Last updated: 8 September 2026
Shortlisted is a trading name of SHORTLISTED TODAY (PTY) LTD, registration number 2026/368921/07, registered in South Africa. We are the controller of the personal information described here. Contact us at simon@shortlisted.today.
Three kinds. What you give us: your name, email address, phone number, your CV, and whatever you tell us during onboarding or in follow-up answers, which can include salary expectations, work preferences and a list of employers you want excluded. If you sign in with Google, that means your name, email address and profile picture from your Google account. What we generate: the profile we build from your materials, the roles we assess for you, their scores, and your status on each. How you use the site: pages visited, browser and device information, collected through Google Analytics only where you have accepted analytics cookies.
We use your information to deliver the service you asked for: finding and assessing roles, writing tailored application materials, and communicating with you about them. Where the GDPR applies, our lawful basis for this is performance of our contract with you. For website analytics, our basis is your consent, which you can withdraw at any time.
We do not sell your personal information and we do not share it with advertisers. We rely on these providers: Supabase for database hosting; Anthropic and Google as large language model providers, because assessing roles and drafting your materials means sending relevant parts of your profile to them, under commercial terms where your data is not used to train their models; Zoho for email; Cloudflare for website hosting and delivery; Paystack for card payments where you pay by card, which means we never see or store your full card details; Google for sign-in and for the calendar we book intake calls on (section 5), and Google Analytics for website statistics, only where you consent. We pass information to a prospective employer only when you tell us to.
If you choose Continue with Google to sign in, Google sends us your name, email address and profile picture, and nothing else. We use them to create and sign you into your account and to address you by name. We do not use them for anything else, we do not share them with anyone, and you can use email and password instead at any time.
When you book an intake call on our site, we create the meeting on Shortlisted's own Google Calendar, which is why our app holds permission to create and delete events on that calendar. That permission is granted by Shortlisted for Shortlisted's calendar only: we never ask for, read, or write to your Google Calendar.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. In particular, we never send Google user data to any artificial-intelligence or machine-learning service, ours or anyone else's. We do not sell Google user data, do not use it for advertising, and do not let humans read it except with your consent, for security, or where the law requires.
Everything you send us and everything we store travels over encrypted connections, and it is stored with providers that encrypt it at rest: our database with Supabase and your documents on Google Drive. Only the people working on your search can open your files, and each of them signs in with their own account. We keep the keys to those systems off the website and off any third-party service. Nothing about you is sent to advertisers, and the website statistics we collect are consent-based and cannot identify you.
When we use AI models to assess roles and draft your application materials, we send them the material you gave us for that purpose — your CV, your answers and the job posting — and nothing from your Google account: not your name or email address as Google supplied them, and never anything from any calendar. The providers we use, Anthropic, OpenAI and Google, are used under their paid API terms, which do not allow them to train their models on what we send. If we ever changed that, we would tell you first.
If we ever had a security breach that affected your information, we would tell you without undue delay and tell the regulator where the law requires it.
Our database is hosted in the European Union, in Frankfurt. Some of the providers above process data in other countries, including the United States. Where personal data is transferred internationally, we rely on those providers' standard contractual clauses.
We keep your information while you are an active client and for a reasonable period afterwards, unless you ask us to delete it sooner. On request we delete your files and your database records. One limitation we would rather state plainly than gloss over: some of our working files are version-controlled, so historical snapshots can persist in that history, and clearing those is a deliberate operation rather than a single switch. If you want full erasure, tell us, and we will carry it out and confirm to you when it is done.
We use a small number of strictly necessary cookies to keep you signed in and remember your preferences, and these do not require your consent. We also use Google Analytics to understand how the site is used. Analytics cookies are set only if you accept them in the banner shown on your first visit; until you do, analytics storage stays switched off. IP addresses are anonymised, we use no advertising cookies, and our own admin pages are excluded from analytics entirely. You can change your choice at any time using the cookie preferences link at the foot of this page.
You can ask us to give you a copy of your personal information, correct it, delete it, export it, or object to how we use it. Where the GDPR applies you may also complain to your local supervisory authority; where POPIA applies, to the South African Information Regulator. Email simon@shortlisted.today and we will respond within 30 days.
We may update this policy from time to time. Where a change materially affects you, we will tell you by email.
Email us at simon@shortlisted.today.