Privacy Policy

Data Controller

Black Cat Solutions j.d.o.o., Ulica Bjeliš 23, 35000 Slavonski Brod operates the SteelGrid platform available at steelgrid.app. For questions about this Privacy Policy or your personal data, contact us at info@steelgrid.app.

This policy applies to all users of the platform, including workers, companies, and visitors.

Data We Collect

We collect the following categories of personal data:

• Account data: email address, hashed password, role (Worker or Company), account status, and the dates your account was created and your email was verified.
• Worker profile data: first and last name, date of birth, country, phone number, city/region, biography, education level, profession, industry background, work type preference, experience level, certifications, passport countries, and language skills. You decide what you add to your profile.
• Company profile data: company name, public URL slug, description, website, location, country, founded year, company size, and public contact details. Internal contact person fields are only accessible to SteelGrid administrators.
• Application data: cover letter text, application status, and the timestamps of each status change.
• Contact form submissions: your name, email address, subject, and message.
• Authentication and security data: session tokens, login timestamps, last login date, and short-lived password reset or email verification tokens.
• Aggregated usage analytics: page view counts collected by Vercel Analytics. No personally identifiable information is stored in our analytics.

How We Use Your Data

We process your personal data for the following purposes:

• Providing the platform: creating and managing your account, displaying your profile, routing applications to companies, and operating job listings.
• Authentication and security: verifying your identity when you sign in, enabling password recovery, and confirming your email address.
• Transactional email: sending account verification links, password reset links, application status notifications, and contact form acknowledgements.
• Company verification: reviewing company profiles submitted for verification by our administrators.
• Moderation: reviewing content and accounts to keep the platform safe and compliant.
• Platform improvement: understanding how the platform is used through aggregated page analytics.

Who Can See Your Data

• Public: published job listings and verified company profiles (name, description, location, size, public contact details) are visible to all visitors without an account.
• Workers: your profile information is shared with companies only when you submit an application. Your contact details are never made available to a company unless your application is marked as Accepted.
• Companies: can view the profile and cover letter of any worker who applies to one of their positions. Internal company contact person details are never shown to workers or the public.
• Administrators: SteelGrid administrators can access all account and profile data for the purpose of verification and moderation.
• Sub-processors: we share data with our hosting and infrastructure providers only to the extent necessary to operate the platform. See the Processors section below.

Data Processors

We use the following third-party processors, each covered by a Data Processing Agreement:

• Vercel (vercel.com) — hosting, CDN, and aggregated page analytics. Data may be processed in the United States.
• Railway / PostgreSQL — database hosting. Data may be processed in the United States.
• Resend (resend.com) — transactional email delivery. Data may be processed in the United States.

Data Retention

While your account is active, we retain all profile and activity data associated with it.

When you delete your account, your personal identifiers (name, email, profile fields) are permanently removed. Application and job records are anonymised and retained to preserve platform integrity and accurate statistics.

Password reset and email verification tokens expire automatically within 24 hours and are deleted on use.

Contact form submissions are retained for up to 90 days to allow us to respond.

Your Rights

Under applicable data protection law, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data. Most profile fields can be updated directly in your dashboard.
• Erasure: request deletion of your account and personal data. You can delete your account at any time from the profile settings page, or by emailing info@steelgrid.app.
• Restriction: ask us to restrict processing of your data in certain circumstances.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Complaint: lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) if you believe we have mishandled your data.

To exercise any of these rights, email us at info@steelgrid.app.

Cookies and Tracking

We use a single session cookie to keep you signed in. This cookie is strictly necessary for the platform to function and is removed when you sign out or your session expires.

We do not use advertising, tracking, or third-party marketing cookies. Vercel Analytics collects aggregated, anonymous page view data and does not track you across other websites.

Security

We store passwords as bcrypt hashes. All data in transit is encrypted via HTTPS. Our database is hosted on Railway with access restricted to application credentials only.

No system is completely secure. If you discover a vulnerability, please report it to info@steelgrid.app.

Changes to This Policy

We may update this Privacy Policy when our practices change. Material changes will be announced by updating the effective date at the top of this page. Continued use of SteelGrid after an update constitutes acceptance of the revised policy.

Contact

Questions about this Privacy Policy? Email us at info@steelgrid.app or use the contact form at steelgrid.app/contact.