Privacy Policy
Effective 23 October 2026
Remote Medium is a human-curated remote recruitment agency. Job seekers create a free profile; companies pay to post roles; a person on our team decides which matches are real, asks the candidate for permission, and only then makes an introduction. This policy explains what personal data that process involves, why we handle it, who sees it and what control you have. We have tried to write it the way the product actually works.
The short version
- Creating a profile is free. Candidates never pay and are never charged.
- A company sees an anonymised card (no name, email, CV or employer names) and only after a curator has confirmed the match and you have said yes to that specific role.
- Your name, email and CV are shared only in the introduction, once you have said yes and the company has shown interest.
- Matching is deterministic scoring plus a human decision. No AI, machine learning or language model is used to rank or choose people.
- We do not sell your data and do not run advertising trackers. We use only the cookies needed to keep you signed in, unless you choose to accept optional analytics cookies and session recordings on our public pages. You can decline and the site works the same.
- You can pause, withdraw, edit or delete your profile at any time.
1. Who we are
"Remote Medium", "we" and "us" means the operator of remotemedium.com and its sub-sites (the company dashboard at company.remotemedium.com and our internal curator tools). We are the data controller for the personal data described here. Contact us at connect@remotemedium.com. Privacy questions and rights requests go to the same address.
This policy covers: job seekers (candidates); people who use a company account; people who visit the site or subscribe to emails; and anyone who contacts us, including owners of external listings who send a takedown request.
2. What we collect
Candidates
- Account: full name and email address (used for passwordless magic-link sign-in and all communication).
- Profile you enter: country and timezone; employment types you will accept (full-time employee, contractor, part-time); minimum salary and currency; availability; role types you are targeting with seniority; skills with years of experience; industries you have worked in or are interested in; and skill suggestions you submit.
- CV: the PDF you upload, stored in private object storage (never in our database). A CV may contain more than we ask for, such as phone number, address, employer names, photo or date of birth. Please leave out anything you would not want a company to see, and in particular sensitive information such as health, religion, ethnicity, political opinions or government ID numbers. We do not ask for it.
- Our own records about you: your profile status (new, screened, active, paused, placed, withdrawn); internal screening notes and who screened you and when (from a review of your profile or a call); the curator's note we may show a company about you; and which curator confirmed or rejected each match.
- Matching and consent records: the roles you were matched to, the score and its per-rule breakdown, your yes/no answer and its timestamp, whether a company was interested and when an introduction was sent. Consent links are stored only as a one-way hash.
- Email records: a log of every email we send you (address, type, related role, delivery status, time — not the message body), which digest emails we sent, and which roles in them you clicked.
Company users
- Your name, work email and a password (stored only as a hash), or a magic-link login.
- Company details: name, website, stage, size band and headquarters country.
- Roles you post (structured fields such as role type, skills, seniority, regions, salary range and timezone), your reactions to candidate cards, and the introductions we send.
- Purchases: order and customer identifiers and the number of credits bought. Card and bank details are collected by our payment provider and never reach us.
Everyone
- Sign-in sessions: a session token, IP address and browser (user agent) for each signed-in session.
- Security signals: our infrastructure and bot-protection service (Cloudflare Turnstile, which runs on all our public forms) process IP address, browser and device characteristics to tell people from bots and to rate-limit abuse.
- Usage analytics and error reports: when you visit our sites, our analytics provider (PostHog) receives the page address (with any query string and link tokens removed), the referring site, your browser and device type. If you have accepted optional cookies, it also derives an approximate location from your IP address; visits counted without cookies carry no location. It also receives anonymous counts of key actions, for example that a profile step was completed or a form had an error, which carry no names, emails, answers or account identifiers. Until you accept optional cookies this uses no cookies or other storage on your device and does not follow you between visits. If the site or API fails, an error report (technical details only) is sent to the same provider.
- Session recordings and interaction data (only if you accept): on our public pages (home, roles, companies and the sign-up page) we record how the page is used, such as what you click, scroll and where you pause, as a replay we can watch to find confusing or broken parts. What you type into form fields is masked and not recorded. We do not record your profile, consent, unsubscribe or sign-in pages, or the company and curator dashboards, and we do not link recordings to your account or identity.
- Messages and takedown requests: what you write to us, plus your name and email, the listing concerned and your reason.
Curated listings (information about companies)
Our curators find public job postings by hand and record only facts (title, company, regions, salary, type, date, link to the original) plus their own short summary. We do not copy the original description, and we remove email addresses and phone numbers from what we store. These records are about companies and roles, not about individuals.
3. Where the data comes from
- From you (profile, CV, answers, messages).
- From our curators (screening notes, match decisions, curator notes).
- From our systems (scores, timestamps, delivery status, sessions).
- From companies (their reactions to your anonymised card; and, once introduced, anything you tell each other, which happens off our platform).
We do not scrape, buy or import candidate data from job boards, social networks or data brokers, and we do not build profiles of people who have not signed up.
4. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account and profile; let you sign in; let you pause, edit or delete | Performing our agreement with you (contract) |
| Curator screening; ranking you against company roles; curator review of matches; consent requests; sending our curated-role digest | Contract (providing the introduction service you signed up for) and our legitimate interest in running a recruitment agency |
| Sharing an anonymised card with a company, and later your name, email and CV in an introduction | Your explicit consent, given per match, and withdrawable until the introduction is sent |
| Running company accounts, credits and billing; activating and reviewing company accounts | Contract; legal obligation (accounting and tax records) |
| Transactional emails (magic links, welcome, consent requests, notices, introductions) | Contract |
| Security, fraud and abuse prevention, rate limiting, error monitoring | Legitimate interest in keeping the service safe and working |
| Cookieless visit counts, to see which pages are used | Legitimate interest in understanding and improving the service |
| Analytics cookies, session recordings and interaction tracking on public pages | Your consent, which you can withdraw at any time (see section 12) |
| Handling takedown requests and other messages; keeping records to defend legal claims | Legitimate interest; legal obligation where applicable |
We handle personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA"): for specified and lawful purposes, on the grounds of consent, performance of a contract, our legitimate interests or a legal obligation, and collecting only what we need. We have not designed this service to meet the requirements of other regimes such as the EU or UK GDPR. If you are in the EU or UK, please keep that in mind before you sign up.
5. How matching works
When a company posts a role, our system compares it with the screened candidate pool using fixed rules over structured fields: role type, required and nice-to-have skills, seniority, timezone overlap, salary band, industry and availability. Region and employment type are hard filters. Each rule adds a visible number, and the per-rule breakdown is stored with the match. The weights are set by our curators and can be explained to you on request. There is no machine learning, no embedding model and no language model anywhere in this process.
The score is only a shortlist for a person. A curator reviews every ranked candidate and decides whether to confirm or reject the match, so no decision that significantly affects you is made by automated means alone. Nothing is shared with a company until you consent to that specific role. If you believe a match decision was wrong, or want to know why you were or were not matched, email us and a person will look at it.
6. Who sees your data
| Stage | Who sees what |
|---|---|
| Anytime | Our curators see your whole profile, CV and notes. The public sees none of it. |
| Match confirmed by a curator; you have not answered | A company sees nothing about you. You receive an email describing the role without the company's name. |
| You say yes | The company can see an anonymised card: role targets and seniority, skills and years, industries, country, timezone, employment types, salary band and currency, availability and our curator's note. Never your name, email, CV, screening notes or current or past employer names. |
| Company is interested and a curator sends the introduction | The company receives your name, email, location and a link to your profile and CV, and you receive the company's name, website and contact details. |
Anonymisation is enforced in how we query the data: the public site and the company dashboard select only the permitted fields, so identity is absent rather than merely hidden. Candidates never see other candidates. Company roles are never shown publicly; the public site shows only curated external listings and aggregate counts.
After an introduction. Once a company has your details it holds its own copy and becomes responsible for how it uses it, under its own privacy practices. We cannot recall an introduction email or delete what a company has already received, and we do not control what happens in your conversation with them (hiring happens off our platform). If you object to how a company is using your data, tell us and we will help pass on your request.
7. Service providers we use
We share data with these providers only to run the service. They act on our instructions (except where noted) and are bound by their own data protection terms.
| Provider | What for |
|---|---|
| Cloudflare | Hosting (Workers), DNS and network protection, private storage of CVs (R2), and Turnstile bot protection on public forms |
| Neon | Managed Postgres database holding accounts, profiles and match records |
| Resend | Sending our emails (magic links, consent requests, digests, introductions) |
| Polar | Payment processing for company accounts, acting as merchant of record. Polar collects and controls payment details under its own privacy policy. Candidates never interact with it. |
| PostHog | Usage analytics, error monitoring and, with your consent, session recordings and surveys on public pages (US cloud). No account identifiers are sent. |
We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a successor if our business is sold or reorganised (in which case this policy would continue to apply to your data unless you are told otherwise).We do not sell personal data and do not share it for cross-context behavioural advertising.
8. International transfers
Remote Medium is a global service and our providers operate internationally, so your data may be processed in countries other than your own, including Sri Lanka, the United States and countries in Europe. When you are introduced to a company in another country, that transfer happens because you asked for it.
9. How long we keep it
We keep your data until you ask us to remove it. We do not delete it on a timer.
- Profile and CV: kept until you delete your profile from your profile page or email us. That removes your profile fields, your CV file, your sign-in account, and the match, consent, digest and email-delivery records about you.
- Unfinished profiles: the answers you save step by step are kept until you finish your profile (they then become it) or email us to remove them.
- Paused or withdrawn profiles: kept so you can come back; you are not matched or emailed. Ask us to remove it if you would rather it went.
- Match, consent, digest and email-delivery records: kept as a record of who agreed to what, until you delete your profile or ask us to remove them. A company keeps the record that we sent it an introduction, without the link to you.
- Company accounts and purchase records: kept until the company asks us to remove them, except where we must keep records for tax or accounting.
- Takedown requests: kept until the requester asks us to remove them.
- Sign-in sessions: until they expire or you sign out. Magic links and consent links expire on their own and work once.
- Analytics, error reports and recordings: held by PostHog under its retention limits for our plan, currently about a year for events and error reports and about a month for session recordings. These are not tied to your profile, so deleting your profile does not remove them. Email us if you want recordings you think are yours removed.
- Backups and provider logs: removed data may persist for a short time in provider backups and logs before it is overwritten.
10. Your rights and choices
Self-service
Signed in, your profile page lets you edit everything you entered, replace your CV, pause matching, withdraw, resume, or delete your profile and CV. Every digest email has a one-click unsubscribe link that pauses matching and the digest. Every consent request can be answered no, which has no effect on future matches.
Rights you can ask us to honour
Under Sri Lanka's PDPA you can ask us to:
- tell you whether we hold your data and give you a copy (access, portability);
- correct data that is wrong or incomplete;
- delete your data (erasure) or restrict how we use it;
- stop processing based on our legitimate interests, or withdraw consent you gave (withdrawing does not affect processing that already happened);
- have a person review a matching or curation decision about you.
Email connect@remotemedium.com from the address on your profile (we may ask you to verify it is you). We aim to answer within 30 days, or sooner where the law requires, and will tell you if we need longer or cannot fully comply and why. Requests are free unless clearly excessive. You can also complain to Sri Lanka's Data Protection Authority; we would appreciate the chance to resolve it first.
11. Emails
We send you transactional emails you need for the service (sign-in links, welcome, consent requests, introductions) and, if you are an active candidate, a curator-sent digest of matching external listings. We only send the digest when there are fresh roles that fit your targets. The digest can be stopped with the unsubscribe link in it or by pausing matching. Stopping the digest does not stop transactional messages about an in-progress consent request or introduction. Links in digest emails go through our redirect so we can see which listing you opened; we use that to judge whether the roles we pick are useful.
12. Cookies and similar technologies
We use a first-party session cookie to keep you signed in. It is strictly necessary, HTTP-only and set only after you sign in. It may be shared across our own subdomains (for example between remotemedium.com and the company dashboard). Turnstile may set or read technical data to tell humans from bots. We do not use advertising or social-media tracking cookies or scripts.
On our public pages we ask whether we may also use analytics cookies and record sessions (section 2). If you decline or do not answer, we only count visits and errors without cookies, and nothing is recorded. If youaccept, PostHog stores an identifier in cookies and local storage on your device so it can recognise a repeat visit and assemble a session, and records sessions and interactions on the pages listed in section 2. We remember your choice in local storage on your device. You can change it at any time with "Cookie settings" in the footer of any public page, or by clearing this site's storage in your browser. Our dashboards for companies and curators use only the cookieless analytics and do not record sessions.
13. Security
We protect data with encryption in transit (HTTPS), private storage for CVs served only through authenticated requests to authorised viewers, hashed passwords and consent tokens, role-based access limited to our curators, bot protection and rate limiting on public forms, and manual approval of company accounts. No system is perfectly secure. If a breach affects your rights we will notify you and the relevant authority as the law requires.
14. Curated external listings and takedowns
Curated listings are external: we summarise and link to the original posting and are not affiliated with, endorsed by or partnered with the companies involved. Listing owners can ask for removal at any time through our takedown form; we act within one business day. The name, email and reason you give are used only to handle the request.
15. Children
Remote Medium is for people who are at least 18 years old and looking for work. We do not knowingly collect data from anyone under 18. If you think a child has given us data, email us and we will delete it.
16. Links to other sites
Listings and introductions lead to third-party sites and companies. They have their own privacy practices, which we do not control.
17. Changes to this policy
If we change how we handle data in a way that matters (for example a new provider or a new use), we will update this page and its effective date and, for material changes affecting candidates or company users, email the address on your account. We will not use your data for a materially different purpose without telling you or, where required, asking for your consent.
18. Contact
Questions, requests or complaints:connect@remotemedium.com.