# Legal

> The agreements that govern your use of the HyperJobs API, and the notices explaining how we handle data.

Source: https://hyperjobs.io/legal

Five documents. The [Terms of Service](/legal/terms) are the contract — what you
may do with the data you retrieve is section 5, and the restrictions are section
6. The [Privacy Policy](/legal/privacy) covers personal data, including the
postings themselves. The rest are narrower. They are written to be read, so if
any of it is unclear, that is worth telling us about:
<Email kind="hello" subject="Legal" />.

<CardGroup cols={2}>
  <Card title="Terms of Service" icon="Scale" href="/legal/terms">
    The contract. Your licence to use the data, what you may not do with it,
    quotas, fees, liability, and Italian governing law.
  </Card>
  <Card title="Privacy Policy" icon="ShieldCheck" href="/legal/privacy">
    What personal data we hold and why, the device fingerprint explained
    honestly, and how to exercise your GDPR rights.
  </Card>
  <Card title="Cookie Policy" icon="Cookie" href="/legal/cookies">
    Every cookie we set, the two things the banner asks permission for, and what
    rejecting does and does not stop.
  </Card>
  <Card title="Refund Policy" icon="Receipt" href="/legal/refund">
    Billing in advance, cancelling at period end, the EU withdrawal right, and
    when we refund anyway.
  </Card>
  <Card title="Subprocessors" icon="Server" href="/legal/subprocessors">
    Every third party that processes data for us, what each receives, and where
    it runs.
  </Card>
</CardGroup>

## The documents

| Document | What it covers | Version | Last updated |
| --- | --- | --- | --- |
| [Terms of Service](/legal/terms) | The agreement between you and us: licence, restrictions, acceptable use, fees, liability, governing law | 1.0 | 15 July 2026 |
| [Privacy Policy](/legal/privacy) | Personal data — yours, and personal data incidentally present in job postings | 1.0 | 15 July 2026 |
| [Cookie Policy](/legal/cookies) | Cookies and browser storage the portal uses | 1.0 | 15 July 2026 |
| [Refund Policy](/legal/refund) | Billing, cancellation, withdrawal rights, refunds | 1.0 | 15 July 2026 |
| [Subprocessors](/legal/subprocessors) | Third-party providers referenced by the Privacy Policy | 1.0 | 15 July 2026 |

## Who you are contracting with

The service is operated by <LegalEntity />. Italian law governs, and the courts
of Salerno have jurisdiction — with the usual carve-out preserving a consumer's
right to their own courts and their own country's mandatory law.

HyperJobs is a business product: a read-only API sold to companies and
developers. It is not a job board, and there is no application feature, CV upload,
or candidate profile anywhere in it.

## A few things worth knowing without reading all five

<AccordionGroup>
  <Accordion title="Can I resell the data?">
    You can build a product on it, charge for that product, and show the data to
    your users. You cannot become a source of the dataset itself — no reselling
    it as a feed, a file, or an API, and no assembling a competing jobs dataset
    for resale. Section 6 of the [Terms](/legal/terms) draws the line precisely,
    and [data licensing](/help/data-licensing) covers the common cases. If your
    use case sits near the line, ask before you build.
  </Accordion>

  <Accordion title="Is the data guaranteed accurate?">
    No, and the [Terms](/legal/terms) say so in section 11. Postings are mirrored
    from employers' own boards, so they go stale when the employer moves.
    Enrichment fields — skills, seniority, salary, taxonomies — are derived by
    classifiers and are wrong some of the time. Do not make it the sole basis of
    a decision that affects someone's employment. Found something wrong? Send the
    job id — see [data corrections](/help/data-corrections).
  </Accordion>

  <Accordion title="What does the cookie banner ask about?">
    Two things. **Product analytics** — we use PostHog, and with your consent it
    stores an id on your device, links what you read to your account, and records
    session replay. And the **device fingerprint** taken at signup to catch bulk
    account abuse. Everything else we set is strictly necessary and needs no
    consent. Two things rejecting does *not* stop, because you should hear it
    here rather than find it: anonymous page counts that store nothing on your
    device, and our own backend's record of what your account did — that you
    created a key or bought a plan. There are no advertising or cross-site
    tracking cookies at all. The [Cookie Policy](/legal/cookies) has every cookie
    and the reasoning in full.
  </Accordion>

  <Accordion title="Do you send marketing email?">
    Only the developer newsletter, only if you ask for it, and only after you
    confirm by clicking a link we email you — subscribing is your consent under
    Art. 6(1)(a), and we keep a record of it. Every issue has a one-click
    unsubscribe link that works without logging in. Transactional mail —
    verification, password resets, billing notices — is separate, is not
    marketing, and does not stop when you unsubscribe. The
    [Privacy Policy](/legal/privacy) covers what we store and for how long.
  </Accordion>

  <Accordion title="You fingerprint my device?">
    At signup and sign-in, for abuse prevention — stopping one person farming
    free accounts. It uses the open-source FingerprintJS library, which runs
    entirely in your browser and sends nothing to FingerprintJS; they are not a
    subprocessor. There is no automated blocking and no automated
    decision-making, so Article 22 GDPR does not apply. The
    [Privacy Policy](/legal/privacy) explains the legal basis and how to object.
  </Accordion>

  <Accordion title="How do I delete my account or export my data?">
    Email <Email kind="dpo" subject="Account Deletion Request" />. There is no
    self-serve delete button in the portal, and we would rather say that than
    send you looking for one. A person handles it. Billing records survive
    deletion because Italian tax law requires it, and a short post-deletion
    record exists to stop delete-and-resignup resetting a free quota — both are
    in the [Privacy Policy](/legal/privacy), and
    [deleting your account](/help/delete-account) walks through it.
  </Accordion>

  <Accordion title="I'm named in a job posting on your API">
    Email <Email kind="dpo" subject="Removal request — named in a posting" />
    with the posting link or job id. You do not need to make a legal argument;
    ask and we remove it. Section 7 of the [Privacy Policy](/legal/privacy)
    explains how a person ends up in a company's job ad and what we do about it.
  </Accordion>

  <Accordion title="What happens when I cancel?">
    Cancellation runs through the Stripe customer portal and takes effect at the
    end of the period you have paid for — access continues until then. Unused
    time is not refunded by default, but the [Refund Policy](/legal/refund) has
    real exceptions: duplicate charges, service failures, and subscriptions you
    never used.
  </Accordion>
</AccordionGroup>

## Contact

| Topic | Contact |
| --- | --- |
| Legal, licensing, billing | <Email kind="hello" /> |
| Data protection and GDPR requests | <Email kind="dpo" /> |
| Security disclosure | <Email kind="security" /> |
| Technical questions, bad data | <Email kind="support" /> |

For anything else, [support](/docs/support) lists what to include so we can
actually help.