Privacy policy
Last updated 9 October 2026.
The short version. You can browse Polyfetch without giving us anything. If you create an account or join our email list, we keep only what's needed to run those features. We don't sell your data, we don't run ads, and you can delete your account yourself at any time.
1. Who we are
Polyfetch is run by Solura AI Ltd, registered in England and Wales, company number 15784552, registered office 5th Floor, 167-169 Great Portland Street, London W1W 5PF, United Kingdom. We are the “controller” of the personal data described here. Contact us about privacy at jon@solura.ai.
2. What we collect and why
| What | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Your email address when you sign in, plus your name and profile picture if you sign in with Google | To create and identify your account, and to email you a sign-in link when you ask for one | Contract: providing the account you asked for | Until you delete your account |
| When you ask for a sign-in link or join the weekly email: your IP address (and, for sign-in links, your email address), kept in short-lived counters | To stop people flooding an inbox or abusing the forms | Legitimate interests: keeping the site and other people's inboxes safe | 2 days |
| Your saved jobs (shortlist) | To show your shortlist | Contract | Until you remove them or delete your account |
| Your email address and the fields you picked, if you join the weekly email, and a record of which weekly emails we sent you | To send the weekly email | Consent, which you can withdraw at any time | Until you delete it (from the “Change topics” link in any of our emails) or ask us to. Signups never confirmed are deleted after 30 days. After you unsubscribe we keep only your address, marked unsubscribed, so we never email it by mistake |
| Apply clicks: which job, when, the website you came from (domain only) and your browser type. No IP address, and not linked to your account. | To see which listings are useful, check referral fees are reported correctly, and filter out bots | Legitimate interests: running and funding the site | 24 months, after which we keep only the total click count per job |
| Visit statistics: pages viewed, searches and filters used on the jobs page, which job listings you click (and where they were in the list), Apply buttons and links to other websites you click (the website's domain only), whether you scroll to the end of a job description, opening the email signup form, the website you came from (domain only), campaign tags in the link, and device type (phone, tablet or computer). Each visit gets an anonymous code made from your IP address and browser that changes every day, so we can count visitors without cookies and can't follow you from one day to the next. We don't store your IP address, and this isn't linked to your account. | To see which pages and listings are useful, what people search for and can't find, and to improve the site | Legitimate interests: running and improving the site | 13 months |
Only if you accept analytics cookies: a random code kept in a cookie (pf_vid), added in coded form to the visit statistics above, so we can see when the same browser comes back on another day (for example, someone who reads a job on Monday and applies on Thursday). It isn't linked to your account or email, and we don't share it. | To understand how people find and come back to roles, and which links bring visitors who apply | Consent, which you can withdraw at any time from “Cookie settings” in the footer | The cookie lasts 13 months from your first visit and isn't renewed. Statistics: 13 months |
| Reports that a role has closed: which role, your note if you add one, and a coded version of your account email (or of your IP address and browser) so one person's report counts once. We don't store the email or IP address itself. | To check the role and take it down if it has closed | Legitimate interests: keeping listings accurate | Until we've checked the role, then 90 days |
| If we contact you about a role ourselves (by email or on LinkedIn): your name, public profile link, email address if we have it, the professional details on your public profile (such as your title, location, languages and background), our notes on which roles might suit you, and the messages we exchange with you | To tell you about paid roles that match your expertise, and to keep track of our conversation | Legitimate interests: matching people with suitable work. You can ask us to stop at any time | Until you ask us to delete it. If you ask us to stop contacting you, we keep only what we need to make sure we don't contact you again |
| Messages you send us, for example to report a listing | To reply and investigate | Legitimate interests | Up to 24 months after the conversation ends |
| Technical logs kept by our hosting provider, which may include your IP address | Security and fixing faults | Legitimate interests | A short period set by the provider |
We don't ask for your CV, ID or application details. You apply on the company's own site, and whatever you give them is covered by their privacy policy, not ours.
3. Google account data
Signing in with Google gives us only your email address, name and profile picture (the “openid”, “email” and “profile” permissions). We don't ask for access to your Gmail, Drive, contacts or anything else. We use this data only to identify your account and, if you turn it on, send you the weekly email. We don't sell it, share it, use it for advertising or use it to train AI models.
4. Emails we send
- Sign-in links, only when you ask for one. Each link works for 15 minutes.
- The weekly email, only if you signed up and clicked the link in our confirmation email (or turned it on while signed in): the top new and best-paid roles in the fields you picked. Every one has links to change your fields or unsubscribe. If an email to you bounces or is reported as spam, we stop sending to that address.
We don't put advertising in our emails.
5. Cookies
We use the cookies needed to keep you signed in and to protect sign-in from forgery. They're set when you sign in, and because they're strictly necessary the law doesn't require us to ask for consent. We don't use advertising cookies or tracking that follows you across sites. Our visit statistics (section 2) work without cookies and use no third-party analytics service.
We'd also like to use these optional cookies, but only if you say yes:
- Analytics: Remembers this browser for up to 13 months so our own visit statistics can tell a returning visitor from a new one, e.g. whether people come back before applying. It's never shared with anyone or linked to your account. Without it we still count visits, but only day by day.
We ask the first time you visit and remember your answer for six months in a cookie called pf_consent. You can change or withdraw your choice at any time from “Cookie settings” in the footer.
6. Who we share data with
We use a few service providers who handle data only on our instructions:
- Railway: hosting and database (United States)
- Google: sign-in, and our own email accounts, which we use to write to people we contact about roles (United States). Google also has its own relationship with you under its own privacy policy.
- Resend: sending sign-in links, alerts and the weekly email (United States)
- OpenAI and Anthropic: AI drafting (United States). See below.
We use OpenAI (and sometimes Anthropic) to help draft job listings from companies' public job postings. We also use them to help draft messages to people we contact about roles. For that we send them the person's name, the professional details in section 2, our notes and earlier messages with them. We read every message before it's sent. When they reply, OpenAI reads the reply (and our message before it) so we notice quickly if they've asked us to stop contacting them or need an answer. We don't send them anything about site visitors, account holders or weekly-email subscribers.
When you click Apply, you go to the company's own site. If it's a referral link, the company can see that you arrived from Polyfetch. We don't send them your name, email or anything else about you. If you're hired, the company may tell us so it can pay a referral fee, and we use that only to reconcile the fee.
We may also disclose data if the law requires it, to protect people from fraud or harm, or to a buyer if the business is sold (who would have to respect this policy). We don't sell your personal data, and we don't share it for advertising.
7. International transfers
Our providers store data in the United States. When personal data leaves the UK or European Economic Area, we rely on the safeguards in our providers' data processing terms, such as the UK-US data bridge, the EU-US Data Privacy Framework or standard contractual clauses. Contact us for details.
8. Your rights
You can ask us to:
- give you a copy of your data
- correct it
- delete it
- restrict or object to how we use it
- send it to you in a portable format
You can withdraw your consent at any time, for example by unsubscribing. You can do much of this yourself: delete your account or stop the weekly email from your account page, or unsubscribe from any email or delete your address from the page its “Change topics” link opens. For anything else, email jon@solura.ai. We'll reply within one month, free of charge, and may need to confirm it's you.
These rights apply to everyone, wherever you live, including residents of California and other US states. We don't sell or “share” personal data as California law defines it, we don't use it for targeted advertising, and we won't treat you differently for using your rights.
If you're unhappy, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live.
9. Deleting your account
When you delete your account, we delete your profile, your shortlist and any weekly-email signup straight away. Copies in our database backups are overwritten within 30 days.
10. Security
We use encrypted connections, restricted access and reputable providers. No system is perfectly secure; if a breach affects you, we'll tell you when the law requires it.
11. Children
Polyfetch is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.
12. Changes
When this policy changes we'll update the date at the top. If a change is significant, we'll email account holders before it takes effect.
13. Contact
Solura AI Ltd, registered in England and Wales, company number 15784552, registered office 5th Floor, 167-169 Great Portland Street, London W1W 5PF, United Kingdom. Email jon@solura.ai.