Privacy Policy

Last updated: July 21, 2026

RamenHire ("RamenHire," "we," "us") is a job board connecting job seekers with bootstrapped, profitable startups. RamenHire is operated by an individual — there is no separate company or legal entity behind it. This policy describes, as accurately and concretely as we can, what data we actually collect, why, where it goes, and what you can do about it. It applies to visitors, job seekers, and companies using ramenhire.com.

We have users in the EU, so this policy is written with GDPR in mind. It is not a generic template — every section below reflects what this specific site does.

1. What we collect

Beyond what you actively submit through a form, the only other data collected is the anonymous, aggregate site-analytics traffic described below and in Section 5. Job seekers have no account system and no login. Companies do have real accounts, as of July 2026 — see below.

Job seekers (applying to a job)

• Full name and email address
• Your answer to "why are you interested in this role"
• Either an uploaded CV file (PDF or Word document, max 5MB) or a link to your CV/portfolio — one or the other, not required to be both

Note on CV files:if you upload a CV, the file itself is stored, and so is its original filename (e.g. "Jane_Doe_Resume.pdf") — which can itself contain your name. Uploaded CVs are stored in a private storage bucket that is not publicly accessible; only we (as admin) can retrieve them, not other site visitors.

Companies (registering a company profile, and managing it afterward)

Registering creates a real account (email + password), used to sign in and manage your profile and listings going forward:

• A password, which we never see or store in plain text — Supabase Auth (Section 3) hashes it before it ever reaches our database.
• Contact name and email address of the person registering. This becomes both your login email and your public-facing contact email at registration time — the two can later diverge, since Account Settings lets you change your contact email without changing your login email.
• Company details, collected once at registration and reused for every listing you post afterward (not re-collected per listing): name, website, description, "why work here," team size, approximate revenue range, founded year, and (optionally) a logo image.
• Job details for each role you post (title, type, location, salary range, description) — collected separately, whenever you actually post a listing, once your account is approved.

Company profile registrations include a hidden spam-trap field. It is never shown to real visitors and is not stored — if it's filled in (a sign of automated spam), the submission is silently discarded before anything is saved.

1a. Company accounts

A company account can be in one of a few states: awaiting email confirmation, pending our manual review, approved (able to post and manage listings), or not approved. You can sign in at any time, in any state, to check your status. Requesting deletion of your account (Section 7) puts it into its own distinct, time-limited state — see Section 6.

Subscribers (weekly email list)

• Full name, email address, and optionally the role types you're interested in

Everyone (site visitors)

If you accept cookies, Google Analytics 4 additionally collects page views, the interactions listed in Section 5, and standard technical data (browser, device type, approximate location derived from IP) — this only happens if you accept. Separately, GoatCounter, Vercel Web Analytics, and Vercel Speed Insights each record an anonymous pageview for every visitor regardless of that choice, since none of them set a cookie or need consent to do so — see Section 5 for the full explanation of that distinction.

2. Why we collect it & legal basis

We process job seeker and company data to operate the core service you asked for — to submit your application, publish your job listing, or register your company profile (legal basis: performance of a contract/pre-contractual stepsyou initiated by submitting the form). Where we send you a confirmation or notification email about your own submission, that's the same basis. Analytics cookies are used only with your consent (Section 5) — none are set until you accept.

3. Where your data is stored

All form data and uploaded files are stored in Supabase, our database and file storage provider. The specific project backing RamenHire is hosted in Supabase's us-west-1 region (Oregon, United States). If you are located in the EU or elsewhere outside the US, your data is transferred to and processed in the United States as a result. This transfer relies on Supabase's own data processing agreement and standard contractual clauses as the transfer mechanism — we don't operate separate infrastructure of our own.

4. Who we share it with

We don't sell data, and we don't share it for advertising purposes. The following third parties process data on our behalf, strictly to run the service:

• Supabase — database, file storage, and (for company accounts) authentication hosting (Section 3).
• Vercel — hosts and serves the website; sees standard request/connection data as part of serving any web page.
• GoatCounter — cookieless site analytics that runs for every visitor regardless of your cookie choice (see Section 5 for why). Per GoatCounter's own documentation, it does not store IP addresses — an incoming IP is used only momentarily to derive a country-level location, then discarded, and no cookie, localStorage, or other browser storage is used. Each pageview it records includes browser/OS, screen width, language, referrer, and the page path.
• Vercel Web Analytics — cookieless traffic analytics, also unaffected by your cookie choice (Section 5). Per Vercel's own documentation, visitors are identified only by a hash derived from the incoming request, not by IP address or any cookie; that hash is discarded after 24 hours rather than kept as a persistent identifier. Each data point includes the page URL, referrer, country/region-level location, and device/browser/OS type — none of it tied to an individual visitor.
• Vercel Speed Insights — cookieless page-load performance measurement (e.g. how fast pages render for real visitors), also unaffected by your cookie choice (Section 5). Per Vercel's own documentation for this specific product, recording is anonymous and not tied to, or able to reconstruct, an individual visitor's browsing session, and it sets no cookie. Each data point includes the page route, network speed, device/browser/OS type, country, and page-load performance metrics (e.g. how fast the page rendered).
• Resend — sends transactional emails on our behalf: your submission details are included in the notification email we receive, and (for company registrations) a confirmation email is sent back to the address you provided.
• Google Workspace / Gmail — our admin inbox (hello@ramenhire.com) that receives the notification emails above.
• Google Analytics 4 — site usage analytics, only after you consent to cookies (Section 5).
• Google Search Console — aggregated, site-level search performance data (e.g. which search queries lead to our pages). This does not include personal data about individual visitors.

5. Cookies

Company sign-in session (strictly necessary, no consent banner) — set regardless of your cookie choice below. If you sign in to a company account, a session cookie (sb-...-auth-token) is set so you stay signed in across pages and visits. This cookie is required for the sign-in feature itself to function — it isn't used for tracking or analytics and contains no data beyond what's needed to identify your session. It's removed when you sign out.

RamenHire does not set any non-essential cookie until you accept the cookie banner shown on your first visit. If you decline, no analytics cookie is set at all — this isn't just a preference toggle after the fact, the underlying analytics script itself is not loaded until you accept.

GoatCounter, Vercel Web Analytics, and Vercel Speed Insights are the exception — they run on every page view regardless of the choice you make above, and that's intentional, not an oversight or a workaround of your decision. The cookie banner governs cookies specifically, and none of these tools sets one: no cookie, no localStorage, no identifier saved to your browser at all — so there is genuinely no non-essential cookie to ask permission for. What they do instead is send a single, anonymous record of that page view directly to their own servers the moment the page loads, before you've made any cookie choice — a real network request you can see for yourself in your browser's network tab. That's the "processes a pageview" side of privacy law, not the "sets a cookie" side; the consent requirement in this section is specifically about the latter. Concretely: GoatCounter discards the IP address it briefly sees after deriving a country-level location from it; Vercel Web Analytics identifies visitors only via a hash that's discarded after 24 hours rather than kept as a persistent identifier; and Vercel Speed Insights doesn't identify individual visitors at all — its recordings are anonymous by design. None of the three can link a page view back to you on a future visit or across other sites.

If you accept, Google Analytics 4 sets two cookies:

• _ga — a general, cross-session identifier used to distinguish visitors. Google's default duration is approximately 2 years.
• _ga_1X6XVB58KC — a property-specific cookie that tracks session state for this site. Google's default duration is approximately 2 years.

We have not configured IP anonymization because Google Analytics 4 does not offer that setting (it was specific to the older Universal Analytics product) — Google states GA4 does not persist full IP addresses. We have not layered on any additional anonymization beyond GA4's own default handling.

Separately, the site uses your browser's sessionStorage(not a cookie) to remember if you've dismissed a promotional popup during your visit. This never leaves your browser, contains no personal data, and clears automatically when you close the tab — it doesn't require consent.

You can change your cookie choice at any time: manage cookie settings. If you previously accepted and later decline, we also actively remove the _ga and _ga_1X6XVB58KCcookies already set on your browser — declining doesn't just stop future tracking, it clears what was already there.

6. Data retention

Company accounts and their listings now have automated retention windows. These are grace periods for undoing a deletion, not a legal or tax record-retention schedule— we make no compliance claim about how long data is kept; they exist purely so a deletion request (yours, or an account that never got approved) isn't instantly irreversible.

• Company registrations that never get approved (still awaiting email confirmation, still in our review queue, or not approved) are eligible for removal 15 days after registration.
• A company that requests account deletion (Section 7) gets a 90-day window before permanent removal — during which the request can still be reversed by emailing us.
• That same company's job listings are removed on their own 30-day window, independent of and shorter than the 90-day account window — so listings come down well before the account itself is fully purged.
• Permanent removal, once a window elapses, deletes the company/listing record, any uploaded logo or CV files tied to it, and the underlying sign-in account itself — not just a status flag.

Everything not covered above — submitted job applications, job-post-request history predating company accounts, and subscriber list entries — still has no automated deletion or retention policy; those persist indefinitely unless manually deleted by us. If you'd like data removed sooner than these windows, see Section 7.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or export your data, and to object to how it's processed.

Companiescan now request deletion of their own account and listings directly from Account Settings, self-service — no email needed to initiate it (though Section 6's 90-day window means emailing hello@ramenhire.comis still how you'd reverse a request already made). Job seekers have no account or self-service tool; to exercise any right over data submitted as a job seeker (or anything not covered by the self-service tool above), email hello@ramenhire.com. We'll describe that process honestly: a person manually locates and removes or exports the data on request. We aim to respond promptly, but this is a manual process, not an instant one.

8. Security

Uploaded CVs are stored in a private storage bucket that isn't publicly accessible — only admin access can retrieve them. Company account passwords are handled entirely by our authentication provider (Supabase Auth) and hashed before storage — we never see or store a plain-text password. All data access is governed by database-level row-level-security rules: an anonymous visitor, a signed-in company (scoped strictly to its own account and listings), and an admin each see only what their role is allowed to. No system is perfectly secure, but we don't take shortcuts like exposing raw database access to the public.

9. Children's privacy

RamenHire is a professional job board and is not directed at, or intended for use by, children. We don't knowingly collect data from minors.

10. Changes to this policy

If our practices change, we'll update this page and its "last updated" date. We don't currently have a mailing list for policy changes specifically — check back periodically if this matters to you.

11. Contact

Questions about this policy or your data: hello@ramenhire.com.