in with Google)
• Account creation date and last login timestamp
• Whether your account is active (we can deactivate an account that breaks our rules, and a deactivated account cannot sign in)

To keep fake accounts out, we refuse sign-ups from email domains that belong to disposable-email services, and we limit how many accounts can be created from one IP address in an hour.

Profile Information

You may optionally provide the following profile information to enhance your experience:

• Full name
• Country of residence
• Biography and personal description
• Social links (LinkedIn, GitHub, Twitter/X, personal website)
• Job preferences (categories, levels, work arrangement)
• Salary expectations and currency preference
• Availability and job-seeking status

Work History & Education

If you choose to add work history or education to your profile, we collect the details you provide, including employer names, job titles, dates of employment, educational institutions, qualifications, and related descriptions.

Resume Data

When you upload a resume, the file is stored securely on DigitalOcean Spaces (cloud object storage). To help structure your profile, the text content of your resume is sent to an AI service for parsing, which extracts information such as skills, work experience, and education.

Job Application Data

When you apply for a job through our platform, we collect:

• Full name and email address
• LinkedIn profile URL (if provided)
• Resume/CV file
• Cover letter (if provided)
• Responses to custom application fields set by the employer
• Responses to qualifier questions (eligibility criteria)
• Application status and tracking data

Your Activity on the Site

When you are signed in we keep what you do in your account so that the features work: the jobs you save and the stage of each job in your application tracker; the searches you save as alerts (the filters, a name and how often we email you) and your recent searches, up to 50; and the jobs and companies you tell us are "not for me". Deleting your account deletes them.

Employer Data

If you register as an employer, we collect:

• Company profile information (name, description, logo, website, social links, industry, size, location, work schedule policy, benefits)
• Job posting content and metadata
• Stripe customer identifier for billing purposes (we do not store credit card numbers or full payment details - these are held by Stripe)

Company teams. More than one person can manage a company on 4dayweek.io. The people who do see each other's name (if they gave one) and email address on the company's Team page, and any of them can remove another, except themselves and the person who pays for the company's live plan. When someone joins a company through the website, we email its other members to say who joined (by email address) and, where we know it, how: by claiming the company's page with an address on its website, by accepting an invitation, or because they are on the 4dayweek.io team.

Team invitations. When a member invites a colleague, they give us the colleague's email address. It must be on the domain of the company's website, or a subdomain of it, and cannot be a personal, relay or disposable address. We use it to send that one invitation and to show the pending invitation (the address and its dates) to the company's members on its Team page. The email says who gave us the address, why we hold it and for how long, and how to ask us to delete it or to object, and we send no reminders. A link works for up to 7 days, and stops sooner if it is used or withdrawn or if the member who sent it is removed. We keep the invitation (the address, who sent it, its dates, and whether it was accepted or withdrawn) while it can still be used, and delete it 30 days after it expires, is accepted or is withdrawn, whichever comes first. Our record that we sent the invitation email, which includes the address, is an email send record and is kept as section 7 says for those.

Analytics & Usage Data

To understand how our service is used and to improve it, we collect:

• IP address - hashed using SHA-256 with a cryptographic salt before storage (see callout below)
• HTTP referrer URL
• UTM campaign parameters
• Job views, saves, and application events
• Page views and navigation patterns

Approximate Location

To show you relevant roles on our job search, we pre-select an approximate starting location based on your general area — derived from your IP address using an offline IP-geolocation database (DB-IP) on our own servers. This rests on our legitimate interest in personalising results: we do not store this location, and you can change or clear it at any time. If you are not signed in, or your account has no country, we also use the country from that lookup to decide which adverts to show you, so that an advert meant for one country is not shown in another (unless you have asked us to stop using your location for this — see the "Suggestions about partner services" row in section 3). It is used only for that request and is not stored.

Newsletter Data

If you subscribe to our newsletter, we collect your email address and the source of your opt-in (e.g. website signup form, during account registration). We send our emails through Amazon SES (Amazon Web Services, United States). Until November 2026 some of them went through Brevo (formerly Sendinblue), based in France, which may still hold a copy of our contact list.

In your account settings you can switch each kind of email on or off: Weekly jobs email, Welcome & tips, Announcements and Job alerts (once you have saved a search as an alert). Each of those emails also carries an unsubscribe link. Emails about your account, such as password resets, receipts and application confirmations, are not optional.

API and MCP Access

Our public API and our Model Context Protocol endpoint require no account and no sign-in, and they return only public job listings and employer profiles — never personal data about our users. As with any request to our servers, we log the IP address, user agent, path and timestamp so that we can enforce rate limits and investigate abuse. For the MCP endpoint we additionally log which tool was called and how long it took, because every MCP request arrives at the same path and this is the only measure we have of whether the endpoint is used at all; we do not log the arguments you send or the results you receive. This rests on our legitimate interest in keeping the Service available and secure. These logs rotate by size, are not linked to any account, and are deleted at most 14 days after they are written.

3. How We Use Your Information

We process your personal data only where we have a valid legal basis under Article 6(1) of the UK GDPR. The table below sets out each processing purpose along with the corresponding legal basis.

4. Automated Processing and AI

We use artificial intelligence services to improve the quality and accuracy of information displayed on our platform. It is important to understand what data AI processes and what it does not.

Job and company data processing: We use two AI providers — Anthropic (Claude) and Google (Gemini) — for the following purposes, all of which involve only job and company data, never personal user data:

• Job data enrichment: Extracting structured information (category, level, skills, schedule type) from job descriptions
• Company description generation: Creating informative company profiles from publicly available data
• Location parsing: Identifying and structuring location data from job postings
• Salary parsing: Extracting and normalising salary information from job descriptions

Resume parsing: When you upload a resume, the text content is processed by Google (Gemini) to extract structured information such as skills, work experience, and education, with Anthropic (Claude) as an automatic fallback if that request fails. This is done to populate your profile and improve your experience on the platform, and to show the employer you apply to the details of a resume you attach to that application. Google operates under paid commercial terms that prohibit training on your data, and both providers are covered by the safeguards described in International transfers.

AI provider data handling: Google, our main AI provider, does not use your data to train its models: it operates under paid, commercial terms that exclude training on customer inputs and outputs. Data is sent to our AI providers via encrypted connections and processed in real time. Under Google’s terms, inputs and outputs may be retained on its infrastructure for a limited period for trust-and-safety review, after which they are deleted. This is governed by the respective data processing agreements, and transfers outside the UK are covered by the safeguards described in “International transfers” below.

No automated decision-making: We do not engage in solely automated decision-making that produces legal effects or similarly significant effects concerning you, as described in Article 22 of the UK GDPR. AI is used only to structure and enrich data - all material decisions (such as whether to display a job listing) involve human oversight.

Caching: AI responses are cached so that identical inputs are not reprocessed. Retention is split by what the cached response contains: entries derived from public job and company data are kept for up to 100 days, while entries derived from your resume or profile are kept for about a week (at most 8 days). Resume-derived cache entries are also purged immediately when you delete your account, rather than waiting for that window to expire.

AI Headshot Pack (retired)

We no longer sell the AI Headshot Pack, and we are deleting everything held for it. If you bought it, we hold the selfies you uploaded (biometric data under UK GDPR Article 9, which we processed on your explicit consent), a private model trained from them and the photos generated. They are on DigitalOcean Spaces with private access and, for training and generation, with our sub-processor Fal.ai.

AI provider: model training and image generation are performed by Fal.ai, our sub-processor, via encrypted connections. Fal.ai does not use your data to train its base models, and acts under a contracted data processing agreement limited to the purpose of fulfilling your headshot pack.

No training, no marketing: we do not use your selfies or generated photos to train our own models, to improve outputs for other users, or for any research, marketing, or advertising purpose.

Deleting it now or withdrawing consent: email hello@4dayweek.io and we will delete your selfies, model and photos and tell you when it is done. Withdrawal does not affect processing that occurred before you withdrew.

5. Data Sharing and Third Parties

We use the following third-party service providers to operate 4dayweek.io:

Employer data sharing: When you submit a job application through our platform, your application data (including name, email, LinkedIn URL, resume, cover letter, and responses to qualifier questions) is shared with the employer for that specific role. Once the employer receives your application, they become an independent data controller for that data, and their own privacy policy will govern their use of it. We recommend reviewing the employer's privacy policy before applying.

Your profile goes with your application: The employer you apply to can also see your 4dayweek.io profile as it is when they view your application: your headline, bio and links, where you live, the countries you can work in and whether you need visa sponsorship, languages, notice period and start date, whether you are actively looking, the kind of role, schedules, work arrangement and levels you are looking for and your years of experience, and your work experience and education. We never send an employer the minimum salary you have told us: it is not part of the profile an employer sees, whether or not you applied to them.

Reading the resume you attach: To show the employer the details of a resume attached to your application (skills, work experience, education, languages and certifications), its text may be processed by the same AI providers that read resumes for your own profile, described in Automated Processing and AI. The result is shown only to that employer, labelled as read from your resume, and the file itself stays the record. Nothing is scored or ranked.

Services You Choose to Connect

Some features on 4dayweek.io open a separate service, run by another company, that you can choose to start. Such a service is not one of our providers listed above. When you start it we send it the details described here, it becomes the controller of what it receives, and its own privacy policy governs what it does with that. Today there is one: JobCopilot.

What JobCopilot receives. When you sign in to JobCopilot through 4dayweek.io (with JobCopilot's own option to sign in with 4dayweek.io, or a link to 4dayweek.io/activate/jobcopilot) we sign you in to JobCopilot by sending it your name, email address and, if you have set one, your country. Nothing is sent before you start it, and we send nothing else: not your resume, saved jobs, applications or search history. What you then give JobCopilot directly, such as your resume and job preferences, is held by JobCopilot and not by us, so requests about it, including deletion, go to JobCopilot. Its privacy policy is at jobcopilot.com/privacy-policy.

What we earn. We earn a share of what you pay JobCopilot. We say so on the page that signs you in. We send your details because you asked to use the service, and we do not sell your personal data to JobCopilot or anyone else; separately, we earn a share of what you pay JobCopilot. To work out that share we may receive information from JobCopilot about which members signed up through us and what they paid. We also record, as part of our analytics, when you sign in to JobCopilot through us and which of our pages you came from. That record stays with us and is not sent to JobCopilot.

Why we send it, and where it goes. We send these details on the basis of your consent (UK GDPR Article 6(1)(a)), given when you start the service. JobCopilot is operated by a company outside the UK, and its own privacy policy says it stores data outside the European Economic Area. We have no data-transfer agreement with it of the kind we use for the providers above, and UK data-protection law may not protect your details once they reach it. By starting the service you explicitly consent to that transfer (Article 49(1)(a)); if you would rather not, do not start it. JobCopilot is optional and nothing else on 4dayweek.io needs it.

Auto-apply with AIApply. Our auto-apply buttons and cards (such as "Start auto-applying" and "Try auto-apply") are links to a page that AIApply, a separate company, runs for visitors from 4dayweek.io. It is not a service you connect in the sense above: we send AIApply nothing about you. If you follow the link, your browser connects to its site as it would to any other, and what you give AIApply there, such as your CV and job preferences, is held by AIApply and governed by its own privacy policy, at aiapply.co/privacy-policy. We earn a share of what you pay AIApply. To work out that share we may receive information from AIApply about sign-ups made through that page and what was paid. We count, as part of our analytics, clicks on those links and which of our pages they came from; that count is not sent to AIApply.

Data storage location: Our primary infrastructure is hosted on DigitalOcean servers located in the United States (New York region). Uploaded files (resumes, company logos) are stored on DigitalOcean Spaces in the same region. All traffic to our service is routed through Cloudflare's global network.

International transfers: As several of our service providers are based in the United States, personal data is transferred outside the United Kingdom. These transfers are safeguarded by the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), as appropriate. Each provider is chosen on the basis that it offers contractual safeguards of this kind, and we review that position when we add or change a provider. A service you choose to connect is the exception: see "Services You Choose to Connect" above.

Third-party links: Our website may contain links to third-party websites, including employer career pages and external job application URLs. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies before providing any personal data.

Other circumstances where we may disclose data:

• To employers: Application data as described above, only when you choose to apply for a role
• To the other members of your company: If you manage a company on 4dayweek.io, the people who manage it with you see your name (if you gave one) and your email address on the company's Team page, and are emailed when you join through the website (see "Employer Data" above). If a colleague invites you, the company's members see the address they gave on that page until the invitation ends
• To a service you connect: Your name, email address and, if you have set one, your country, only when you start that service (see "Services You Choose to Connect" above)
• Legal requirements: Where we are compelled to do so by law, regulation, court order, or governmental authority
• Business transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity. We will provide at least 30 days' advance notice via email or a prominent notice on our website before any such transfer
• Anonymised statistics: We may share aggregate, anonymised statistics (such as total job counts or application volumes) that cannot be used to identify any individual

6. Cookies and Similar Technologies

We use a minimal number of cookies. Most are strictly essential or functional. We use one product-analytics cookie (PostHog), listed below. We do not use advertising cookies, and we do not track your browsing across other websites.

Staying signed in

On a personal device you stay signed in while you use the site: each visit renews your sign-in, which ends after 90 days without use, or after 365 days at most. You can be signed in on several devices at once. To end every sign-in except the one you are using, choose “Sign out other devices” in your account settings. If you sign in on a public or shared device, tick the shared-device option: that sign-in ends when you close the browser, or after 24 hours, and is never renewed.

We do not currently display a cookie consent banner, so the analytics cookie above is set without asking you first. We are working to change that. In the meantime it is configured narrowly: no automatic click tracking, a recording only after an error on the page, and no personal record of signed-out visitors. PostHog records nothing at all if your browser sends Do-Not-Track or Global Privacy Control. You can block or delete this cookie at any time using the browser controls described below. Nothing on the site stops working if you do.

No advertising or cross-site tracking: We do not use Google Analytics, Facebook Pixel, advertising cookies, or any technology that follows you across other websites. Your activity on 4dayweek.io is measured only by the two analytics providers named in the table above (Fathom, which is cookieless, and PostHog), and is never sold or shared for advertising.

Do-Not-Track and Global Privacy Control: If your browser sends a Do-Not-Track (DNT) or Global Privacy Control (GPC) signal — GPC is on by default in Brave and DuckDuckGo, and optional in Firefox — PostHog records nothing from your visit: no events, no error reports and no session recording. Fathom's cookieless, aggregate page-view counts are unaffected by either signal.

Email tracking: Our weekly jobs email, welcome emails and announcements contain a small image that records whether the email was opened, and their links pass through our own server so that we can record clicks. We use this to measure which emails are useful and to send the weekly jobs email first to members who have recently opened or clicked. We keep individual opens and clicks for 90 days, and a record of each email, including whether you clicked it, for 7 months (see section 7). Account emails such as password resets and receipts, and job alerts, are not tracked this way. You can stop the open signal by turning off image loading in your email client, or stop the emails in your account settings.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. The following table sets out our retention periods:

8. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to certain exceptions and limitations set out in the legislation.

• Right of access (Article 15): You have the right to request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to rectification (Article 16): You have the right to request correction of inaccurate personal data, or completion of incomplete data.
• Right to erasure (Article 17): You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose or you withdraw consent. Exception: if you have purchased paid products from us, we must retain financial records (invoices, purchases, subscriptions, refunds) for 6 years after the end of the tax year to comply with UK HMRC rules. In that case, we anonymise the personally-identifying fields (email, name) attached to those financial records while preserving the records themselves against an anonymised user identifier. Stripe retains its own billing records independently under its own retention policy; we can request deletion on your behalf by contacting Stripe support, subject to their legal obligations.
• Right to restrict processing (Article 18): You have the right to request that we limit the processing of your data in certain circumstances, such as while a rectification request is being verified.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to object (Article 21): You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. For suggestions about partner services we stop at once, and the dismiss button does exactly that.
• Right to withdraw consent: Where we rely on your consent (e.g. newsletter), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Account deletion: You can permanently delete your account and all associated data through the account settings in your dashboard. This is a hard delete - your personal data, profile information, and resume files will be permanently removed from our systems. Please note that applications previously submitted to employers may have already been shared and cannot be recalled. Employer accounts are deleted on request: email phil@4dayweek.io.

How to exercise your rights:

• Self-service: Edit your profile, manage preferences, and delete your account through the dashboard
• Email: Send a request to phil@4dayweek.io for any rights request. We will verify your identity and respond within 30 days. If a request is particularly complex, we will inform you of any extension (up to a further 60 days) within the initial 30-day period.

Right to complain: If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• Online: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

9. Job Information Disclaimer

Many of the job listings displayed on 4dayweek.io are sourced from company career pages, applicant tracking systems, and other third-party sources through automated processes. While we make every effort to ensure the accuracy and timeliness of the information presented, we cannot guarantee that all details are complete, accurate, or reflect real-time changes made by the employer.

Job data is updated regularly through our processing pipeline. AI enrichment is used to improve the accuracy of structured data such as job categories, skill requirements, schedule types, and salary information. While this process significantly improves data quality, no guarantee of completeness or accuracy is made.

We strongly recommend that you verify all job details, including schedule type, compensation, location, and benefits, directly with the employer before making any decisions based on the information displayed on our platform.

10. Children's Privacy

4dayweek.io is a professional job board intended for individuals aged 16 and over. We do not knowingly collect, process, or store personal data from anyone under the age of 16. If we become aware that we have collected personal data from a person under 16, we will take immediate steps to delete that data from our systems.

If you are a parent or guardian and believe that a child under 16 has provided personal data to us, please contact us at phil@4dayweek.io so that we can take appropriate action.

11. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Password security: All passwords are hashed using bcrypt with a cost factor of 12. We never store plaintext passwords.
• Session tokens: Cryptographically random session tokens are generated for each authenticated session.
• IP address hashing: IP addresses are irreversibly hashed using SHA-256 with a cryptographic salt before being stored in our database. PostHog, our product-analytics provider, is configured to discard IP addresses rather than store them.
• Cookie security: Session cookies are set with HttpOnly (preventing JavaScript access) and Secure (HTTPS-only) flags, with SameSite=Lax to prevent cross-site request forgery.
• Encryption in transit: All traffic to and from 4dayweek.io is encrypted using HTTPS, enforced through Cloudflare.
• Rate limiting: API endpoints are rate-limited to prevent brute-force attacks and abuse.
• Request size limits: Upload and request body size limits are enforced to prevent resource exhaustion attacks.
• Payment security: All payment processing is handled by Stripe, which is certified to PCI DSS Level 1 (the highest level of payment security certification). We never store credit card numbers or full payment details on our servers.
• Backups: Automated database backups are performed regularly to ensure data can be recovered in the event of a failure.
• Access control: Access to production systems, databases, and infrastructure is restricted to the sole operator of Sellframe Ltd.

While we implement these measures to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining and improving our security practices.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.

Recent changes. November 2026: we stopped selling the AI Headshot Pack and are deleting its data (section 4). We now refuse sign-ups from disposable-email domains and limit sign-ups per IP address. We describe more clearly how we send and measure email (sections 2, 6 and 7). Our auto-apply buttons now open AIApply, a separate company, through a plain link that sends it nothing about you, and we earn a share of what you pay it (see "Services You Choose to Connect", section 5). Signing in to JobCopilot through 4dayweek.io works as before. We now describe how a company's team works: the people who manage a company see each other's name and email address, are told when someone joins, and can invite colleagues, whose email addresses we keep for a limited time (sections 2, 3, 5 and 7). We also reworded how we describe instant job alerts (section 3). We also now say that the exclusion from model training applies to Google, our main AI provider (sections 2 and 4). October 2026: added "Services You Choose to Connect" (section 5) and its row in the table in section 3. It sets out what JobCopilot receives when you start auto-apply, that we earn a share of what you pay it, and how that transfer is made. We also added a row to that table for suggestions about partner services on your dashboard, which use the location you have told us and send the partner nothing about you. If you dismiss one, we now record that on your account so that it does not come back. We also now use your country (from your account, or approximately from your IP address if you are not signed in) to choose which adverts you see. We also now record, in our own analytics, when you start auto-apply and which of our pages you started it from.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide prominent notice by either:

• Sending an email notification to the address associated with your account, or
• Displaying a prominent notice on our website prior to the changes taking effect.

We encourage you to review this policy periodically. Your continued use of 4dayweek.io after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our handling of your personal data, please contact us using the details below.

Please also see our Terms of Service for the terms governing your use of 4dayweek.io.