Privacy policy
Who we are
Sirin OÜ, registry code 16315993, Nõmmiku/1, Kibuna küla, Saue vald, 76313 Harju maakond, Estonia,
Estonia. Contact: privacy@sirin.ee.
Who this covers
- Visitors to sirin.ee, fit.sirin.ee and rolefit.eu
- People who open or use an account — owners, admins, recruiters, hiring
managers, viewers
- People who contact us
What we collect
| What | Why | Basis |
|---|---|---|
| Work email address, password (hashed) | To give you an account | Contract |
| Company name, web address, strapline | To run your workspace and careers page | Contract |
| Billing contact, company details, VAT number | To invoice you | Contract, legal obligation |
| Usage — applications processed, roles open, when you signed in | To enforce plan limits and bill correctly | Contract, legitimate interest |
| Support correspondence | To answer you | Legitimate interest |
| Server logs, including IP address | Security and abuse prevention | Legitimate interest |
We do not run advertising trackers or analytics that profile you. See
cookie-policy.md.
What we never do
We do not sell your data. We do not share it with advertisers. **We do not use
your data, or any candidate's, to train AI models.**
Payment
Payments are handled by Stripe. Card details go to Stripe directly and never
reach us. We hold what Stripe tells us: your customer id, subscription status,
plan, and the billing details you gave.
How long we keep it
| What | Kept for |
|---|---|
| Account, while it is open | Until you close it |
| Account, after closure | 90 days, then deleted |
| Invoices and accounting records | 7 years — Estonian Accounting Act |
| Server logs | 30 days |
| Support correspondence | 2 years |
Candidate data in your workspace follows retention-schedule.md, not this
table.
Who else sees it
Supabase (accounts and database, EU), Cloudflare (serving the site), Resend
(email we send you), Stripe (payments, Ireland). Full details in
sub-processors.md.
Some are US companies. Transfers rely on the EU Standard Contractual Clauses
and, where applicable, the EU–US Data Privacy Framework.
Your rights
Access, correction, erasure, restriction, portability, and objection to
processing based on legitimate interest. Write to privacy@sirin.ee and we
will answer within 30 days.
You can complain to the Estonian Data Protection Inspectorate
(aki.ee) or the authority where you live.
Changes
We will tell account owners by email before a material change takes effect.
Last updated: 13 September 2026