Privacy

The data controller is the company listed in the legal notice. You can contact us about your data at support@sharshor.com or from the Support page.

This summary lists each type of data, what it is used for and whether it is linked to you. Sharshor does not use any data to track you across other companies' apps or websites, and does not sell it.

Not collected: precise location, contacts, browsing history, advertising identifiers or health data. The website uses no analytics or advertising cookies (see Cookies).

Sign-in data provided by Google or Apple (name and email), the profile data you enter and the activity the product needs: Likes, Matches and messages. We only ask for what each feature needs, and optional features (Radar, verification, location, notifications) only collect data if you turn them on.

To show your profile to other professionals, apply the category, skill and country filters, create Matches, enable chat and moderate the Global Chat.

Your photo, name, age, profession, skills, description and Portfolio. Your email address is never shown in the app.

To turn on Radar we need your CV. You can upload a photo or a PDF (up to 5 MB), or write it yourself. If you upload a file, we send it to a third-party artificial intelligence service (currently OpenAI) only to read it and suggest the data to you; you then review and confirm everything before it is saved. The file is not stored in Sharshor: we only store the data you confirm (headline, summary, skills, experience, education, languages and certifications), without email, phone number, address or links.

While Radar is on, that data can be seen by the Sharshor admin team and by recruiters. If you turn off Radar, it is no longer visible. You can delete your CV at any time from the app, and it is also deleted when you delete your account. The AI provider may keep the file temporarily under its own terms. We limit you to 5 AI reads every 24 hours.

A recruiter with an active subscription can send your name and profession to their organisation's applicant tracking system (ATS) through an integration provider (Apideck). We do not send your email or phone number. This only happens while Radar is on, and from that moment the organisation processes that data under its own terms; to exercise your rights over it you must contact the organisation.

Recruiters can add you to their organisation's hiring pipeline (stages such as contacted, interview, offer or hired) and write internal notes about you. Only that organisation can see its pipeline and notes, and you stop appearing in it if you turn off Radar. Pipeline data is deleted when you delete your account.

From the interview stage, a recruiter can invite you to a video call. Calls run on Daily (Daily.co), a third-party video provider acting as our processor: it handles your audio, video, the first name we show in the call and technical data such as your IP address while the call lasts, and its servers may be outside your country. Neither side sees the other's email: each person joins with a private link in their own name. The room is limited to two people and expires 3 hours after it is created. Sharshor does not record calls or keep their content; joining is always your choice.

From the offer stage, a recruiter can send you a contract (a PDF) to sign. Signing runs on SignWell, a third-party electronic signature provider acting as our processor: to record the signature it processes the document, your name, your email address, your signature, your IP address and the dates, and its servers may be outside your country. You sign inside Sharshor and SignWell does not email you. The organisation receives the signed PDF without the audit page, so it does not see your email address. You can download your copy with the audit page from the conversation. Sharshor keeps a record of each contract (title, status and dates) and deletes it when you delete your account; the organisation keeps its copy of the signed contract under its own terms, and SignWell keeps the document under its terms for as long as our account with it requires.

If you promote products as a creator, your presentations (photos or videos) are shown on your profile. For videos we also save a still image taken from the video itself to use as its cover. Your Instagram and YouTube handles and follower counts are only shown to other users and advertisers once the Sharshor team has validated them.

If you turn them on, we store your device identifier to send them to you. Message pushes do not include the text of the message. The sending history is kept for 30 days and does not store the content of automatic pushes.

If we suspend an account for breaking the rules, we keep its email address to prevent it from signing up again with it, along with the related reports, even if the account is deleted later.

To prevent abuse, when any account is deleted we keep for 12 months an encrypted, irreversible fingerprint of its email address and of the Google or Apple account it signed up with (not the email itself). If a new account is created with the same data within that period, we flag it for review and, if it happens more than once, we block it automatically. You can ask for that block to be reviewed from the Support page.

Location: only if you tap “Use my location” when editing your profile does the app ask for permission to use your location at that moment, and it turns it into country, region, province and city (on mobile the operating system does this; on the web, the OpenStreetMap Nominatim service). We only store those names, which you can change whenever you want; never your coordinates, and we do not track your location in the background.

It is voluntary and is only done with your explicit consent. Through the provider Didit we process the image of your official document and your face (selfie and liveness check) to confirm that you are the person on the document. This biometric data is special category data (Art. 9 GDPR). We do not send your profile photo to Didit. Sharshor only stores the result (status, match score and dates): it does not store images or face templates. Didit keeps the sessions for 1 month and then deletes them, and processes the data as our processor. It also uses the face to prevent the same person from verifying two accounts. You can withdraw your consent at any time.

If you are verified, you can ask for a Top profile review. A member of the Sharshor team looks at your profile (photo, description, skills, languages, portfolio and whether you have a CV) to decide whether to give you the Top diamond; no automated decision is made. We keep each request with its date, the result and, if it is not approved, the reason we gave you, until you delete your account (legal basis: your request).

Payments are processed by the App Store or Google Play; Sharshor does not receive or store your card details, only the status of your subscription and, if you use one, the promotional code redeemed.

Organisations that subscribe to the recruiter panel pay through Stripe, which processes the payment details and the billing email as our processor. Sharshor does not receive or store card details: we only keep the Stripe customer and subscription identifiers, the subscription status and the end date of the period paid.

Each organisation manages the emails of its recruiters from its panel, with up to 5 active at a time. When an organisation removes a recruiter, that email can no longer sign in, but we keep its email, the name given, who added and removed it and the dates, so we can handle any report about the organisation's conversations and know who took part (legal basis: our legitimate interest in keeping the service safe). Messages sent by a recruiter record which email sent them. An organisation with reports cannot be deleted, so that the reports and their conversations are kept.

Communities are open spaces that any user can find and join. Messages you write in a community are stored on our servers (Supabase) for as long as the community exists, and every member can read them, including people who join later, together with your name, your photo and your role in the community. They are not stored on your device. The list of members, with their name, photo, profession and role, is visible to the other members.

Owners, admins and moderators of each community can remove messages and remove or ban members; a ban records who applied it and the reason. Messages and names go through our filter of offensive words. If you report a message, we keep a copy of its text, its author and your report so the Sharshor team can review it, even if the message or the community is deleted later (legal basis: our legitimate interest in keeping the service safe). Messages are deleted when you delete them, when the community is deleted or when you delete your account.

You can also send photos and GIFs, reply to messages, react with emoji and edit your own messages (an "edited" label is shown). Photos are stored privately on our servers (Supabase) and only members of that community can open them; before a photo is uploaded it goes through the same automatic image check as in chats and groups. GIFs come from KLIPY: your device loads them directly from KLIPY. Other members see how many people reacted with each emoji, not who. If someone mentions you or replies to you, we send you a push notification with their name and the channel, without the text of the message; you can mute a community to stop them. To show unread counts we store, for each channel, when you last read it, and whether you muted the community; both are deleted with the community or with your account.

When you tap the button to claim a perk on the Coworkings page, we open WhatsApp or your email app with a message already written for you, addressed to that coworking. The message includes your name and a link to your public Sharshor profile so the coworking can check that you are a member. You decide whether to send it, and you send it yourself from your own WhatsApp or email account: Sharshor does not send it, does not see it and does not keep a record of it. From then on the coworking processes your details under its own privacy policy. We only show the coworking's WhatsApp number and email to members who are signed in with a complete profile.

We store your messages in one-to-one chats, groups and the Global Chat, and the files you send (photos or videos) in Cloudflare and Supabase storage services. Part of the history is also stored on your device. In teams in dynamic mode we also store the date of your last message and, if you are given it, the date your immunity ends, so we can apply the inactivity rule. Your Likes and Dislikes are only seen by the person who gives them.

In one-to-one chats and groups you can send GIFs from the KLIPY service. To search for them, the text you type in the GIF search goes through our servers and is sent to KLIPY together with an anonymous identifier (a code derived from your account, not your identity). When you send a GIF, the message only stores its web address; your device and the recipient's device download the GIF directly from KLIPY's servers, which can therefore see that device's IP address. We do not send KLIPY your name, your email or the content of your conversations.

Before saving an image (sent in a chat or group, profile photo, group photo or ad), we send it to a third-party artificial intelligence moderation service (OpenAI) to check that it does not contain nudity, sexual content, graphic violence or other content that breaks the rules. The image is not stored for that purpose: if it is rejected, it is not stored; if it is accepted, it is saved like any other. Sharshor keeps an audit log with your account identifier, where the image was being used, the result and the categories detected, but not the image. The provider may keep the data temporarily under its own terms. The decision is automatic and you can ask for it to be reviewed by writing to us from the Support page.

Premium members can translate the messages they receive in one-to-one chats and in conversations with recruiters, and recruiters will be able to do the same from their panel. A message is only translated when the person who receives it asks for it, by long-pressing the message or by turning on auto-translate in that chat. The sender's message is never changed, and the original is always available with "See original".

To translate a message we send its text, and nothing else about you, to a third-party artificial intelligence provider (currently OpenAI), which may process it outside your country. We ask the provider not to store the request, and it does not use it to train its models, although it may keep it for a limited time to prevent abuse under its own terms. Sharshor does not store translations on its servers: they are kept on the device of the person who translated them. To apply the daily limit (currently 500 messages) we store, for each account, how many messages it translated that day, without their text. Translations are produced automatically and can contain mistakes (legal basis: providing the service the recipient asks for, and our legitimate interest in letting members who speak different languages talk to each other).

To give the daily reward (a free SuperPitch for opening the app on 5 days in a row) we store, for each account, the last day it opened the app, how many days in a row it has done so, and the free SuperPitches it has earned and used, with their dates. We do not record each visit separately. This data is deleted together with the account (legal basis: providing the reward you take part in by using the app).

We show ads and record impressions and clicks linked to your profile to measure their performance. That data is unlinked from you when you delete your account.

Premium members, recruiters and advertisers can search for profiles by describing them in their own words. To make this possible we send the public data of each profile (profession, description, category, skills, city and country, languages and, for creators, the creator details shown on their profile; never name, email, messages or CV) to our artificial intelligence provider (currently OpenAI), which turns it into a numerical representation that we store to compare it with searches. The text of a search is sent to the same provider and is not stored by Sharshor; we only log who searched, when and how many results there were, to apply a limit of 60 searches an hour. For advertisers we also ask the provider to read the age, gender and country mentioned in the search to use them as filters. If you do not want to appear in these searches, you can delete your account; we are working on an option to opt out without deleting it (legal basis: providing the service and our legitimate interest in helping members find each other).

When an organisation creates its account in a panel, we store the organisation's name, the nickname and email of the person who created it, the emails of its team, and the tax details and document it provides so we can validate it (legal basis: the contract with the organisation and our legal obligations). The tax document is kept in private storage that only the validation team can open. When the organisation deletes its account from the panel, we delete the organisation, its team, its ads and their results, its conversations and the tax document. Invoices and payment records kept by Stripe follow Stripe's retention rules and the tax law.

The website has no contact forms: if you email us, we use your message and email only to reply and delete the conversation once it is closed, unless we need it to handle a claim.

To sign up for an event you need your Sharshor account. We store your registration, any note you add and whether you agree to appear in photos or videos of the event. The organiser (Sharshor) sees your name and email to manage the event and notify you of changes. Other attendees do not see your registration. If you do not agree to photos, we will try to make sure you do not appear in a recognisable way in what we publish. Registrations are deleted 12 months after the event.

We keep your data while you have an account. The notification history is deleted after 30 days and Didit verification sessions after one month. When you delete your account we erase your profile and conversations, except as stated for suspended accounts and the 12-month encrypted fingerprint described in that same section. We are defining retention periods for the rest of the data.

When you ask to delete your account from the app, we wait 7 days before erasing it, in case you change your mind. During those days your profile is hidden from other members (Discover, Likes, searches and your public profile), your data stays stored as it was, and we keep the date of the request and the reason you gave. We send you an email with the deletion date and a reminder the day before. If you sign in again before the date, the deletion is cancelled; if not, the account is erased as described above. If you want your data erased without waiting, write to us from the Support page.

When the app or the website fails, it sends an error report to Sentry, a service that acts as our processor and stores the data in the European Union. The report contains the technical error, the screen or page where it happened, the version of the app and basic details of the device and system (model, operating system and browser). We do not send your name, email, profile, messages or account identifier, we remove the parameters of the web addresses, and we ask Sentry not to store your IP address. We only use these reports to find and fix faults (legal basis: our legitimate interest in keeping the service working), and Sentry deletes them after 90 days at most.

We use Supabase (database, authentication and files), Google and Apple (sign-in), Firebase Cloud Messaging (notifications), Cloudflare (hosting and files), Didit (identity verification), the App Store and Google Play (subscriptions), Stripe (recruiter and advertiser subscription payments), Google Web Risk (to check the links of ads before they are shown: only the ad's link is sent, never data about you), KLIPY (GIFs in chats), Daily (video calls with recruiters), SignWell (contracts from recruiters), an artificial intelligence provider to read CVs, review images and translate chat messages (currently OpenAI), Sentry (error reports) and email delivery services.

You can edit your profile, undo Matches and delete your account at any time. You also have the right to access your data, correct it, erase it, restrict or object to its processing, take a copy of it in a common format (portability), and withdraw any consent you gave without affecting what was done before. For any request about your data, write to us at support@sharshor.com or from the Support page; we reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority of the country where you live.