Privacy Policy
Effective 11 September 2026 · Last updated 8 October 2026
1. Who we are
DirectRef ("DirectRef", "we", "us", "our") is a cross-company referral marketplace operated by Shai Atar and Anat Atar Lachmish, jointly, as private individuals in Israel. DirectRef is not currently incorporated.
We are the controller of the personal data described in this policy, meaning we decide why and how it is processed.
Contact for anything in this policy, including to exercise your rights: support@direct-ref.com
2. What DirectRef does, and why that matters for your data
DirectRef connects two kinds of people:
- Seekers: people looking for a job, who send their CV to a specific person at a hiring company.
- Referrers: people employed at a hiring company, who post an open role and decide whether to refer a seeker internally.
When you apply to a role as a seeker, you are deliberately sending your CV, your cover note and your name to a named individual at another company. Once a referrer forwards it into their employer's hiring process, your CV is in that employer's hands and this policy no longer governs what they do with it.
We tell you who that person is before you apply. You choose them. You are never matched to a referrer you did not see, and your application is never passed to anyone else. If your referrer never answers, the application closes and we tell you. It is not reassigned.
3. What we collect
3.1 Information you give us
| Data | When | Why we need it |
|---|---|---|
| Email address, and whether you joined as a seeker or a referrer | Waitlist sign-up | To email you when DirectRef opens. Nothing else, and you can unsubscribe anytime |
| Name, email, password (hashed) | Sign-up | To create and secure your account |
| Google account profile | Google sign-in | To authenticate you without a separate password |
| Work email address at a company | Before posting a role | To verify a referrer controls an address at the company they post for |
| Employer name and job title | Referrer profile / posting | Shown to signed-in seekers on listings |
| Profile picture / avatar | Optional | Displayed on your profile |
| Your CV file | Uploaded to your profile, and copied per application | Sent to the referrer you choose; the core of the service |
| Cover note | Each application | Sent to the referrer with your CV |
| Messages you send | Messaging about an application | Delivered to the other party |
| Job listing content | Referrer posts a role | Displayed to signed-in seekers |
| Profile preferences | Optional, Settings | Powers "Suggested for you": a saved search, no ranking algorithm |
| Saved jobs | When you save a role | Shown in your Saved tab |
3.2 Information we generate
- Application records: which role, which referrer, when you applied, the decision, and the timestamps of every step in the response clocks.
- Credit balance and credit ledger: how many credits you hold and each grant and deduction. Credits are spent by referrers to post roles; applying costs nothing.
- Notification records: what we sent you.
3.3 Information collected automatically
- IP address, browser and device type, and operating system.
- Access and security logs: sign-in attempts, timestamps, and requests to our API.
- A strictly necessary cookie holding your sign-in session. See §9.
Anonymous visit and click counts. On our public marketing pages we count page visits and clicks on the sign-up buttons, together with the campaign tags in the link you arrived from (such as utm_source), so we can see which pages and campaigns work. These counts are stored without your IP address, without any cookie or identifier, and without anything else that could identify you.
We do not run any other product analytics, session replay, or third-party crash reporting. If we add any, we will update this policy under §15 first.
3.4 What we do not collect
We do not ask for and do not want: your national ID number, bank details, payment card numbers, health information, biometric data, political or religious affiliation, or trade union membership. DirectRef takes no payments at all, so no payment data is collected anywhere on the Service.
If you volunteer sensitive information inside your CV or a message, we process it because it is inside a document you chose to send, but we do not ask for it, do not index it, and do not use it for anything other than delivering it to the referrer you selected.
4. What happens if you don't provide it
Israeli law requires us to tell you the consequences of declining to give us data. Plainly:
- Email and password (or Google login): required. No account without them.
- CV file: required to apply for a role. You can browse without one.
- A work email at the company (referrers): required to post a role.
- Profile preferences, avatar, saved jobs: entirely optional.
5. Why we process your data, and on what legal basis
We process data to run and secure your account, deliver applications to the referrer you chose, run the response clocks, send transactional notifications, email people on the waitlist when DirectRef opens (on the basis of the consent you give by joining it), manage credits, prevent fraud, improve the product, and meet legal obligations, resting on your consent, contract performance, our legitimate interests, or a legal obligation, as applicable under Israeli law and GDPR where it applies.
We do not sell your personal data. We do not share it with advertisers. We do not use your CV to train machine learning models. We are not a data broker.
6. Who your data is shared with
6.1 Other DirectRef users
- The referrer you choose receives your name, your CV file, your cover note, and any messages you send about that application. They can download your CV.
- A seeker who applies to your role sees your name, your employer, your job title and your public profile.
- Job listings are visible to signed-in users and include the referrer's name and company.
6.2 Service providers who process data on our behalf
We use third parties to run the service, each bound by contract to process data only on our instructions:
| Provider | What it handles | Where |
|---|---|---|
| Railway | Application hosting, the primary database, and CV file storage | EU (europe-west4) |
| Vercel | Website and app front-end hosting | Global edge network |
| Cloudflare | DNS, network protection, and email routing | Global edge network |
| Resend | Transactional email, and the waitlist mailing list | US / EU |
| "Sign in with Google" authentication | US |
6.3 Everyone else
We disclose personal data outside the above only where we are legally required to (a court order, a lawful demand from a competent authority, or to establish, exercise or defend a legal claim), or where strictly necessary to protect the safety or rights of a person.
If DirectRef is ever acquired, merged, or transferred to a company we incorporate to operate it, personal data may transfer with it. We will notify you beforehand and you will be able to delete your account first.
7. International transfers
We are based in Israel. Several of our providers are in the United States and the European Union, so your data is transferred outside Israel.
- Israel benefits from a European Commission adequacy decision, so transfers from the EU to DirectRef in Israel are permitted without additional safeguards.
- For transfers to providers outside Israel and the EU, we rely on EU Standard Contractual Clauses or an equivalent adequacy finding.
8. How long we keep it
The rule in one line: nothing active is ever deleted.An application that is still open stays, however long it takes. Once it closes, it is erased after 30 consecutive days with no activity, and "activity" includes a message sent on it.
| Data | Retention |
|---|---|
| Waitlist sign-ups | Until you ask us to delete it. If you unsubscribe we keep only the address, marked unsubscribed, so we never email it again |
| Live applications and their CVs | Kept for as long as the application is open. Nothing active is ever deleted. |
| Closed applications, with their CV copy, cover note and messages | Erased after 30 consecutive days with no activity on the application |
| The CV on your profile | Kept until you replace it, remove it, or delete your account |
| Account profile, preferences, saved jobs | For as long as your account is open |
| Credit ledger | For as long as your account is open |
| Job listings | While active, plus 30 days after being deactivated |
| Security and access logs | 12 months |
Each application carries its own copy of the CV that was sent with it, so a CV you later replace on your profile does not change what a referrer already received. That copy is erased with the application.
When you delete your account, we delete your personal data, including every CV file you have uploaded. The only exception is anything under a legal hold. Backups are purged on their own rotation, within 30 days.
Deleting your account does not retract a CV a referrer has already downloaded or forwarded to their employer. If you want a CV removed from a company's hiring process, you have to ask that company.
9. Cookies
We use strictly necessary cookies only: your authentication session and CSRF protection. No consent is required for these, and you cannot turn them off while using the service.
We do not use advertising cookies, cross-site tracking, or analytics cookies. There is no cookie banner because there is nothing optional to consent to. If that changes, we will ask you before setting anything new.
10. Security
- All traffic is encrypted in transit with TLS.
- CV files are stored on our application host's server storage, outside the public web root. They are never served as static files and cannot be reached by guessing a URL.
- Every request for a CV is authorisation-checked. Only the seeker who uploaded it and the referrer assigned to that application can retrieve it; anyone else gets a refusal.
- Passwords are stored hashed and salted. We never see your password.
- Access to production systems is limited to the two founders.
No system is perfectly secure, and we won't claim otherwise. DirectRef is in beta, run by two people. If a breach occurs that is likely to harm you, we will notify you and the Privacy Protection Authority as required under Amendment 13 to the Privacy Protection Law, without undue delay.
11. Your rights
You may:
- Access the personal data we hold about you.
- Correct it if it is wrong, incomplete or out of date. Most of it you can edit yourself in Settings.
- Delete your account and your data, from Settings. Immediately, yourself, including every CV file you have uploaded. Or email us and we will do it for you.
- Export a copy of your data in a portable format. Email us and we will send it within 30 days.
- Object to or restrict processing based on legitimate interests.
- Withdraw consent at any time, without affecting anything done before you withdrew it.
- Opt out of marketing email in one click. You cannot opt out of transactional email.
To exercise any of these, email support@direct-ref.com. We will respond within 30 days. We may ask you to confirm your identity first, so that we don't hand your CV to someone impersonating you.
Complaints. If you think we've handled your data badly, tell us first. We would rather fix it. You also have the right to complain to the Israeli Privacy Protection Authority (ppa.gov.il). If you are in the EU or UK, you may complain to your local supervisory authority.
12. Automated decision-making
We do not make automated decisions that produce legal or similarly significant effects about you.
Specifically: there is no matching algorithm, no compatibility score, and no ranking of candidates. "Suggested for you" is a saved search that runs the same filters you set yourself. Every decision about whether to refer you is made by a human being.
The only automated actions in the system are the response-clock mechanics in the Terms (reminders to your referrer, and closing the application and telling you if they never answer) and the retention rule in §8. These are published, fixed rules, not judgements about you.
13. Children
DirectRef is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we discover that we have, we delete the account and its data. If you believe a minor has an account, email us.
14. Data Protection Officer
Based on the volume and nature of the data we process, we are not currently required to appoint a Data Protection Officer under Amendment 13 to the Privacy Protection Law. Privacy questions are handled by Shai Atar at support@direct-ref.com.
15. Changes to this policy
If we change this policy in a way that materially affects your rights or how we use your data, we will email you and show a notice in the app at least 14 days before it takes effect. Minor clarifications take effect on publication. The effective date at the top always tells you which version you're reading, and we keep previous versions available on request.
16. Contact
Shai Atar and Anat Atar Lachmish, Israel