Edge of Bliss GDPR Compliance
Effective Date: September 23, 2025
Applies to Users in the EEA, UK, and Switzerland (and anyone interacting with EU/UK/CH personal data).
Contact: privacy@edgeofbliss.com | support@edgeofbliss.com
Plain-English Summary
We are the controller for the Edge of Bliss platform and a processor for certain employer-provided candidate data.
Legal bases include: Consent (analytics in EEA/UK), Contract (core features & job applications), and Legitimate Interests (safety/fraud prevention & basic operations).
Data may be transferred to the U.S.: we use SCCs (+ UK/Swiss Addenda) and, where applicable, the EU-U.S. Data Privacy Framework.
You can access, correct, delete, export, or object via privacy@edgeofbliss.com or in-product tools.
Who We Are & Roles
Controller: Edge of Bliss, Inc., 30 N Gould St, Suite 40107, Sheridan, WY 82801, USA
Email: privacy@edgeofbliss.com
Role Split
- Controller: candidate accounts/profiles, forums, messaging, events, platform analytics.
- Processor to Employers: when processing candidate data on their instructions (e.g., delivering applications, resume search logs, event leads).
EU/UK Representatives (GDPR Art. 27)
To be appointed. We will publish contact details for our EU and UK representatives here once appointed. Until then, contact privacy@edgeofbliss.com.
What We Collect & Why
Candidates (End Users)
- Identity & account: name, email, phone (optional), city/region.
- Career data: resume/CV, work history, eduction, skills, portfolios.
- Platform activity: messages, forum posts, job views, search terms, event interactions.
- Billing (if you upgrade: payment tokens/IDs via Stripe, invoices (no full card stored by us).
- Security & abuse prevention: we minimize routine IP/device data but may collect/store IPs and device identifiers strictly for security/fraud detection (e.g., attempted hacks).
- We do not collect special-category data (e.g., health, religion) and we prohibit posting it unless sctricly necessary for a legitimate job function.
Employers/Business Users
- Organization profile, job posts, ATS links, recruiter messages, resume searches, event leads, billing/admin contacts.
Lawful Bases (By Purpose)
| Purpose | Legal basis | Notes / Controls |
|---|---|---|
| Account creation & core features (profiles, messaging, forums) | Contract | Necessary to deliver your account and features. |
| Job applications & delivery to Employers | Contract | We process/apply using your submitted materials. |
| Safety, fraud prevention, service integrity | Legitimate Interests | Minimal data (incl. security IP logs) to detect abuse; users can object where appropriate. |
| Product analytics / diagnostics (EEA/UK) | Consent | GA4 fires only after consent via CookieCompliance; no ad pixels. |
| Transactional emails (receipts, critical notices) | Contract / Legal obligation | Sent without marketing content. |
| Marketing to non-customers | Consent | Unsubscribe anytime. |
| Payments & tax | Contract / Legal obligation | Stripe processes payment data. |
| Virtual job fairs / events | Contract + Legitimate Interests | Running booths, chats, and lead capture with clear notices. |
| AI assistance (resume help / matching) | Legitimate Interests | Human-in-the-loop; transparent logic and opt-out options. |
We maintain brief Legitimate Interests Assessments (LISa) for safety, analytics, and AI assistance.
Cookies, Analytics & Signals
- Consent banner: CookieCompliance. Categories: Strictly necessary, Analytics, Functional. No advertising pixels.
- GA4: runs only with consent in EEA/UK; IP addresses not stored; Google-signals disabled regionally.
- Sessoin replay (Lucky Orange): disabled by default in EEA/UK unless consented to Functional/ANalytics; input masking enabled; never records payment fields.
- Global Privacy Control (GPC): treated as withdrawal of consent for non-essential cookies/analytics in EEA/UK.
International Transfers
- We are U.S.-based (Google Cloud US).
- For EEA/UK/Swiss data transferred internationally we use: EU Standard Contractual Clauses (2021), UK Addendum (or IDTA), and Swiss Addendum.
- Where a vendor participates, we also rely on the EU-U.S. Data Privacy Framework.
- We perform Transfer Impact Assessments (TIAs) for higher-risk transfers and document safeguards.
AI & Profiling Transparency (Arts. 13-22)
- No automated decisions with legal or similarly significant effects.
- Profiling for matching/ranking: factors include skills, role tags, recency, and stated preferences; we explain factors and allow opt-out where feasible.
- Model training: we train our own assistive models on de-identified/aggregated data. EU/UK users may object (profile setting: “AI training opt-out”). We do not train third-party foundation models on user content.
Sub-Processors & Vendors (Current List)
| Vendor | Purpose | Region(s) | Transfer mechanism |
|---|---|---|---|
| Stripe | Payments & billing | US/EU | SCCs; DPF participation where applicable |
| Google Cloud Platform (GCP) | Hosting, backups | US | SCCs; DPF where applicable |
| SiteGround | Web hosting / ancillary | US/EU | SCCs |
| Google Analytics 4 | Analytics (EEA/UK consent-gated) | EU/US | SCCs; GA4 EU processing |
| CookieCompliance | Consent management | EU/US | SCCs |
| Lucky Orange | Session replay (consented or disabled in EEA/UK) | US | SCCs |
| OpenAI | AI services (assistive features) | US/EU | SCCs / DPF where applicable |
| Google Gemini | AI services | EU/US | SCCs / DPF where applicable |
| Anthropic | AI services | US/EU | SCCs |
Change notice: We update this table and notify subscribers 30 days before adding or replacing a sub-processor. Subscribe at privacy@edgeofbliss.com.
Security (High-Level)
Encryption: TLS 1.2+ in transit; AES-256 at rest.
Access control: SSO/MFA for admins, role-based access, least privilege, audit logs.
Secure SDLC: code review, dependency scanning, secrets management, change control.
Monitoring & vulnerability management: alerts, patching cadence, periodic pen-tests.
Incident response: 24/7 on-call; isolate/contain; investigate; notify regulators within 72 hours when required and affected users without undue delay.
Retention
| Data | Retention |
|---|---|
| Accounts (candidates & employers) | Kept until you delete your account. |
| Messages & forum posts | User-controlled deletion; backups roll off in ~30 days. |
| Job posts & employer logs | Until role closure + 12 months. |
| Security logs (incl. IPs for incident analysis) | 12 months by default; longer if required for investigations. |
| Analytics data (GA4) | 12 months (EEA/UK consent-gated). |
| Cookie consent logs | 12 months. |
| Moderation records | 180 days (longer if on legal hold). |
| Backups | Rolling 30/30 (30-day retention; restore within 30 days). |
We apply storage-limitation: where feasible we delete or aggregate/anonymize older operational data, and retain longer only for legal holds or to resolve security incidents.
Your Rights (EEA/UK/CH)
- You can request access, correction, deletion, restriction, portability, or objection to certain processing (including analytics and our model-training).
- Withdraw consent at any time (does not affect prior processing).
How to exercise your rights:
- In-product: Settings > Privacy & Data > Manage My Data” (coming soon).
- Email: privacy@edgeofbliss.com (use the email on your account).
- Verification: We verify your logged-in session or a confirmation email to your account address.
- Timing: We respond within 30 days (may extend to 60 for complexity; we’ll notify you).
- Complaints: You can lodge a complaint with your local supervisory authority. We will list our EU/UK representatives and their supervisory authority once appointed.
Children
Edge of Bliss is 18+ only. We don’t knowingly collect children’s data.
Controller-Processor DPA (for Employers)
- Scope & nature of processing: recruiting ops; candidate submissions; analytics relating to employer accounts.
- Your instruction: we act only on documented instructions.
- Confidentiality: staff bound by confidentiality and access controls.
- Security: measures summarized above; detailed annex attached.
- Sub-processors: listed in the table; 30-day advance change notice + right to object.
- International transfers: EU SCCs (2021/914) Module 2/3 as appropriate; UK Addendum (orIDTA) for UK transfers; Swiss Addendum for Swiss data.
- Assistance: with DSARs, incident notifications, DPIAs/consultations.
- Deletion/return: upon termination, delete or return personal data; limited retention for legal obligations/backups.
- Audits: reasonable assistance; third-party attestations where available.
