This policy covers this website only — the pages at placemefast.com.
It covers the public pages and the act of signing in. How resumes, job-search data, and any connected mailbox are handled inside your account is described in the terms you accept when the account is created; this document does not stand in for that.
The short version
The public pages are static. If you only read them, you give us nothing beyond the ordinary server logs described below.
There is no tracking of any kind. No analytics, no tracking pixel, no advertising network, no social media embed, and no third-party script. Fonts are served from our own domain rather than requested from Google.
One cookie, and only if you sign in. It records that you are signed in and nothing else. It carries no identifier we can use to follow you, it is set only after you enter your password, and it is deleted when you sign out. It is strictly necessary to keep you signed in, which is why there is no consent banner asking about it — there is nothing optional to consent to.
What we collect
If you sign in
We process the email address and password you enter, for the single purpose of checking whether they are correct. The password is never written to a log and never sent anywhere else.
If they are correct, we place one cookie on your device recording that the session is valid. It is httpOnly, so page scripts cannot read it, and it is restricted to this site.
Why: without it you would be signed out on every page you opened. Our basis for this is that it is strictly necessary to provide something you asked for.
If you ask us for an account
If you write to us asking for access, we hold that correspondence — your email address and whatever you chose to tell us — so we can reply and set the account up. It is not added to a mailing list, not loaded into a marketing platform, and not shared with, sold to, or rented to anyone.
Server logs
This site is hosted on Vercel. Like any web host, their infrastructure processes technical information needed to serve a request — your IP address, browser user-agent, the URL requested, and a timestamp. This is standard operation of a web server, and it happens whether or not you use the form.
We do not build profiles from these logs and we do not combine them with form submissions.
The sign-in endpoint also holds an IP address briefly in memory to limit repeated attempts, which is what stops someone guessing passwords at speed. It is not written to disk and does not survive the server process.
How long we keep it
The session cookie expires seven days after you sign in, and is deleted immediately when you sign out. Correspondence about an account is kept until you ask us to delete it.
When you delete your account, everything held in it goes with it — your profile, your preferences, your resumes, and the record of applications made through it.
Two fields are kept: your name and email address. They are retained for one purpose only, which is to recognise that this person has already had an account, so that a deleted account cannot be reopened repeatedly to keep claiming the free plan. They are not used to contact you, not used for marketing, and not combined with anything else. Our basis for keeping them is our legitimate interest in preventing that abuse, and you can object to it — see below.
Server logs are retained according to our hosting provider's own retention policy, which we do not control.
Who else sees it
Two providers are involved in operating this site, and neither receives your data for their own purposes:
- Vercel, which hosts the site and serves the pages.
- Our email provider, which carries any correspondence between us.
That is the complete list. There are no other processors, no advertising partners, and no analytics vendors.
Your rights
Wherever you are, you can ask us to:
- Tell you what we hold about you.
- Correct anything inaccurate.
- Delete it entirely.
- Stop contacting you.
If you are in the UK or EU, the UK GDPR and GDPR give you these rights explicitly, along with the right to withdraw consent at any time and the right to complain to your data protection authority. If you are a California resident, the CCPA gives you rights of access and deletion, and the right not to be discriminated against for exercising them. We do not sell personal information, as that term is defined under the CCPA, and we never have.
We do not require you to prove a legal basis before we act. Ask, and we will do it.
The one limit worth stating plainly: deleting your account leaves your name and email behind, for the anti-abuse reason described above. If you want those removed too, say so and we will discuss it rather than hiding behind a policy — but you should know that the effect is that we can no longer tell a returning person from a new one.
To make any of these requests, email us at the privacy address on our contact page. A request to delete your details takes effect as soon as we action it and needs no explanation.
Children
This site is aimed at people looking for work and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us details, tell us and we will delete them.
International transfers
We are contactable in the jurisdiction listed in our terms. Our hosting and email providers operate internationally, so a request may be processed on servers outside your country. Where required, those providers rely on their own transfer mechanisms.
Security
Data in transit is encrypted with HTTPS. The site sets strict security headers and loads no third-party code, which removes the most common route by which visitor data leaks from a website.
We are a small operation. We do not claim certification against a formal security standard, and we would rather say that than imply otherwise. Our approach and how to report a problem are described on the security page.
Changes
If this policy changes materially, the effective date at the top changes with it. Because we do not hold a marketing list, we cannot notify you of changes — which is itself a consequence of collecting as little as we do.
Contact
For anything in this policy, including a deletion request, use the privacy address on our contact page.