Privacy Policy
EarlyO — Connecting Early Years Talent in Ireland Last updated: June 2026 Version 1.0
1. Who We Are
EarlyO ("we", "us", "our") is a jobs marketplace platform connecting childcare professionals with early years employers in Ireland. We operate at earlyо.ie.
For the purposes of data protection law, EarlyO is the data controller of personal data collected through this platform.
Contact us: Email: privacy@earlyo.ie Address: [Your registered address, Ireland]
If you have any questions about this policy or how we handle your data, please contact us at the above address.
We are registered with the Irish Data Protection Commission (DPC). Our DPC registration number is: [Insert when registered]
2. What Data We Collect
2.1 Candidates (Childcare Professionals)
| Data | Why we collect it |
|---|---|
| Full name | To identify you and display your profile |
| Email address | Account access and notifications |
| Location | To match you with nearby roles |
| Sector preference (Montessori, crèche, daycare, afterschool) | To surface relevant job matches |
| Availability status | To show employers when you can start |
| CV file (PDF or DOCX) | Core platform function — matching you to jobs |
| Extracted CV data (skills, qualifications, experience years, job titles) | Automated matching against job adverts |
| Garda vetting status (yes/no) | Required for childcare roles; shown to matched employers |
| Job match interactions (saved, dismissed, viewed) | To personalise your matches feed |
| Last login timestamp | Platform security and retention |
2.2 Employers (Childcare Settings)
| Data | Why we collect it |
|---|---|
| Organisation name | Public-facing profile |
| Contact name and email | Account access and billing communications |
| Sector(s) | To match relevant candidates |
| Website and logo | Organisation profile |
| Stripe customer ID | Payment processing |
| Payment plan and billing history | Subscription management |
| Job advert content | Core platform function |
2.3 All Users
| Data | Why we collect it |
|---|---|
| IP address and browser type | Security and fraud prevention |
| Cookie data | Platform functionality and analytics (see Cookie Policy) |
| Communication records | If you contact our support team |
3. Legal Basis for Processing
We process personal data under the following legal bases under GDPR Article 6 (and Article 10 where applicable):
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract performance (Article 6(1)(b)) |
| CV parsing and job matching | Contract performance (Article 6(1)(b)) |
| Sending match notifications | Contract performance (Article 6(1)(b)) |
| Payment processing | Contract performance (Article 6(1)(b)) |
| Garda vetting status | Legal obligation (Article 6(1)(c)) + Irish law; and Article 10 processing under Schedule 2, Data Protection Act 2018 |
| Platform security and fraud prevention | Legitimate interests (Article 6(1)(f)) |
| Analytics and platform improvement | Legitimate interests (Article 6(1)(f)) |
| Marketing emails (optional) | Consent (Article 6(1)(a)) |
| Cookie consent where required | Consent (Article 6(1)(a)) |
Note on Garda vetting data: The garda_vetted field records whether a candidate has undergone Garda vetting — a criminal records check required under Irish childcare law. This is processed under Article 10 GDPR and Schedule 2 of the Data Protection Act 2018. We record only the boolean outcome (vetted: yes/no), not the content of any vetting certificate.
4. How We Use Your Data
Candidates
- Match your profile and CV against live job adverts
- Display your match score and relevant jobs in your dashboard
- Notify you of strong matches (score ≥ 70) by email
- Allow employers whose adverts you match to view your profile summary
Employers
- Display matched candidates for your adverts
- Process payments via Stripe
- Send billing and account emails
All users
- Send transactional emails (account creation, password reset, billing)
- Secure and maintain the platform
- Comply with legal obligations
5. Who We Share Your Data With
We do not sell your data. We share it only with the following trusted processors, each under a signed Data Processing Agreement (DPA):
| Processor | Purpose | Location | DPA |
|---|---|---|---|
| Supabase, Inc. | Database and file storage | EU (AWS eu-west-1) | Signed |
| Vercel, Inc. | Web hosting | EU region | Signed |
| Stripe, Inc. | Payment processing | EU | Signed (ToS addendum) |
| Resend, Inc. | Transactional email | EU | Signed |
| Anthropic, PBC | CV parsing via AI (Claude API) | USA | Signed (API ToS DPA) |
| Irish Revenue / tax authorities | Legal obligation | Ireland | N/A |
Candidate data shared with employers: When your CV matches a job advert, your profile summary (name, sector, location, skills, qualifications, experience years, Garda vetting status) is made available to that employer. Your full CV is only accessible to employers once you are shortlisted (Phase 2). Your email address is never shared with employers.
6. International Transfers
Anthropic (Claude API) processes CV text on servers in the United States. This transfer is covered by:
- Anthropic's Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR
- Anthropic's data processing terms, which prohibit use of your data for model training
All other processors operate within the EU or under SCCs.
7. How Long We Keep Your Data
| Data category | Retention period |
|---|---|
| Active account data | While your account is active |
| Inactive candidate profiles | Deleted after 24 months of inactivity (no login) |
| Inactive employer profiles | Deleted after 24 months of inactivity |
| CV files | Deleted with your account or on re-upload |
| Payment records | 7 years (Irish tax law requirement) |
| Consent records | 3 years from last consent event |
| Breach records | 3 years |
You will receive an email 30 days before your inactive profile is scheduled for deletion.
See our Retention Policy for full details.
8. Your Rights
Under GDPR, you have the following rights:
| Right | What it means | How to exercise |
|---|---|---|
| Access | Obtain a copy of all data we hold about you | Settings → Download My Data, or email privacy@earlyo.ie |
| Rectification | Correct inaccurate data | Edit your profile directly, or contact us |
| Erasure ("right to be forgotten") | Delete your account and all personal data | Settings → Delete Account, or email privacy@earlyo.ie |
| Restriction | Pause processing while a dispute is resolved | Email privacy@earlyo.ie |
| Portability | Receive your data in a machine-readable format | Settings → Download My Data (JSON format) |
| Object | Object to processing based on legitimate interests | Email privacy@earlyo.ie |
| Withdraw consent | Withdraw any consent given at any time | Unsubscribe links in emails, or email privacy@earlyo.ie |
We will respond to all requests within 30 days. Complex requests may be extended to 90 days with notice.
Right to lodge a complaint: If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC):
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Web: www.dataprotection.ie
Phone: +353 57 868 4800
9. Automated Decision-Making
Our job matching system uses automated scoring to rank candidates against job adverts. This process:
- Calculates a match score (0–100) based on skills, qualifications, sector, and location
- Does not make any consequential decisions about your employment
- Does not result in any legal effects — it is a recommendation tool only
Candidates and employers can always view, dismiss, or override match results.
10. Security
We implement the following technical and organisational measures:
- All data encrypted in transit (TLS 1.2+) and at rest (AES-256 via Supabase)
- Row-Level Security (RLS) on all database tables
- CV files stored in private Supabase Storage buckets, served via short-lived signed URLs (1-hour expiry)
- JWT-based authentication with role-encoded claims
- Stripe webhook signature verification
- Regular security reviews
11. Children's Data
This platform is intended for adults (18+) only. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please contact privacy@earlyo.ie immediately and we will delete the account.
Note: Our users work with children in professional settings — this does not affect the above.
12. Cookies
We use cookies for essential platform functionality, analytics, and (with your consent) marketing. See our full Cookie Policy.
13. Changes to This Policy
We may update this policy periodically. We will notify you of material changes by email or by prominent notice on the platform at least 14 days before changes take effect. The "Last updated" date at the top of this page will always reflect the current version.
Continued use of the platform after changes take effect constitutes acceptance of the updated policy.
EarlyO — Connecting Early Years Talent in Ireland