Privacy policy

Thorio operates the job board at thorio.co. For any privacy question, including access, correction and deletion requests, write to privacy@thorio.co.

• Account email address. Collected when you create an account with an email and password, or when you sign in with Google. We need it to identify your account, confirm your address and contact you about the service.
• Google profile basics. If you choose Google sign-in, Google returns your email address, name and profile image URL, which are stored with your account record.
• Sign-in activity. Our backend platform records authentication events, including timestamps and the IP address the request came from, as a security measure.
• Job alert email address. If you subscribe to job alerts, we store your email address, your chosen frequency (daily or weekly), the time the last digest was sent, and the time you unsubscribed, if you have.
• Employer submission details. If you post a job, we store the contact email address you provide along with the listing content you submit, such as company name, job title, location and application URL.
• Billing records. For paid products we store your email address, your Stripe customer and subscription identifiers, your plan status, the plan period end, posting credit balances and the Stripe checkout session identifier for each purchase.
• Administrator role. For staff accounts we store a user identifier and a role label, nothing more.

We never see or store card details. Card numbers are entered on Stripe's own checkout pages and never reach Thorio.

No analytics or advertising trackers are installed on this site. There is no Google Analytics, no advertising pixel, and no cross-site behavioural profiling. We do not build interest profiles, and we do not sell or rent personal data to anyone.

Account records, job alert subscriptions, employer submissions and billing status are held in our managed cloud database and authentication service, which is operated for us by Lovable Cloud. Access is restricted by row-level security rules, so one account cannot read another account's records, and administrative access is limited to staff accounts holding an explicit administrator role.

• Stripe. Payments and subscriptions. Receives your email address and the card details you enter directly on its checkout pages, and returns customer and subscription identifiers to us.
• Google. Optional Google sign-in. If you use it, Google processes the sign-in request and returns your email address, name and avatar URL.
• Google Fonts. The typefaces used on this site are served by Google Fonts. Because your browser requests those font files directly from Google's servers, Google receives your IP address and standard request headers on page load, on every page, whether or not you have an account. If you prefer to avoid this, a browser extension or setting that blocks third-party font requests will stop it, and the site remains fully usable with fallback system fonts.
• Lovable Cloud. Hosting, database and authentication for the whole site.
• Our managed email service. Sends account confirmation, employer status and job alert emails from notify.thorio.co, and therefore processes the recipient email address and message content.

Account and billing records are kept while your account exists, and billing records are kept afterwards for as long as tax and accounting rules require. Job alert subscriptions are kept until you unsubscribe, after which the record is retained only long enough to make sure we stop emailing you. Employer submission details are kept with the listing.

You can ask us to show you the personal data we hold about you, correct it, export it, or delete it, and you can object to a particular use of it. Every job alert email carries a one-click unsubscribe link. To exercise any other right, email privacy@thorio.co and we will respond within 30 days. If you are in the UK, the EU or the EEA, you also have the right to complain to your local data protection authority.

Thorio is intended for people of working age. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will remove it.

If we change how we handle personal data, we will update this page and the date at the top. Material changes affecting account holders will also be sent by email.