Privacy Policy

1. Scope

This policy applies to JoinUp and to communications with us about JoinUp. Other websites operated by the Club, social networks and external application sites may have their own privacy notices. Following a link to another service does not make that service part of JoinUp.

2. Controller and Data Protection Contact

For questions about personal data, access, correction, deletion or export requests, contact it@entrepreneur-club.org. This is the Club's contact channel for JoinUp privacy matters.

3. Data We Collect

The data we receive depends on the features you use:

• Account and sign-in data: name, email address, handle, account roles, first Terms-acceptance time, verification records, sessions, IP address and browser user agent. Social sign-in also exchanges account identifiers and authorization tokens with the provider you select.
• Talent profiles: avatar, headline, biography, work and education history, skills, expertise, location, work preferences, social links and other profile details you enter or import.
• Startup and job activity: startup profiles, membership and access requests, job listings, application contact details, attachments, and saved jobs or startups.
• Public event information: event details, cover-image links and public organizer names or links imported from Luma for the event directory.
• Documents and imports: uploaded CVs and file metadata, information supplied through an authorized LinkedIn import, extracted CV fields and import status. CV Vault also stores document labels, share-link settings, access counts and the last access time.
• JoinUp newsletter: if you opt in, your email address and your newsletter choice, with a record of when you gave or changed that choice and which version of the consent wording applied.
• Search and location: search text, location text and coordinates used to find places, display maps and search profiles or jobs.
• AI outputs: numerical representations of text for semantic search, structured CV information and CV analysis feedback or scores.
• Usage analytics, only with your consent: the pages you visit, the page that referred you, which buttons and links you click, the time and duration of visits, and your browser, operating system, device type and screen size. See section 7.
• Technical and support information: requests, timestamps, security events, error information, browser preferences and the contents of messages you send us.

JoinUp has no payment collection flow or advertising analytics integration. We do not ask for health, religious, political or similarly sensitive information. Free-text fields and CVs can nevertheless contain it: please leave out information that is unnecessary for your professional profile, including other people's private details.

4. Purposes and Legal Bases

We process data to provide accounts and profiles, publish the content you choose to share, operate startup and job features, import and analyze CV or LinkedIn information, support search, send transactional messages, answer requests and protect the service against abuse.

Where the EU General Data Protection Regulation applies, processing necessary to provide the service you request is based on performance of a contract or steps at your request before entering one (Article 6(1)(b)). For optional LinkedIn authorization and publication choices, we rely on your consent where required (Article 6(1)(a)). Security, troubleshooting and defending legal claims serve our legitimate interests in running and protecting JoinUp (Article 6(1)(f)); applicable legal duties may also require processing (Article 6(1)(c)). The Swiss Federal Act on Data Protection also governs our handling of personal data.

You can decline an optional import or keep a talent profile unlisted. Data needed for authentication or a requested feature is necessary to provide that feature. Contact us to withdraw consent or object to processing; withdrawing consent does not undo processing that was lawful before withdrawal.

Usage analytics. If you accept analytics, we use PostHog to understand how JoinUp is used, find confusing steps and decide what to improve. Where the EU General Data Protection Regulation applies, this processing and the storage of PostHog identifiers on your device are based on your consent (Article 6(1)(a)). Declining has no effect on your access to JoinUp.

JoinUp newsletter. The newsletter is optional. During sign-up the newsletter box is ticked in advance, and you can untick it before continuing; you can also opt in or out at any time under Settings. When you opt in, we pass your email address to Mailchimp, which emails you a confirmation link. You only receive the newsletter after confirming. We then use your email address and your choice to send you occasional emails with startup jobs, events and JoinUp news, which may include sponsored content from partners. Where the EU General Data Protection Regulation applies, this processing is based on your consent (Article 6(1)(a)). You can withdraw your consent at any time in Settings; withdrawal does not affect processing that took place before it.

5. LinkedIn Data Portability API

If you connect LinkedIn for an import, LinkedIn asks you to authorize access. JoinUp uses the resulting token to retrieve professional information and help populate your profile. This import is separate from using LinkedIn to sign in.

Imported information and the import status are stored by JoinUp. Profile content derived from the import can also be sent to OpenAI to generate search embeddings. Revoking authorization through LinkedIn stops future access under that authorization; it does not automatically remove copies already imported into JoinUp. You can edit profile fields and contact us about deleting imported information.

6. Visibility Within the Platform

A new talent profile is unlisted by default, and its CV visibility setting defaults to off. Listing and CV visibility are separate choices. Unlisted profiles are excluded from the public talent directory, public profile lookup and public semantic search. This does not stop storage, CV extraction or generation of search embeddings.

Listed talent profiles are publicly accessible, including without signing in. They can expose your name, handle, avatar, profile text, location text, work and education history, skills, preferences, badges and profile details such as social links. The location shown is the text you provide, so avoid entering a private street address. Search engines and other visitors may copy public information.

If you enable public CV visibility on a listed profile, the CV link is returned with that public profile. Information inside that file, including contact details, can therefore become public. Your account email, authentication records and raw LinkedIn import snapshot are not fields returned by the public talent profile. Information you put into public text or a public CV is a separate disclosure.

CV Vault sharing works through links: anyone who has a valid share link can view its document information and obtain a download link without an account. You can revoke a share link, and links with an expiry stop working after that expiry. A previously issued download link may continue to work for its short lifetime, and revocation cannot retrieve copies already downloaded.

Startup and job information is published for discovery. When you contact a startup through an email address or external application link, the recipient handles the information you send under its own practices. Changing visibility limits future access through the relevant JoinUp feature; it cannot erase third-party copies or search engine caches.

7. Cookies and Tracking

JoinUp uses cookies for sign-in, routing, authorization and preferences. It also stores preferences in your browser's local storage. JoinUp does not use advertising pixels. The only third-party analytics service is PostHog, and it runs only if you accept it.

Analytics with PostHog. When you first visit, JoinUp asks whether you accept analytics. Until you accept, the PostHog script is not loaded and nothing is sent to PostHog. If you accept, PostHog records the pages you visit and which buttons or links you click. It does not record the text of those elements, what you type, or session recordings. Query strings and document share links are removed from page addresses before they are sent. When you are signed in, events are linked to your internal JoinUp user ID; your name and email address are not sent. Requests are routed through JoinUp's own domain and processed in PostHog's EU region. PostHog is configured to discard your IP address, and analytics events are kept for up to 12 months.

You can change your choice at any time through Cookie settings, also linked in the footer. Withdrawing consent stops further analytics and removes PostHog's cookie and local storage from your browser. It does not delete events already sent; contact us to have analytics data linked to your account deleted.

better-auth.session_token

Keeps you signed in. The persistent session cookie has a seven-day lifetime and may be renewed during use. A non-persistent sign-in uses a session cookie instead.

better-auth.state

Protects social sign-in requests against mismatched callbacks. Up to five minutes, and cleared on a successful callback.

better-auth.dont_remember

A session-only marker when non-persistent sign-in is requested. Better Auth cookies use an __Secure- prefix on secure deployments.

jup-onboarded

Remembers that onboarding is complete for routing. Up to 24 hours; removed when the session cookie is absent.

joinup_audience

Remembers the talent or startup audience you select. Up to one year from selection.

jup-active-ctx

Remembers which talent or startup dashboard you are using. Up to 30 days from selection.

linkedin_oauth_state

Protects the separate LinkedIn import authorization flow. Up to ten minutes, and cleared on callback.

linkedin_dma_token

Holds the LinkedIn authorization token used for an import. Its lifetime follows the token expiry supplied by LinkedIn, or 30 days if no expiry is supplied.

joinup-theme (local storage)

Remembers your chosen display theme in your browser until changed or cleared.

joinup-analytics-consent (local storage)

Remembers whether you accepted or declined analytics, with the date and version of the notice. Kept until you change it or clear browser storage; set only once you make a choice.

ph_<project key>_posthog (cookie and local storage)

Only after you accept analytics. Holds PostHog's random visitor identifier and session state so visits can be counted. Up to one year from the last visit; removed when you decline or withdraw consent.

linkedin_sync_seen_<user ID> (local storage)

Remembers whether you have seen a LinkedIn import notification. Reset for a new pending import, or removed when you clear browser storage.

You can remove cookies and local storage through your browser. Doing so may sign you out, reset preferences or interrupt an authorization flow. Cookies used on a social provider's own site are governed by that provider's notice.

8. Data Sharing and Service Providers

The services integrated with JoinUp process data needed for the functions below. A provider can also process technical information about requests to its service. Services you choose directly, such as social sign-in providers and external application sites, also have their own privacy terms.

Authorized Club operators may access data for support, administration and security. We may also need to disclose relevant data to respond to a binding legal obligation or establish or defend legal claims. The platform does not contain a personal-data sales or advertising-network integration.

9. Location of Processing

JoinUp uses international service providers. Processing can take place outside Switzerland, including in the United States, and depends on each service and its account configuration. This policy does not promise that all data stays in Switzerland or Europe. This also applies to Mailchimp, which receives the email addresses of newsletter subscribers. PostHog stores analytics data in its EU region (Frankfurt, Germany); PostHog, Inc. is based in the United States, and its staff or subprocessors may access data from outside Europe.

Contact us for information about the processing locations and safeguards relevant to your data. Provider terms and the legal requirements for international transfers apply; the use of a particular provider does not by itself establish a specific contractual safeguard or certification for our account.

10. Retention

Account and profile information is stored to operate your account and the features you use. JoinUp does not automatically erase accounts after a fixed period of inactivity. Uploaded files, imported information and generated data can remain stored after processing; CV analysis is not a promise that the original file is automatically deleted.

You can edit your profile, manage documents and sharing, or delete your account from Settings after confirming a fresh email code. Deletion removes account access and associated personal records, including jobs you created; startup pages and other people's jobs remain. File cleanup can be delayed or require review, especially for shared, legacy or untracked uploads. Limited security records retain linkable user identifiers, including a deletion marker that prevents restoration of an old account identity. These records are pseudonymous, not anonymous, and have no automatic purge. Backups and provider records can have different retention periods from the visible profile. Applicable legal duties or the need to address disputes may also affect a deletion request. We will explain relevant limitations when handling your request; this policy does not promise immediate deletion from every system.

PostHog analytics events are deleted automatically after at most 12 months. Deleting your JoinUp account does not automatically delete analytics events linked to your user ID before that time; contact us and we will delete them.

We keep your newsletter choice with your account and stop using your address for the newsletter when you withdraw your consent or delete your account. Removal from Mailchimp may not happen at the same moment, and Mailchimp's own records can have a different retention period.

The record of when you gave or changed your newsletter choice is one of the limited security records described above. It contains a linkable user identifier, the time, your choice and the version of the consent wording. It is pseudonymous, not anonymous, has no automatic purge and can remain after your account is deleted.

11. Security

JoinUp uses email one-time codes and supported social providers for sign-in; password sign-in is disabled. Session cookies use HttpOnly and SameSite protections. Application authorization checks restrict account functions, file operations and administrative tools, and authentication requests are rate limited.

We record selected security events, including successful sign-ins, email verification, account deletion, newsletter consent changes and selected administrative changes. These records can include a user identifier, event type and time. This is not a record of every profile view or every action. Operational logs and background task records are also used to investigate failures.

No service can guarantee absolute security. Please protect your email account, sign out on shared devices and treat document share links as access credentials. Contact us if you suspect unauthorized access. We assess security incidents and make notifications where required by applicable law.

12. Your Rights

Depending on the law and circumstances that apply, you may request access to your personal data, correction, deletion, restriction of processing or a portable copy. You may object to processing based on legitimate interests and withdraw consent where processing depends on it, including analytics consent through Cookie settings.

Send requests to it@entrepreneur-club.org. We may need information to verify your identity and clarify the request before disclosing or changing personal data. We handle requests under the applicable legal deadlines and explain any restriction or extension that applies. You can delete your account in Settings using a fresh confirmation code. Contact us for a data export or help with a request; export requests require operator review and are not delivered automatically.

You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where applicable, the data protection authority in your EU country.

13. AI and Automated Matchmaking

OpenAI's text-embedding-3-small model converts profile and search text into numerical vectors used to find similar listed talent. Profile text can include headlines, biographies, skills, work descriptions and education, including information imported from a CV or LinkedIn. These inputs are not guaranteed to be anonymous.

Google Gemini extracts information from uploaded CV PDFs. The CV scan and employability analysis features also send extracted CV text for generated feedback and scores. The current integrations use gemini-2.0-flash for extraction and gemini-3-flash-preview for analysis.

These features make inference requests; JoinUp does not run a model training or fine-tuning workflow. Providers' handling of inputs, outputs and operational records depends on their applicable service terms and account settings. We do not make a blanket promise that every provider deletes inputs immediately or never uses data for service improvement.

Generated fields, scores and matches can be inaccurate or biased. Review imported information before publishing it. Scores are feedback, not a hiring decision, and JoinUp does not automatically hire, reject or offer employment based on them.

Keeping your profile unlisted excludes it from public talent search, but does not switch off all AI processing. There is no separate AI opt-out setting. You can avoid an optional CV analysis or import and contact us about processing already performed or concerns about a result.

14. Children's Data

JoinUp provides professional job and startup services and is not designed for children. The platform does not currently verify users' ages. If you believe a child has provided personal data, contact us so we can assess the information and the appropriate action.

15. Organizational Changes and Updates

Changes to JoinUp's features, providers or operations may require changes to this policy. The version available on this page carries the date of its latest revision. Where applicable law requires additional notice or consent for a change, that requirement also applies.

16. Contact

ETH Entrepreneur Club, Rämistrasse 101, 8092 Zürich, Switzerland.

Privacy questions and requests: it@entrepreneur-club.org.