Privacy Policy

Last updated: 1 January 2025

1. Data controller

Soongy Ltd (Company No. 15XXXXXX), 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: [email protected].

2. Data we collect

We collect and store the following personal data:

• Email address — required for account creation and delivery of the weekly shortlist.
• Password (hashed) — stored as a bcrypt hash. We never store your plaintext password.
• Preferences — your chosen country, city and job categories.
• Stripe customer ID and subscription ID — reference identifiers for billing. We do not store card numbers; these remain with Stripe.
• Account creation timestamp — for record-keeping.

3. Legal basis for processing

We process your data on the following bases under UK GDPR and EU GDPR:

• Contract performance — to deliver the service you subscribe to.
• Legitimate interest — to send billing notifications and renewal reminders.
• Legal obligation — to retain records required by UK company law.

4. How we use your data

• To authenticate your account.
• To generate and deliver your weekly job shortlist by email.
• To send billing-related emails (renewal reminders, payment receipts).
• To manage your Stripe subscription status.

We do not sell, rent or share your personal data with third parties for marketing purposes.

5. Third-party processors

• Stripe — payment processing. Subject to Stripe's Privacy Policy.
• Adzuna — job data API. No personal data is shared with Adzuna.
• SMTP provider — email delivery. Your email address is transmitted for delivery purposes only.
• PostgreSQL database — hosted data storage.

6. Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — delete your account and all associated data from your dashboard at any time, or by emailing [email protected].
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — cancel your subscription and delete your account at any time.

7. Retention

Your data is retained for as long as your account is active. Upon account deletion, all personal data is permanently removed from our database within 24 hours. Stripe may retain billing records for their own legal compliance purposes.

8. Cookies

We use a single session cookie (soongy.sid) to keep you logged in. This cookie contains no personal data — only a session identifier. It expires after 7 days of inactivity. We do not use tracking or advertising cookies.

9. Security

Passwords are hashed with bcrypt. Data is transmitted over HTTPS. Database access is restricted to application servers only.

10. Contact

For any data protection enquiries, contact: [email protected].