Privacy and personal data protection (English)

Key Definitions

1. Get on Board, LLC ("Get on Board" or "us"): Includes all Get on Board portals through country-specific access, the www.getonbrd.com portal, the Concierge recruiting service, and mobile applications, feeds, and XML and other services provided by us.
2. The services: All services provided by Get on Board, its websites, API services, feeds, applications, and others, both public and open, and those that require user registration.
3. Processing: Any operation we perform on personal data, including collecting, storing, organizing, consulting, analyzing, disclosing, transferring or deleting it.
4. Data subject: The individual the personal data refers to. In this document we address you as the subject of your own data.
5. Publishing entity ("entity" or "company"): An entity of any kind that offers a job vacancy at Get on Board. We also include recruiters acting individually on behalf of a company and the accounts of team members acting on behalf of the entity who may or may not have an employment or contractual relationship with the entity.
6. Professional applicant: Individual who applies for a job vacancy published in Get on Board or who registers with Get on Board with that intention. We may also refer to an applicant as a "professional", "Webpro", "candidate", or "applicant".
7. Job: A job offer or vacancy shared publicly by an organization, calling for qualified individuals to apply. The organization may have requirements or restrictions related to the candidates' professional profile, geographic location, or migratory status.
8. Application: Communication of an applicant expressing interest in a job offered by the organization, and sharing personal and professional information that allows the organization to evaluate the application. This includes filling out application forms, as well as the acceptance of invitations by a company.
9. Partners: Any kind of entity or individual, for or non-profit, with which Get on Board has established a commercial, strategic or mutual benefit relationship that does not belong to the categories stated above.
10. Third parties: Entity or individual of any kind that does not belong to any of the categories stated above.

What data we collect and where it comes from

Get on Board is a recruitment platform and service based on information exchanged between recruiters and applicants. This information includes the following:

Who is in our databases

1. Professionals registered with Get on Board.
2. Team members of a publishing organization.
3. People whose CV a company imported into Get on Board and who never registered with us.
4. People subscribed to job alerts.
5. People and organizations that consume our API or our MCP server.
6. Sales leads who left their contact details on one of our pages.

Where the data comes from

1. From you, when you fill in a form, post a job, apply, or write to us.
2. From an external sign-in provider (GitHub, LinkedIn or Google), when you register with it.
3. From the CV you upload. We convert it to text and have it parsed by our artificial intelligence provider. From that parse we write your phone number, country, city, your LinkedIn link, your portfolio link and an inferred gender value onto your profile. We keep the record of that parse together with the CV. For CVs processed through our earlier flow, that record also holds the full extracted text, which may include your name, email address, date of birth and home address.
4. From a company, when it imports your CV into Get on Board.
5. From GitHub's public API, when your profile declares a GitHub handle.
6. From data we derive ourselves out of the above, as described below.

For Professional Applicants

In this section, "you" refers to a professional.

1. We ask for personal data such as name, email address, telephone number, and country.
2. In addition, depending on the external service you use to sign up, we automatically obtain certain publicly available information in your profile from that service. This may include your profile picture (avatar) and your LinkedIn or GitHub profile URL.
3. You can register with Get on Board as a professional using external services, such as Google, LinkedIn, and GitHub, and directly using your email address ("magic link"). External service providers do not share their login information with us. We do not receive or store your password on any of these services. To use Get on Board, you must authorize our app to access your service. In general, we ask for as little information as possible and never post content to your accounts. If you revoke access to Get on Board from the service you authorized to sign in, you may lose access to your account.
4. We may require consolidating two or more professional accounts registered under the same email address. In this case, the data of both accounts will be added in a single master account.
5. Get on Board offers tests or questionnaires to give you information about your profile or professional skills. Also, Get on Board recruiters may ask you to take technical knowledge or psychological tests similar to those usually requested in recruitment processes. We store this information and only share it with companies if you opt to make your profile visible to them or directly share your test results. Companies cannot identify you in our database based on this information unless you accept to interact with the company.
6. Optionally, we ask you for information relevant to the companies you are applying to, such as your portfolio or a link to your CV. Although this information is not required to register with Get on Board, some recruiters may require you to include it before submitting your application.
7. When you apply or make your profile visible, you share with us and employers information about your professional profile, work experience, and reasons for applying for a job. Additionally, some applications will require you to answer questions determined by the company, the answers to which we also store.
8. Questions written by the company: organizations can add their own questions to the application form. We only check their length. We keep your answers even if the company later removes the question, we include them in the summaries we generate with artificial intelligence, they can be graded automatically and used as a filter, and they are sent to Lever and Ashby when the company exports the application.
9. You can exchange private messages with a company's team members in a fashion similar to emails. We will store the text of those messages.
10. GitHub information: if your profile declares a GitHub handle — whether you typed it or connected your account — we use our own credentials to fetch your public GitHub profile (login, name, bio, company, location, public email, website, Twitter handle, organizations, public repository statistics and contribution history), store it, have it analyzed by our artificial intelligence provider, and use that analysis as one more search field. We make that request when you set or change the GitHub handle on your profile.

Data we derive that you cannot edit

Out of the information above we generate new data about your profile. This data is not editable by you:

1. A summary of your profile addressed to recruiters.
2. Your years of experience, which are also written onto your profile and can be used as a filter.
3. An inferred seniority level.
4. The technologies and languages you work with.
5. A classification of your profile by job category.
6. Numeric representations (embeddings) of your profile, used for similarity search.
7. The analysis of your public GitHub information.
8. Per-application fit data: residence and salary-range match, industries, certifications, education, scholarships, volunteer work and entrepreneurial experience.
9. A compatibility score per job.
10. An inferred gender value taken from the text of your CV, which we use to produce statistical reports.

Your salary expectation and where it goes

When you state a salary expectation on your profile or in an application, that information:

1. Is shown to the company reviewing your application.
2. Works as a filter and a sort key in that company's applicant list. In the Talent Database it works as a filter over the range you state on your profile — a company can narrow its search by both your minimum and your maximum — without the amounts being displayed there.
3. Is included in the CSV file a company can export with its applicants.
4. Is sent to our artificial intelligence provider inside the instructions with which we compute the compatibility score and the summary of your application. The minimum stated on your profile is also sent for jobs you have not applied to when you use the compatibility gauge.
5. Is sent as a property of your profile to our product analytics provider.
6. Is exported to Lever when the company maps that field in its integration.
7. Is aggregated into salary statistics.

We do not expose your salary expectation through our MCP server.

In the case of organizations and team members

In this section, "you" refers to an authorized user of an organization.

1. We ask you for basic information about your company, such as your name, logo, contact email, website, the country where the offices are located, and descriptive texts about your organization.
2. When you post a job offer, you will make public information about the position you want to hire and your organization, including compensation and salary information.
3. You can exchange private messages with job applicants you post, similar to sending emails. We will store the text of those messages.
4. We will also store company team members' names, company email addresses, sign-in data and records of their activity in the account.
5. Your organization's sales and billing contact details reach the CRM and billing providers listed below.
6. When you make a purchase on Get on Board, you enter your credit card details through our portal. We do not store such data in our services in any way, but we send them to our payment gateway provider in the United States (Stripe). Stripe does not provide us with any card details and only allows us access to the following information: card brand, cardholder name, card expiration date and the last 4 digits of the card number. View Stripe Privacy Policy for details on how Stripe protects your payment information.

Processing we do not carry out

1. We do not process biometric data: our automated analysis works on text only, and profile pictures and videos never reach a model.
2. The country and city on your profile are the ones you declare: we do not infer them from your IP address and we do not overwrite them with it. On the company signup form we do use the IP address to preselect a country, which you can change before submitting.
3. No question written by us asks for disability, health or accessibility data, and we do not derive that data from your CV either. Note that the questions a company adds are written by that company, not by us. We do publish aggregate gender statistics.
4. We do not compute an automated fraud or risk score about people.
5. We do not offer criminal-record or background-check features. The background field on your profile refers to your work history.
6. Public professional profile pages are served with an instruction not to be indexed by search engines.
7. Private messages are never sent to our artificial intelligence provider.

How we protect and use information

In general, we use the information you provide to provide the services we offer, which facilitate selection processes between organizations that publish job offers and people who apply for them.

Security measures

These are the security measures we have adopted:

1. All production traffic travels over HTTPS, with HSTS enabled.
2. CVs and profile files are stored with private access and served only through signed, time-limited links, with file-type and size restrictions.
3. Team members of a company can enable two-factor authentication (TOTP).
4. We apply password rules (length, complexity, expiry and history) and lock the account after repeated failed attempts.
5. We filter salaries, email addresses, passwords, tokens and advertising click identifiers out of application logs and error reports.
6. We rate-limit requests and block malicious traffic.
7. We apply automated abuse checks on sign-in, signup and public forms.
8. We verify the signature of the webhooks we receive.
9. We encrypt at application level the secrets we issue.
10. We review software changes through code review before deploying them, we remove access when a working relationship ends under the least-privilege principle, and we keep credentials outside the source code.

In general

We use the information collected in the following manner:

1. We store information about your user session, such as the number of times you logged in and when your account or company's account was last active on Get on Board.
2. We may average, aggregate, or group usage information or data submitted to Get on Board by organizations and applicants and disclose it for educational, informational, or commercial purposes. We only publish aggregate statistics.
3. We will analyze, group, or process the information to automatically infer which professionals are most compatible with a given job, sort search results according to relevance, suggest relevant jobs to a professional based on the information shared with us, and feed automated recommendation services.
4. We may send you emails to the address you have registered with our services, notifying you of Get on Board account activity, communications, and messaging from other users, or information that is important or requires immediate action.
5. We share your email address only with the providers we use to run the service and with the company whose job you apply to. We never sell it. We also do not send advertising or commercial communications on behalf of third parties. In general, when you share your email address with Get on Board you will only receive communications identified as coming from us.

Automated processing and profiling

Get on Board carries out the following automated processing:

1. Compatibility score: with our artificial intelligence provider we compute a score for each application, out of your profile summary, your seniority, your years of experience, your languages, your reason to apply and your salary expectation. That score is shown to companies with the Superpower add-on and orders their applicant list. It is shown to you as a band with a checklist, when the compatibility gauge is available in your account. The score is also sent to our product analytics provider together with your profile.
2. Automatic move to a shortlist: with that same add-on, applications with a high score can be moved automatically into a shortlist column of the company's board. The rule that produces that move is shown to the company.
3. Semantic search: we convert profiles into numeric representations and retrieve them by similarity.
4. Automated filters: in a company's applicant list with the Superpower add-on: years of experience and AI-derived signals such as university education, bootcamp, scholarships, volunteer work, industries and certifications. In the Talent Database: minimum salary, years of experience, country and English level.
5. Automatically generated notes: we generate notes per application addressed to the company, about fit for the role, areas to probe and a notable fact.
6. Suggested screening questions: we propose screening questions the company can approve; the answers can be graded automatically and used as a filter.
7. Email signals: delivery problems and spam complaints can suspend your notifications.
8. Job recommendations: we select the jobs we suggest to you automatically, from the preferences you state on your profile. The order you see them in does not depend on your profile: jobs the company paid to feature come first, then the most recent ones.

If you are in Chile, you also have the right to ask for an explanation of these decisions, for a person to intervene, to state your point of view and to have the decision reviewed. We set that out under Users in Chile.

In the case of professional applicants

In this section, "you" refers to a professional.

1. When you apply for a job, we share the information you submit in your application with the job's organization. This information includes contact details, job preferences, professional profile data, and fields filled in the application form, including company-specific questions. As context, please note that whenever you apply for a job outside Get on Board, you also share your personal information with the company.
2. By applying to a job, you acknowledge that once the application has been submitted, the organization may use the information you have shared with it outside of the Get on Board services and for its own purposes. Companies can also access some personal and contact information, such as your name, your LinkedIn or GitHub profile, and other data, once you have applied to them or they have spent a credit to unlock your profile. Companies may only use your contact information strictly in connection with recruitment or hiring processes. Using this information for commercial or promotional purposes violates our Terms of Service and will result in the company's account termination.
3. The companies you apply to may contact you using Get on Board services or other means, depending on the contact information you shared with them. We will store the messages exchanged between you and the company inside Get on Board.
4. Companies may request additional information from you using the Get on Board communication services (e.g., additional contact information). If you provide such information through Get on Board, we will also store such information as part of the message text.
5. A company can use an automated service that will send to your email information about a job it has posted that matches your preferences. This service is provided automatically and the posting company does not have direct access to your contact details or know whether or not you have read the email.
6. A company can send you invitations to participate in one of its selection processes. Making your profile visible to employers is what lets a company find you and invite you; it does not hand the company your contact details. Those stay hidden until you apply, or until the company spends a credit to unlock your profile. If you keep the setting deactivated, the invitations you receive will have been sent anonymously.
7. Applicants may include companies on an exclusion list that prevents those companies from sending them jobs using the service described above. Publishing organizations do not have access to such a list and cannot know who or how many professionals have included them.
8. For all purposes, we treat application information as confidential and we do not disclose or communicate it in any way that could lead to the public identification of the applicant, unless the applicant has expressly authorized us to do so (for example, by checking the "Visible for companies" box). We do not give any third parties any way of knowing whether you have a professional account with Get on Board, unless we are required to do so by law or by a competent authority. We never grant bulk access to our applicant database.
9. We do not provide companies with access to the contact info of professionals unless you have applied to one of their jobs or the company has spent a credit to unlock your profile. Making your profile visible to companies is not enough on its own.
10. Please note that an organization's name may change or that it has the right to grant access to or transfer ownership of its account to third parties on its own initiative and without our prior knowledge or consent.
11. Similarly, a company may grant specific Get on Board members access to their account information to enable them to act as recruiters. In that case, for all legal purposes, Get on Board members are considered part of the company's recruiting team and are governed by the confidentiality clauses established by the company.
12. If a company imported your CV and you never registered with us, you do not have a Get on Board account. In that case we hold your CV, the text extracted from it and any application the company created on your behalf; we send that text to our artificial intelligence provider; and we may write to you by email on the company's behalf.

In the case of publishing organizations ("companies")

In this section, "you" refers to the authorized user of an organization.

1. All information requested in the job posting form is public knowledge, including job title, requirements, and public information about the company. This public information may appear on affiliated third-party sites, which are required to disclose Get on Board as the source of information.
2. We do not disclose or share the company's email address or direct contact details with other users or with the public.
3. By creating a company account or posting a job on Get on Board with your company trademark and logo, you publicly disclose your business relationship with us. We may mention you as a customer publicly for promotional or business purposes.
4. We may change without prior notice company logos or information that we believe most accurately identifies your organization. We also reserve the right to edit the public information in a job post to improve its readability.
5. When opening a selection process, you will be able to make use of our tools and services in ways that could reflect confidential information about your organization or business strategy, such as phases of a selection process, evaluation or selection tools, private information about projects and people within your organization, etc. For all purposes, we consider this information to be confidential and strictly reserved, and we take the necessary security measures to protect it and restrict access to it. No one outside your account's authorized members can access this information.
6. Applicants to a job posted by your company can only access the information you explicitly share with them through messages. Applicants can never access the stages of your recruitment process, any private qualifications you or members have left on the application or internal team notes.
7. Applicants cannot identify whether or not they have been excluded from a process or whether the process is open or closed, unless you explicitly inform them. They cannot know the identity of other applicants. However, certain information regarding an application (for example, whether it has been discarded or not, the reason for discarding, the stage of the selection process when an application has been completed and the number of messages exchanged between company users and the applicant) is aggregated with the same information from other jobs to which the professional has applied, to advise the applicant on possible improvements to their profile.
8. Applicants can find out whether or not the company has read their application.
9. Logged-in applicants may be able to infer the salary offered by a job, even if you have marked that salary as "publicly hidden".
10. As stated above, we do not store or record payment or credit card information with Get on Board. The data is received and protected directly by Stripe. Through Stripe, we may use the stored payment information to make new charges, upon authorization by the customer, as well as previous purchase and billing history.
11. Integration with Slack: Companies can integrate their Slack account and receive notifications about activity in their Get on Board account. This integration is entirely optional and can be revoked at any time. The responsibility for Get on Board information shared in Slack rests with Slack and the individual company.
12. Integration with external ATS software: Companies can integrate their ATS software to export information about the process and the candidates. The export is one-way: we send the information to the external system and do not retrieve it or sync it back. Once exported to an external system, the information ceases to be under Get on Board's control and the present Policy no longer applies.

How We Use Cookies and Third Party Services

Like the vast majority of Web sites and services you use every day, we use cookies (small data files stored on your computer). Some cookies are deleted if you close your browser, others persist until you manually delete them or they expire automatically after a while.

1. Essential Cookies: We use site cookies necessary to keep your user session active and to remember certain preferences for use of our services. This allows us, for example, to avoid sending you duplicate communications and messages. It also means we do not need to ask you to log in each time you close your browser or connect to a new network.
2. Analytical and Performance Services: We collect certain information in connection with your use of the services. This information includes actions you take on our services (pages visited, applications submitted, etc.) and certain information about your device, such as your IP address, operating system, browser type, and others.
3. The above information is stored in our own and third party cookies. Those third party cookies correspond to industry-recognized analytics and advertising measurement services, such as Google Analytics, Google Tag Manager, Google Ads and Mixpanel.
4. We may combine the information provided by analytical and performance services with the information you provide to us in your use of the platform, in order to understand how our services are used, to resolve problems or errors and to deliver help more quickly.
5. To obtain a record of errors and bugs in our software we use Bugsnag, which includes information about the device where an error occurs, such as IP address, operating system and browser type, as well as the account id and name of a signed-in user.
6. Advertising conversion measurement: when you reach Get on Board from an ad, we store the click identifier Google adds to the address. If a purchase or a signup follows, we send Google Ads from our servers the conversion event and its value, identified by that click identifier or, where there is none, by the account's email address transformed through a hash function.

Cookies we use

You can block the use of cookies at Get on Board and you can delete the cookies that Get on Board stores at any time. However, please note that if you block the use of cookies in Get on Board, several aspects of the Services (such as signing in) will no longer work properly.

Please note that some analytics and performance services will still record and store certain information, even if you block all cookies and JavaScript, because some information collected is directly dependent on your interaction with our servers.

Where we store your information and who we share it with

Services are provided in the United States of America. The data (personal or otherwise) that you provide to us may be stored, processed and accessed by us, our team, and sub-contracted third parties in the United States of America or in other countries, both within and outside the European Union, for the purposes described in this policy. In addition, we may store your information in locations that are outside the direct control of Get on Board (for example, on servers or databases provided by hosting service providers). Please note that the United States laws may treat information and privacy differently from the laws of your country of residence.

Our databases and servers are hosted with our hosting providers, and some static files such as CVs or profile images (avatars) are stored at Amazon Web Services (S3). Profile images provided by Google, GitHub or LinkedIn stay hosted on those platforms and we access them through the URL address they provide; if you have no image of your own, we may copy that image into our own storage.

Separate websites by country, as well as the domain names belonging to each country, work only as a way to facilitate the access to the job offers.

Who we share information with

These are the categories of recipients we share data with in order to run the service, and what they receive:

1. Infrastructure: Amazon S3 (files), Amazon CloudFront (delivery of compiled assets: IP address and browser), Amazon SES and SNS (inbound mail and delivery events), Bonsai/Elasticsearch (search index), MemCachier (cache), Stackhero (session store, job queues and traffic control), Cloudflare (edge proxy over all traffic), New Relic (request traces) and Bugsnag (error reports, which include the id, name and email address of the signed-in account).
2. Artificial intelligence: our artificial intelligence provider receives the full text of your CV, your profile, your application answers, your salary expectation and your public GitHub data, in batches identified by your internal id.
3. Analytics and advertising: Google Tag Manager, Google Ads (tag and conversions sent from our servers, with the email address in hashed form), Google Analytics, Mixpanel, Google Fonts, Google reCAPTCHA (which receives your IP address) and embedded YouTube videos.
4. Language detection: DetectLanguage.com and Google Cloud Translation receive the text of an application's background fields.
5. Payments: Stripe.
6. Company integrations: Lever, Greenhouse and Ashby receive your name, email, phone number and your CV or a link to it; Lever also receives your profile links and the application share link, and Ashby receives the CV file itself. Webhooks the company registers receive the application data, including salary expectation, answers, messages and the company's notes once unlocked. Slack receives notifications in the channel the company chooses.
7. Sales and billing: Pipedrive, Apollo.io, Airtable and Zapier into Google Sheets receive organizations' contact details. Brave Search receives company domains only.
8. Others: GitHub's API; your browser's push notification services; the artificial intelligence clients that connect to our MCP server, which receive search results and profiles, including the recruiter summary, years of experience and test traits, without the salary expectation; and search engines, which receive only the public addresses of job posts.

Your rights as a user

For all legal purposes, your information and personal data are stored and submitted to the jurisdiction of the State of Delaware, United States of America.

Nothing in this policy limits or implies a waiver of the rights that the data protection legislation of your country of residence grants you and that cannot be waived by agreement.

1. You have the right to view and modify your personal data.
2. You can revoke Get on Board's access to your external service accounts (Google, LinkedIn, GitHub or Slack) from the settings of each of those services. Within Get on Board you can remove a GitHub handle you typed from your profile, unless GitHub is the method you sign in with. If you revoke access to the service you sign in with, you can still get in with a magic link sent to your email address.
3. You have the right to request the deletion of your personal data at any time, unless we are required by law or by a competent authority to retain it.

Correcting your data

Corrections you make on your profile take effect in our database at once, and in the search index shortly after. An application you already sent keeps the text you submitted at the time — your salary expectation, your reason to apply, your background fields and your answers are recorded as they were — but points at your current CV file. Some company views show your current profile values.

Your controls

1. The "Notify me of new jobs" option is a single switch that stops job and blog emails and, at the same time, removes you from Talent Database searches and from invitation suggestions. The unsubscribe link in those emails — including the one-click unsubscribe some mail programs offer — flips that same switch.
2. The "Visible for companies" option controls whether you appear in Talent Database searches, and how much of your profile a company sees there. It does not disclose your contact details: those stay hidden until you apply to the company, or until the company spends a credit to unlock your profile.
3. Once you apply to a job, the company that posted it finds you in its own applicant search, regardless of those two switches.
4. Message reaction notifications can be muted separately.
5. Your choice in the cookie notice is stored in a cookie.

Deleting your data

1. If you are a professional, you can delete your account yourself from the link at the bottom of your profile edit page. Deletion starts immediately, with no waiting period and no way to undo it, and removes your profile, your applications, your messages, your CVs, your test results, the automated analysis records, the experiment records and your entry in the search index.
2. If you represent a company, you can request the deletion of the account and we carry it out 30 days later. Jobs that received applications are kept without the company's identity, together with their applications, background fields, reasons to apply, CVs, answers and message threads. Internal notes and team evaluations are destroyed.
3. In either case, you can also write to us at compliance@getonbrd.com. Deletion of that data results in the termination of your access to the Get on Board Services.

Users in Chile

From the date Chile's Law 21.719, which amends Law 19.628 on the protection of private life, enters into force — currently 1 December 2026 — the rights described below are the ones that legislation grants you as the data subject.

1. You have the rights of access, rectification, deletion, objection and portability over your personal data. You can exercise them by writing to us at compliance@getonbrd.com.
2. For decisions we take by automated means that significantly affect you, you can ask us for an explanation of the decision, for a person on our team to intervene, to state your point of view, and to have the decision reviewed. We describe those decisions under Automated processing and profiling and you can exercise these rights by writing to us at compliance@getonbrd.com.
3. These rights are personal, non-transferable and cannot be waived, and they cannot be limited or restricted by any act or agreement. Your heirs may exercise them, unless you have expressly forbidden it or the law provides otherwise.
4. Exercising rectification, deletion and objection is always free of charge. Access is free at least once per quarter. We may charge direct costs only where you exercise access and portability more than once within the same quarter, and never in the cases of the fourth paragraph of article 28 of that law.
5. Where processing is based on your consent, you can withdraw it at any time, without stating a reason and without affecting the lawfulness of the processing carried out beforehand.
6. From that same date, if we refuse your request or do not answer within the deadline, you can complain to the Agencia de Protección de Datos Personales within the following 30 business days.