Privacy policy

In brief

COLLABme connects project owners, companies, educational institutions, and talents. To do this, we process personal data: the data you provide (profile, applications, messages), data generated by your use of the platform — including the website, web apps, and mobile app — (interactions, navigation events), and data from services you choose to connect (Google, LinkedIn, your calendar). If you accept, we also share key milestones of your journey with Google and Meta to measure the platform's audience and the effectiveness of our advertising campaigns.

Three principles guide this policy: we only collect what serves the service, we never sell your data, and you remain in control — visibility of your profile, consent to audience measurement and advertising measurement, optional connections, and account deletion at any time via your settings. One exception, which we prefer to state explicitly rather than leave you to discover it: our mobile app measures its own startup times and counts launches without asking for permission. These measurements do not identify you or track what you do; the section "Why we use your data" explains the basis for this.

Who is responsible for processing?

The publisher of COLLABme, identified in the legal notices, is responsible for processing the data described in this policy. For any questions, email us at info@collabme.be.

Special case: within an organisation’s workspace (member management, team structure, recruitment, onboarding), the organisation decides the purposes — it acts as the data controller and COLLABme as the data processor, hosting and securing the data on its behalf. To exercise your rights over this data, contact your organisation first; we assist them in responding.

The data we collect

Depending on the features you use, we process the following categories of data:

• Account and login — email address, first name and last name, avatar, preferred language. Login is passwordless via a link sent by email or through Google or LinkedIn (we then receive your identifier, name, email and profile picture from these services).
• Profile and facets — displayed name, public handle (@handle), profile and cover photos, title, bio, skills, experiences, education, sector, contact phone, contact email, address and location you declare, daily rate, availability, as well as facet-specific information (student, freelancer, teacher, employee, investor, project owner). We never collect your device location: the location is the one you enter.
• Date of birth (required) — requested at the first registration step and required for older accounts before proceeding: it allows us to apply protections for minors (legal guardian consent, exclusion from certain measurement tools). It is self-declared, never displayed on your public profile, and once recorded, can only be modified by our support team upon a motivated request with a trace of the correction.
• Content and interactions — posts, comments, reactions, polls and votes, reviews, skill recommendations, connections and subscriptions, favourites, event participation.
• Applications — your cover letter, the facet you apply with, and the compatibility score calculated (see the section on AI).
• Messaging and calls — the content of your messages, including voice messages and their attachments, your reactions, your online presence status and the original language of messages (for translation when reading). For audio and video calls, we only keep a record — who called whom, when, and for how long — and, when a call fails or degrades, a technical report on the connection (setup delay, relay use, cause of failure): never the audio or video.
• Organisation workspace — your role and position, department and reporting line, post approvals, interviews and onboarding paths.
• Financial data — the private activity log of your freelance facet (clients, amounts, invoice and payment status), the declarative log of your investments, your displayed rates. If you subscribe to a paid plan, payment is handled by our provider Stripe: we never store your card number, only a customer reference and subscription events.
• External calendar (optional) — if you connect Google Calendar or Microsoft Outlook, we store encrypted access tokens, your availability (free/busy slots) and, for your personal use only, your calendar events.
• Verifications — school email address (the verification code is stored in hashed form), certificates and diplomas issued by institutions or companies, and, for minors, the name and email of the legal guardian who gave consent.
• Technical and usage data — product events collected first-party across the whole platform, mobile app included (screens and pages viewed, actions taken such as applying, publishing, searching, sharing or switching facet), with no IP address kept, no search text, no message content and no full page address — the identifiers it contains are replaced before sending —, linked to an anonymous identifier created only after your consent; if you consent to audience measurement, anonymised journey recordings and heatmaps (clicks and scrolling on web, gestures and screens displayed on mobile), with input fields and conversations masked before recording; push notification subscriptions (technical address of the browser or device and user-agent); and an IP address processed ephemerally, in memory, solely to protect against abuse — it is never stored in the database.
• Advertising measurement (with your consent) — your consent choice, specific to each surface (website and web apps on one hand, mobile app on the other), and, depending on this choice, the identifiers deposited by Google and Meta tags in your browser (Google Analytics ID, Meta _fbp and _fbc IDs, Google ad click ID); and the technical description of your browser (user agent). In the mobile app, the installation ID assigned by Firebase and, if you accept advertising measurement (and, on iPhone, tracking), the advertising ID of your device, read by the Meta SDK. What we transmit to Google and Meta is detailed in the "Audience measurement and advertising measurement" section.
• Mobile app technical measurements — app startup and screen display durations, number of launches, app version, device type and OS version, as well as the domain name of the slowest network service at startup. These measurements contain neither your identity nor the content of your screens, nor what you type, nor the full addresses of pages visited — single-use codes received via link (invitation, email address confirmation, parental consent) are removed before any transmission. They are linked to a technical installation ID, unique to the app and separate from your account, which remains as long as the app is installed. Unlike audience measurement, these do not depend on your consent: see the next section.

Why we use your data

Each processing activity is based on a lawful basis under the GDPR:

• Providing the service (contract performance) — creating and managing your account, displaying your profile, publishing your content, sending your applications, routing your messages, operating organisation spaces, processing subscription payments.
• Connecting users (contract performance) — calculating suggestions and compatibility scores between profiles and opportunities, based on your profile content and listings.
• Securing the platform (legitimate interest) — preventing abuse and fraud, rate limiting, handling reports, moderating flagged content.
• Communicating with you (contract performance) — login emails, activity-related notifications, responses to your requests.
• Service e-mails related to your account (legitimate interest and contract execution) — a welcome e-mail, sent only once when you complete your registration; reminders related to your account status (complete your registration, submit a first application, publish a first listing, process pending applications…), no more than two per seven-day period; a weekly summary (compatible listings and profile views for a student, pending applications for a company, promotion activity for a school). Reminders for students are never sent to a minor account or to an account whose birth date has not been declared; other reminders are never sent to an account identified as a minor. The student summary is also never sent to a minor account or to an account whose date of birth has not been declared, unless the legal guardian has confirmed consent; company and school summaries are never sent to an account identified as a minor. You can opt out at any time, with a single click, using the unsubscribe link at the bottom of each of these e-mails, or by contacting us.
• Propose you to companies (with consent) — if you are a student, of legal age, and you yourself activate the setting “Propose my profile to companies by email” (never activated by default), your profile may appear in a weekly selection sent by e-mail to companies with an open listing that matches you, provided it is public and displays #DISPO. The company sees your displayed name, your title, the city in your #DISPO, three skills, and your compatibility with their listing, with a link to your profile — never your e-mail, phone number, address, or photo. You are not proposed to an organisation you are a member of or have already applied to, nor to someone with whom a block exists, and not to the same company more than once every 56 days. You can withdraw this consent at any time in your notification settings.
• Measure and improve (consent) — audience statistics and usage analysis (our own statistics, PostHog, Microsoft Clarity, Google Analytics, including Firebase in the mobile app), only if you accept them via the "Audience measurement" checkbox in the consent banner.
• Measure and optimise our advertising campaigns (consent) — identify which ads on Google and Meta (Facebook, Instagram) lead to sign-ups, applications, or offers, and adjust their delivery, only if you accept the "Advertising measurement" checkbox in the banner (or "Accept all") — and, in the mobile app on iPhone, if you also allow tracking in Apple’s window. You can withdraw this consent at any time; withdrawal does not affect the legality of processing carried out before it.
• Connecting third-party services (consent) — external calendar, CollabCoach assistant: each connection is optional and revocable.
• Measuring the performance of our mobile app (legitimate interest) — knowing how long the app takes to start and display a screen, how often it is launched and on which versions, so we can fix slowness and errors. These measurements are not used for advertising or profiling, nor are they linked to your profile. You can object by writing to us (see ‘Your rights’); on your device, the only way to stop them is to uninstall the app.
• Complying with legal obligations — retaining payment records for accounting and tax purposes, responding to legally valid requests from authorities.

Matching, AI and automated decisions

The core of COLLABme is a matching engine: the content of your profile and opportunities is converted into digital representations (embeddings), then a language model assesses compatibility between a profile and an opportunity. This processing is carried out by our provider Mistral AI, based in the European Union. The score obtained is indicative: it helps to sort and suggest, it does not make any decisions.

When an interview is being prepared, the platform can generate separate preparation guides for the recruiter and the candidate, based on the profile and the listing. Messages in the chat can be translated when read into your language; the message text is then sent to the AI provider solely for this translation. The CollabCoach assistant only acts when you enable it, and each of its actions is logged in a reversible and auditable journal.

No decision producing legal effects on you or significantly affecting you is made entirely automatically under Article 22 of the GDPR: accepting or rejecting an application always remains a human decision made by the recruiter. If you believe a score or suggestion is unfair, contact us: a human will review your case.

Audience measurement and advertising measurement (Google, Meta)

With your agreement, we measure platform usage with Google Analytics and the effectiveness of our advertising campaigns on Google and Meta (Facebook, Instagram). Three methods coexist: tags loaded in your browser (Google Analytics and Meta pixel on the showcase site and business space), development kits (SDKs) integrated into the mobile app (Google Firebase Analytics and Meta SDK), and server transmissions (Google Analytics Measurement Protocol, Meta Conversions API), which relay key steps in your journey wherever they occur — website, web apps, or mobile app. Here is exactly what is transmitted and under what conditions:

You can withdraw your consent at any time, as easily as you gave it: on the website, via the "Manage my cookie preferences" button in the cookie policy (link at the bottom of this page); in web apps, in your settings, under "Privacy"; in the mobile app, in Settings → Privacy. On iPhone, you can also withdraw tracking permission in iOS settings: Settings → Privacy & Security → Tracking. Withdrawal stops future transmissions, including those queued in our sending queue. It does not retrieve what has already been sent: for this data, see "Your rights".

• Events — from your browser: page views, clicks on a sign-up button, registration steps, viewing or sharing a listing, starting an application or posting, searches (that a search occurred, never the entered text), starting a subscription payment. From our servers: account creation, completion of registration, profile activation, posting a listing, application, internship proposal, scheduled interview, accepted internship, creating an organization, joining a school cohort, subscribing to a paid plan, submitting a « Founding companies » application.
• Parameters of these events — your audience (e.g., student or company), your main facet, city and domain associated with your arrival on the platform or the relevant listing, source, medium, and campaign that brought you here, the app used, type of listing, organization, or subscription, the ID of the viewed listing or joined cohort, and for certain steps, a conventional value used to optimize campaigns (this is not an amount you pay).
• Technical identifiers — to Google: the Google Analytics cookie ID (client_id) or, if unavailable, a technical ID calculated from your internal ID, and your internal COLLABme ID (user_id), which is neither your name nor your email address. To Meta: Meta cookie IDs (_fbp, and _fbc if you arrived via a Meta ad), the technical description of your browser (user agent), and the URL of the originating page.
• Matching data, for Meta only — your email address, your phone number if provided, your internal ID (external_id), and the city associated with the event, normalised and hashed (SHA-256) on our servers before any transmission. Meta does not receive these values in plain text but can compare them to fingerprints calculated the same way for Facebook or Instagram accounts it holds, to link the step to an ad: hashing is therefore pseudonymisation, not anonymisation. The city is also listed in plain text among the event parameters. This data is only sent with your consent to advertising measurement — and, if you use the app on iPhone, your tracking permission — and only if we also know you visited the website or a web app: for users who only use the mobile app, our servers send nothing to Meta, and only the app’s SDK measures usage, without email or phone. Google does not receive email or phone.
• What our servers never transmit — your name, your IP address (our servers do not read it for this measurement), the content of your messages or applications, your search text, your workspace data, and the contact details entered in the « Founding companies » form. When tags load in your browser, it connects directly to Google and Meta servers, which then receive your IP address and technical device information as with any web connection, and process them according to their own rules.
• Your consent, category by category — the "Audience measurement" checkbox in the banner controls Google Analytics; the "Advertising measurement" checkbox controls the Meta pixel, Meta Conversions API, and Google’s advertising use of data (Consent Mode v2: without this agreement, Google counts the step without using it for advertising). Until you respond, nothing is loaded or transmitted: lack of choice is never considered consent. Our servers re-read your choice at the time of each transmission, and a refusal expressed on one surface (website and web apps, mobile app) overrides others. In the mobile app, the same logic applies to SDKs: audience measurement controls Firebase Analytics, advertising measurement controls the Meta SDK (and Firebase’s advertising use of data); on iPhone, a tracking permission refused in Apple’s window counts as a refusal for Meta, including for server transmissions.
• Minors — our servers do not transmit anything to Google or Meta for a minor account, nor for an account whose birth date has not been declared. Browser tags never load for an account identified as a minor, and mobile app SDKs (Firebase Analytics, Meta SDK) never start for a minor account or an account with unknown age. On the showcase site, which you can visit without logging in, we do not know the visitor’s age: tags depend only on the choice expressed in the banner.
• Only recent transmissions — an event older than 72 hours is never transmitted.
• Mobile app SDKs — Firebase Analytics (Google) receives, under your internal COLLABme ID and an installation ID specific to it, the screens you view (the screen name, never its address) and the same events as browser tags; it does not read your device’s advertising ID. The Meta SDK receives these same events, key steps viewed in the app, and automatic events (installation, app opening), without your name, email, or phone. Both are delivered deactivated: they only start after your consent, and withdrawal stops them — Firebase then deletes measurement data kept on the device.
• On iPhone, Apple’s tracking permission (App Tracking Transparency) — if you accept advertising measurement, the app then asks you once to "Allow Tracking". Without this permission, Meta receives nothing, neither from the app nor from our servers. If you grant it, the Meta SDK can read your device’s advertising ID (IDFA). You can withdraw this at any time in Settings → Privacy & Security → Tracking, or withdraw advertising measurement in the app (Settings → Privacy).
• On Android, where this window does not exist, your consent to advertising measurement in the app is sufficient; the Meta SDK can then read your device’s Android advertising ID. You can withdraw this consent in the app (Settings → Privacy) and reset or delete this ID in Android settings.

Who sees what

• Your profile (display name, photo, title, skills, city, public content) is visible to other users. Your full address, if provided, is never shown to others: only the city appears, and the address is solely used to calculate distances to suggest nearby opportunities. Your published freelance showcases are also visible to non-logged-in visitors and may be indexed by search engines; you choose whether to publish your showcase or not.
• Private profile: you can make your profile private in your privacy settings. Your posts will then only be visible to your accepted connections, only they can view your full-size photo, and your public page will no longer be indexed by search engines. Your name, thumbnail photo, and title remain visible so you can still be recognised and receive connection suggestions.
• Selection for companies: only if you have activated it in your settings (student of legal age, public profile displaying #DISPO), a company recruiting may receive by e-mail your displayed name, your title, the city in your #DISPO, three skills, and your compatibility with their listing — never your contact details or photo. A minor account or one whose birth date has not been declared is never proposed.
• Your applications are only visible to the recipient organisation. The interview guide generated for the recruiter is not shown to you, and vice versa.
• Your messages are only visible to participants in the conversation. Our teams do not access them unless a participant reports a message: the moderation team then only sees a limited window around the reported message, reconstructed from the reporter’s perspective.
• In an organisation space, your team data (role, position, department) is managed by the organisation and by the people it authorises.
• Your private logs (freelance activity, investments) are never visible to other users.
• Ghost mode removes the notification sent when viewing a profile; the view is still recorded technically, and reciprocity applies.

Who we share your data with

We do not sell your data. We only share it with service providers who help us operate the service, each limited to their specific purpose:

• Mistral AI (European Union) — matching calculation, interview guide generation, message translation upon reading, CollabCoach assistant. This is our sole AI provider.
• Brevo (European Union) — sending login e-mails, transactional e-mails, and service e-mails related to your account (welcome, reminders, weekly recaps), as well as profile selections sent to companies.
• Stripe — payment and subscription processing, VAT calculation, invoices, and client portal.
• Google — login to your account (if you choose to) and Google Calendar (if you connect it).
• Google Ireland Limited (Google Analytics, and Firebase Analytics in the mobile app), with your consent — audience measurement and, if you accept advertising measurement, measurement of our campaigns (see "Audience measurement and advertising measurement"). For audience measurement, Google processes the data on our behalf as a data processor, under its data processing terms. For certain uses — notably advertising, when you have consented — Google may also process them on its own behalf, under its own rules.
• Meta Platforms Ireland Limited (Meta pixel, Conversions API, and mobile app Meta SDK), with your consent to advertising measurement — and, on iPhone, your tracking permission — measurement and optimisation of our campaigns on Facebook and Instagram. For the collection of this data and its transmission to Meta, COLLABme and Meta act as joint controllers; Meta is then solely responsible for the processing it carries out on its own behalf, as described in its privacy policy.
• Microsoft — Outlook calendar (if you connect it) and, with your consent to traffic measurement, Microsoft Clarity: heatmaps and anonymized journey recordings on the website, web apps, and mobile app. This tool is never activated for accounts identified as minors.
• LinkedIn — login to your account (if you choose to); additionally, an opportunity may be published on the COLLABme LinkedIn page after human validation, never your profile.
• PostHog (hosted in the European Union) — product usage statistics, only after your consent.
• Our hosting provider (European Union) — server hosting, database, file storage, and backups.
• Expo (United States) — technical measurement of our mobile app: startup and navigation durations, number of launches, app and OS versions. No content, messages, or account identifiers are transmitted.
• Cloudflare — relay for audio and video calls (TURN server), when your devices cannot connect directly: it routes encrypted streams without being able to read them, and sees the IP addresses of connected devices.
• Your browser’s notification services (Google, Mozilla, Apple) — delivery of push notifications you have enabled.
• Public authorities — only on legally valid requests.

Transfers outside the European Union

Our servers and database are hosted in the European Union, and our main AI and email providers are European. Some providers (Stripe, Google, Microsoft, LinkedIn) may process data in the United States: these transfers are governed by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses. Microsoft Clarity, when you consent, processes session recordings outside the European Union under this same framework. Mobile app technical measurements are processed by Expo in the United States. Cloudflare’s call relay operates from its global network under this same framework.

Google Analytics (including Firebase) and Meta: the measurement data received by Google Ireland Limited and Meta Platforms Ireland Limited may be transferred to their parent companies in the United States (Google LLC and Meta Platforms, Inc.), which adhere to the Data Privacy Framework; their contractual terms also include standard contractual clauses. Our servers send Google Analytics events to a collection point in the European Union, which does not exclude subsequent processing in the United States.

How long we retain your data

• Your account and its content — as long as the account exists. Deleting your account, available in your settings, will immediately erase your profile, your posts, your listings, your applications, your reviews, the accounts you follow and those that follow you, your favourites, your notifications, your advertising measurement data and your login access. It does not erase everything: messages already sent remain in your contacts' conversations, the organisations you created continue to exist without you, and some technical traces are not yet automatically deleted — contact us for a complete deletion. Data already shared with third parties (Google, Meta, Microsoft) follows their own retention periods.
• Usage event data (first-party analytics) — 13 months, automatically purged daily.
• Journey recordings and heatmaps (Microsoft Clarity) — kept by Microsoft under its own retention policy, then deleted. We keep no copy of them on our servers.
• Mobile app technical measurements (Expo) — retained by Expo according to its own retention policy. We do not keep any copies on our servers.
• Consent choices and advertising measurement identifiers — stored on our servers as long as your account exists, updated with each visit, cleared when you withdraw consent, and deleted with your account.
• Sending queue to Google and Meta — each detected step waits there until it is sent (usually a few minutes, never more than 72 hours); the entry, which keeps the sending status for our tracking, is automatically deleted 90 days after its creation.
• Google Analytics and Meta cookies — the _ga cookie is limited to 13 months; the _fbp and _fbc cookies are kept for 90 days, a duration set by Meta (see the cookie policy). The data received by Google and Meta, including via mobile app SDKs, is retained by them under their own rules.
• Login sessions — approximately 30 rolling days; temporary tokens (magic link, email change, OAuth) expire between 15 and 60 minutes.
• Notifications — deleted 24 hours after being read.
• Messaging — for the duration of the conversation, including voice messages: a voice message is kept and deleted like other messages. The encryption key for a conversation can be destroyed, making its content permanently unreadable.
• Audio and video calls — neither audio nor video is recorded or stored. The record of a call (participants, start, end) is deleted 12 months after the call ends, and technical connection reports after 90 days. The call mention displayed in the conversation (e.g. "Call · 4 min") is a message, kept like any other.
• Payment traces — retained after account deletion, for the duration of our accounting and tax obligations.
• Reports and moderation logs — for as long as necessary to process and evidence our due diligence.

How we protect your data

All communications are encrypted in transit (TLS). Messaging content and attachments are encrypted at rest, with a unique key per conversation — the platform holds these keys to enable service features (translation, search, reporting): this is not end-to-end encryption, and we are transparent about it. Access tokens for your calendar are encrypted.

Audio and video calls connect directly between devices or via Cloudflare’s relay when the network requires it; they are encrypted between devices (WebRTC DTLS-SRTP protocol), and the relay only sees encrypted data. Our servers simply connect the devices: they never receive audio or video, and do not record the technical exchanges that establish the call.

Our team’s access to data is strictly limited to what is necessary: since August 2026, messaging is no longer viewable from our back office — only a message reported by a participant can be reviewed, within a limited window. The database is subject to automated encrypted backups within the European Union.

In the event of a data breach likely to pose a risk to your rights, we will notify the supervisory authority within 72 hours and inform you directly if the risk is high, in accordance with Articles 33 and 34 of the GDPR.

Your rights

You have the rights provided by the GDPR: access, rectification, erasure, restriction of processing, objection, portability, withdrawal of consent at any time, and the right to set directives for the handling of your data after your death.

Most rights can be exercised directly on the platform: your profile can be updated in your settings, account deletion is available and takes effect immediately (within the limits described in the section 'How long we keep your data'), consent for audience measurement and advertising measurement can be withdrawn from the Cookie Policy page, from the web app settings (Privacy section) and from the Settings → Privacy screen in the mobile app. For the rest, email us at info@collabme.be — we respond within one month.

For data shared with Google and Meta, you can contact us; you can also exercise your rights directly with Meta for data for which we are joint controllers with it, and with Google or Meta for processing they carry out on their own behalf, according to their privacy policies. Withdrawing your consent stops future sends; we cannot, on our side, delete an event already received by Google or Meta.

If you believe your rights are not being respected, you can file a complaint with the Data Protection Authority (APD), rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be — or with the supervisory authority in your country of residence.

Minors

COLLABme welcomes students, some of whom may be minors. Registering a minor requires the consent of their legal guardian: we collect the guardian’s name and email address for this purpose, and certain actions — such as applying to an opportunity — remain blocked until consent is confirmed. The guardian can withdraw consent at any time by emailing us. The profile photo of a minor account, or of an account whose birth date has not been declared, can never be displayed in full size by other users.

Session recording tools and heatmaps are never enabled for an account identified as a minor, including in the mobile app, regardless of the choice expressed in the consent banner. The same applies to advertising measurement: Google and Meta tags never load for a minor account, Firebase Analytics and Meta SDKs in the mobile app never start — nor for an account with unknown age — and Apple’s tracking window is never shown; our servers send nothing to these platforms for a minor account — nor for an account whose birth date has not been declared. These exclusions rely on the birth date declared at registration: it is mandatory, but not verified, and an incorrect date disables them.

Via e-mail, an account identified as a minor never receives reminders, and an account whose birth date has not been declared does not receive reminders intended for students. A minor account or an account with an unknown age only receives the weekly student summary if the legal guardian has confirmed consent, and is never suggested to companies in profile selections.

Changes to this policy

We may update this policy to reflect changes in our service or regulations. The last update date is shown at the top of the page. In the event of a significant change — new purpose, new recipient, new data category — we will notify you via the platform or by email before it takes effect.

Contact us

For any questions about your personal data or to exercise your rights: info@collabme.be. The full contact details of the publisher are available in the legal notices.