Privacy Policy

The controller of your personal data under the EU General Data Protection Regulation (GDPR) is Vascora OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia, represented by Julian Busarello. Contact: hello@getsari.com.

This policy also reflects applicable data protection laws in the countries we serve, including the Philippines Data Privacy Act (RA 10173), Vietnam Decree 13/2023/ND-CP (PDPD) and Thailand PDPA. Where those laws require more, we follow the stricter rule.

• Account data: email address, display name, password (hashed), avatar.
• Profile data: skills, rates, categories, preferences, match vector.
• Usage data: jobs viewed/saved/applied, credit usage, feature usage.
• Content you provide: CVs, notes, invoices, time entries, finance records, chat messages.
• Optional integrations: Telegram chat ID (if you connect Telegram), Google account (if you log in with Google).
• Payment data: we do not store your card details. Payments are handled by Stripe.

• Provide and operate the Service (performance of the contract).
• Authenticate you and keep your account secure (contract; legitimate interest).
• Process payments and subscriptions (contract; legal obligation).
• Send service notifications and (with consent) Telegram push messages (contract; consent).
• Improve the Service through aggregated, non-personal statistics (legitimate interest).
• Comply with legal obligations (e.g. tax and accounting law) (legal obligation).

We share data only with processors needed to run the Service:

• Supabase – database, authentication, storage.
• Vercel – application hosting.
• Stripe – payment processing (their own privacy policy applies to payment data).
• Google – optional sign-in (OAuth).
• DeepSeek – AI features (pitch generation, scam analysis). Content you submit to AI features may be sent to DeepSeek for processing.
• Telegram – notifications, if you opt in.

Job listings shown in the Service come from public third-party platforms. We do not disclose your data to them.

Your data may be processed outside the EEA (e.g. by AI and hosting providers). Where we transfer personal data outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or adequacy decisions. For processors in the Philippines, Vietnam and Thailand, we rely on their local data protection obligations.

We keep your data only as long as needed for the purposes described, or as required by law (e.g. accounting records). If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep it for legal or tax reasons.

Depending on your location you may have the following rights:

• Right of access (GDPR Art. 15; PH RA 10173; TH PDPA; VN PDPD).
• Right to rectification (Art. 16).
• Right to erasure (“right to be forgotten”, Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21).
• Right to withdraw consent at any time (Art. 7).
• Right to lodge a complaint with a supervisory authority (in Estonia: the Andmekaitse Inspektsioon, aki.ee).

To exercise any right, email hello@getsari.com. We respond within the timeframe required by law (usually 30 days). We may ask you to verify your identity first.

We use HTTPS, hashed passwords, Supabase Row Level Security and role-based access to protect your data. No method of transmission or storage is 100% secure; you use the Service at your own risk regarding risks beyond our control.

The Service is not intended for minors under 18. We do not knowingly collect data from children. If you believe a child provided us data, contact us and we will delete it.

We may update this policy. Material changes will be announced by email or in-app. The “last updated” date above reflects the current version.

Data protection enquiries: hello@getsari.com or Vascora OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia.