Privacy policy · Datenschutzerklärung

Short version: without your consent our pages set no cookies and load no advertising tags. In the free test, your answers stay in your browser; only an anonymous score and time are sent so we can calculate percentiles. We count visits with Jetpack Stats from Automattic, our host (see 3d). If you click Accept in our banner, we also load Meta’s and Google’s advertising tags to measure our ads. You can change your choice at any time with Privacy choices in the footer.

1. Who is responsible (Verantwortlicher)

The controller under the GDPR for remotelyscaled.com is: M. Subedi, Johanneskirchner Str. 101, 81927 München, Germany, email hello@remotelyscaled.com. See also the Impressum.

2. Summary

• Without consent: no cookies, no advertising tags. Your light/dark mode choice (rs-theme) and the sign-up box state (rs-su, 14 days) are kept in your browser's local storage and never sent to us.
• Your consent choice is stored in local storage (rs-consent, 12 months). This is strictly necessary to respect your choice (§ 25(2) No. 2 TDDDG).
• No external fonts.
• Visits are counted with Jetpack Stats (see 3d). WordPress.com may set technically necessary cookies for people who log in to WordPress.com itself, for example the site owner in the admin area.
• Your email address is processed only if you subscribe to job emails or the newsletter, join a waitlist, buy a membership, test or career service, bought a digital download in the past, or use the cancellation and withdrawal forms.
• About two days after you subscribe to our job emails or newsletter, we send you one follow-up email about our resume, cover letter and 1:1 services (see 4). You can unsubscribe with the link in it.

2a. Consent banner

On your first visit we ask whether we may use advertising technologies. Accept necessary only and Accept all are equally prominent; Settings lets you switch marketing on or off on its own (strictly necessary storage is always on). Until you decide, nothing optional is loaded. You can change or withdraw your choice at any time via Privacy choices in the footer. Withdrawing deletes the Meta and Google cookies set on our domain (_fbp, _fbc, _gcl_*). Our banner is our own code; no consent-management provider receives your data. Legal basis for storing and reading information on your device for these optional purposes: your consent, § 25(1) TDDDG. For the processing that follows: Art. 6(1)(a) GDPR.

If your browser sends Global Privacy Control or Do Not Track, we treat that as a refusal: we don't offer Accept, and no advertising tags load.

3. Hosting and server logs

This website is hosted by WordPress.com. For visitors in the EU, the provider is Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland, together with Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA (source: Automattic privacy policy, checked 27 Oct 2026). The domain name and our email mailbox are managed by Hostinger, Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (source: Hostinger terms of service, checked 27 Oct 2026). Emails you send us are stored in that mailbox; Hostinger does not host the website. When you visit, the host’s servers automatically process technical data your browser sends: IP address, date and time, page requested, referrer, browser and operating system. This is needed to deliver the site and keep it secure. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Automattic states that it keeps server logs for about 30 days. Automattic processes this data on our behalf under its Data Processing Agreement, an amendment to the WordPress.com Terms of Service. For transfers to the USA, Automattic relies on the EU Standard Contractual Clauses.

3b. Embedded exchange-rate widget (other websites only)

None of the pages on remotelyscaled.com load exchange rates. One older widget that other websites can embed (/embed/currency-converter/) loads the European Central Bank reference rates directly from the Frankfurter API (api.frankfurter.dev), an open-source service. Like every web request, this reveals the visitor’s IP address to that service, but not the amounts typed. Frankfurter states that it does not collect or log personal data, IP addresses or request URLs (checked 27 Oct 2026). Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in showing current rates in that widget.

3c. Advertising

We show no ads on this site. We do advertise this site on Meta (Facebook/Instagram) and Google. To find out which ads lead to sign-ups and purchases, we use the tags described in 3f and 3g, only with your consent.

3d. Visitor statistics (Jetpack Stats)

To see how many people visit which pages, we use Jetpack Stats, a service of Automattic, our host (see 3). When a page loads, your browser loads a script from stats.wp.com, which sends a request to pixel.wp.com. According to Automattic, Jetpack Stats uses your IP address, user agent, the page visited, the referring page, the time, browser language and country code. It records page views, clicks on links to other sites and the search terms that led here, and measures page-load performance across Jetpack sites in aggregate. We only see aggregated figures, for example how many views a page had; we cannot see IP addresses or who visited. Automattic keeps stats logs containing IP addresses for 28 days and uses them only to provide the statistics (source: Jetpack privacy documentation, checked 27 Oct 2026). Automattic’s documentation lists no visitor cookie for this feature; see Automattic’s cookie policy for its cookies in general.

If your browser sends a Do Not Track or Global Privacy Control signal, our pages do not load the statistics script. You can also block stats.wp.com and pixel.wp.com with a content blocker. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing which pages are used so we can maintain and improve them. Transfers to the USA rely on the EU Standard Contractual Clauses as described in 3.

3e. Aptitude and psychometric tests

Anonymous test scores (v1.4.20). When you finish a test we store only the test, your score, the number of questions, the time you took, the question-set version and the date, to work out percentiles for future results; no name, email, IP address, browser details or other personal data is stored with it. Your Job Readiness progress is kept only in your browser’s local storage.

Buying a paid practice test. Payment is handled by Stripe (Stripe Payments Europe, Ltd. and, where Stripe acts as the seller of record, its affiliates) under Stripe's own privacy policy. Stripe sends us a checkout reference. When you open the page after checkout, our server asks Stripe whether that checkout was paid and for which test. We store a one-way hash of the checkout reference, the product, amount and currency, the payment reference, the time you confirmed that access starts now, and how many attempts you used. We use the email address from your checkout once, to send your access link and the confirmation of your request for immediate access, and when you ask us to resend the link; we do not store it in our purchase records.

Past digital download purchases. We no longer sell downloads. For past digital download purchases, the same applies: on the /download/ page our server asks Stripe whether the checkout was paid and for which product. We store a one-way hash of the checkout reference, the product, amount and currency, the payment reference, the time you confirmed that the download may start now, and how many times each file was downloaded (up to 10 per file). We use the email address from your checkout once, to send your personal download link and the confirmation of your request, and when you ask us to resend it; we do not store it in our purchase records.

Taking a paid test. To score an attempt we store its start time and deadline and, after you submit, your answers and your score (or, for the psychometric test, your work-style profile), for 2 days. Your browser keeps an access token and your last result in local storage so you can come back to them. No tracking cookies are set by the test feature.

Technical data. To prevent abuse we count requests per IP address for up to an hour; the IP address is stored only as a hash in temporary storage and deleted automatically.

Legal basis and retention. Performance of the contract you bought (Art. 6(1)(b) GDPR), our legal obligations for the payment records (Art. 6(1)(c)) and our legitimate interest in preventing abuse (Art. 6(1)(f)). Purchase records are kept for as long as the law requires us to keep payment records. Not a validated assessment: these are practice questions written by us; results, including the work-style profile, are not used for any automated decision and are not shared with employers.

Free 10-question test. The free cognitive test runs in your browser. Your answers stay in your browser; only an anonymous score and time are sent so we can calculate percentiles. That anonymous record holds only what is listed under “Anonymous test scores” above. Your last score is also kept in this browser’s local storage (key rs-ft-last) so you can see it next time; clear your site data to delete it.

3f. Meta Pixel and Meta Conversions API (only with consent)

Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may also be processed by Meta Platforms, Inc., USA.

What happens: after you accept, your browser loads Meta's Pixel. It records that you viewed a page and, when it happens, that you signed up for job emails ("Lead") or bought a membership or service ("Purchase", with the product and, where known, the price in EUR). The Meta Pixel is a marketing cookie: it only loads if you choose Accept, and withdrawing consent stops it and deletes its cookies. Meta processes your IP address, browser data, the page URL, the event and an event ID, and may set the cookies _fbp (90 days) and _fbc (90 days, only if you arrived from a Meta ad). If you are logged in to Facebook or Instagram, Meta can link the event to your account.

Conversions API: if you accepted, then when you sign up we also send the same "Lead" event from our server to Meta. It contains your email address hashed (SHA-256, so Meta receives only the hash), your IP address and browser user agent, the event ID and the Meta click identifier if present. This makes measurement more reliable when ad blockers interfere. If you did not accept, nothing is sent.

Purpose: measuring and optimising our ads. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Joint controllership: for collecting and transmitting the data to Meta, we and Meta are joint controllers (Art. 26 GDPR). The essentials of our agreement are in Meta's Controller Addendum (facebook.com/legal/controller_addendum). Meta is responsible for the further processing. You can exercise your rights against either of us. USA transfer: Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR); otherwise SCCs apply. Meta's policy: facebook.com/privacy/policy.

3g. Google Ads conversion tracking and Consent Mode (only with consent)

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC, USA.

What happens: after you accept, your browser loads Google's tag (gtag.js) for Google Ads. It records whether you arrived via a Google ad (click identifier gclid/gbraid/wbraid) and whether you then signed up or bought a membership or service (with the price in EUR where known). It may set _gcl_au and _gcl_aw cookies (90 days). We use Google Consent Mode v2 in "basic" mode: without your consent the Google tag is not loaded at all, and no cookieless pings are sent.

Purpose: measuring our ads. We do not use Google Analytics, remarketing audiences or ads personalization on this site. Legal basis: consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. USA: Google LLC is DPF-certified; Google Ads Data Processing Terms / Controller-Controller Terms apply. Google's policy: policies.google.com/privacy. How Google uses data from partner sites: policies.google.com/technologies/partner-sites.

4. Job emails, newsletter and waitlists

If you sign up for our job emails (for example the free weekly digest) or join a waitlist, we process your email address, the list you joined, and the optional preferences you choose, such as a remote region or job category. We use double opt-in: you only receive emails after confirming via a link we send. To prove consent, MailPoet records the time of sign-up and confirmation and the IP address used to sign up and confirm. If you close the job-alert box on the homepage or sign up there, your browser’s local storage remembers this for 14 days so the box does not show again; this stays in your browser and is not sent to us.

MailPoet. We manage these lists with MailPoet, an email plugin by Automattic that runs inside our WordPress site. Your email address, list and preferences are stored in our WordPress database, hosted by Automattic (see 3). Our emails, including the confirmation email, are sent through the MailPoet Sending Service, also part of Automattic, which processes your email address to deliver each email and keeps logs of sent emails for up to 3 months. According to MailPoet, the delivery infrastructure is located in the USA; transfers rely on the EU Standard Contractual Clauses under Automattic’s Data Processing Agreement, which covers both MailPoet and WordPress.com (source: MailPoet knowledge base, “Data Collected and Stored by MailPoet”, checked 29 October 2026).

Email opens and clicks. We measure whether our emails are opened and which links in them are clicked, using MailPoet on our WordPress site. We do this so we can stop emailing people who aren’t reading and see which job emails are useful. This happens only inside our emails (MailPoet’s “partial” tracking setting); it sets no cookies and adds no tracking to our website. Legal basis: our legitimate interest in sending only emails that are wanted and in keeping our list healthy, Art. 6(1)(f) GDPR. Subscribers who haven’t opened any of our emails for about 3 months are automatically marked inactive and stop receiving them. You can unsubscribe at any time with the link in every email.

To protect the sign-up form from abuse, our server briefly keeps one-way hashes of your IP address and of the email address entered (for up to one hour) to limit the number of sign-up attempts. These hashes are not stored with your subscription and are deleted automatically.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw consent at any time with the unsubscribe link in every email or by writing to us. Withdrawal does not affect processing before it.

We keep your data until you unsubscribe, then delete it or keep only what is needed to respect your opt-out. If you join Pro or Ultra, we also add your email address to a members list in MailPoet so we can send your plan emails.

Campaign attribution. When you sign up, we store which campaign brought you here: the utm_source, utm_campaign and utm_content values from the link you followed, the page you signed up on, and, if present, an ad click identifier (gclid/fbclid). These are saved with your subscriber record in MailPoet so we can see which campaigns bring useful subscribers. On the page where you land, the values are only kept in memory. If you accepted the banner, they are also kept in your browser's session storage (rs-attr, deleted when you close the tab), so they still count if you sign up on a later page. We also note whether you had accepted advertising consent at sign-up. Legal basis: Art. 6(1)(f) GDPR (our interest in knowing which channels work). You can object at any time by emailing us. We delete the values with your subscription.

Pro and Ultra payments via Stripe. The Pro and Ultra buttons open a Stripe-hosted checkout page. Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland), and for transactions under Stripe Managed Payments Stripe's Link service as merchant of record, process your payment details under their own privacy policies (stripe.com/privacy, link.com/privacy). Where Link is merchant of record, it is responsible as controller for the payment, the receipt, tax calculation and payment support. We never see your full card number. Stripe passes us your name, email address, billing country, the plan, payment and subscription status. We use these to provide your membership: the daily email, adding you to the members list in MailPoet, the account page and the cancellation function. If you accepted the banner, our purchase page passes a campaign reference to Stripe (client_reference_id, e.g. "meta__launch__ad3") so we can attribute the purchase. We keep payment records as long as tax and accounting rules require (up to 10 years, § 147 AO / § 257 HGB). Legal basis: Art. 6(1)(b) and (c) GDPR. Stripe transfers data to the USA under the DPF/SCCs.

Other newsletter forms on this site that still say “Newsletter launching soon” send nothing and do not store what you type.

4b. Career services (orders and booking)

Paid orders via Stripe. The Book & pay buttons on /services/ and /book/ open a Stripe checkout page. Stripe processes the payment as described for payments in this section. At checkout we ask for your name, email address and a few details we need to deliver the service: for calls and the career bundle your target role or field, your time zone and what we should cover; for written services your target role, a LinkedIn or portfolio link and any deadline. Stripe passes these to us with the order. We use them only to deliver the service you bought: to send you the order confirmation and next steps, to agree a call time by email, and to prepare the call or the written work. Our team inbox (hello@remotelyscaled.com) receives a copy of each order. Legal basis: Art. 6(1)(b) GDPR (contract). Payment and invoice records are kept for as long as tax and accounting rules require; the order details stored on our site are deleted after 3 years.

You can also book or ask by email; we then process your message as described in section 5. If we offer online booking (the Book online button on /book/), we use Cal.com, Inc. (USA). When you book there, Cal.com processes your name, email address, the chosen time, your time zone, any answers you give in the booking form and, for paid bookings, the payment via Stripe. You receive confirmation and reminder emails from Cal.com. The call takes place on the video tool named in your booking confirmation. Legal basis: Art. 6(1)(b) GDPR. Cal.com processes data on our behalf under its data processing agreement; transfers to the USA rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Booking records are kept for as long as tax rules require for paid services, otherwise 12 months.

Documents you send us for a CV or cover-letter review are used only for that service and deleted 90 days after delivery, unless you ask us to keep them longer.

Follow-up email after sign-up. About two days after you subscribe to our job emails or newsletter, we send you one email (from hello@remotelyscaled.com) about our resume and cover letter services and the 1:1 session. We send it once, using the email address and sign-up time stored in MailPoet, and keep a record that it was sent so you do not get it twice. Legal basis: the consent you gave when you subscribed (Art. 6(1)(a) GDPR), which you can withdraw at any time. It contains an unsubscribe link; if you unsubscribe, you get no further emails from us.

4c. Cancellation and withdrawal forms

If you use Cancel contracts here (/cancel/) or Withdraw from contract (/withdraw/), we process the details you enter (name, email, contract, date, type of cancellation), the time of receipt and a one-way hash of your IP address (abuse protection). We use them to carry out your request and to send the legally required confirmation email. Legal basis: Art. 6(1)(b) and (c) GDPR. We keep them for 3 years (the limitation period for claims) and then delete them.

4d. Featured role orders (employers)

When a business buys a featured role, Stripe passes us the company name, the link to the role and the contact email entered at checkout, with the order details. We use them to set up the placement and to contact you about it. Legal basis: Art. 6(1)(b) GDPR. Order and payment records are kept for as long as tax and commercial rules require.

5. Contact by email

If you email us, we process your message and address to reply. Legal basis: Art. 6(1)(b) GDPR where it concerns a contract or pre-contract request, otherwise Art. 6(1)(f). We delete correspondence when it is no longer needed, unless legal retention periods apply.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)): via Privacy choices (advertising tags) or the unsubscribe link (emails). You also have the right to complain to a data protection supervisory authority, for example the one where you live or the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

7. External links and tips

This site links to official sources and other websites. Their privacy policies apply once you follow a link. Apart from the visitor statistics in 3d and, with your consent, the advertising tags in 3f and 3g, we load no content from other sites in the background (the embeddable widget in 3b is not part of our own pages).

Payments via Stripe. Buy buttons for memberships, practice tests and career services open a Stripe checkout page. Stripe processes the payment as described in section 4. To deliver what you bought we process your email address, what you bought and when, and keep the order record as long as tax and accounting rules require. The same applies to past digital download purchases.

8. Storage on your device (overview)

9. Visitors from the United States and Canada

• US (including California): we do not sell personal information for money. Using Meta and Google advertising tags can count as "sharing" for cross-context behavioural advertising under California law. We only do this when you click Accept, and we honour Global Privacy Control as an opt-out (no tags load). To opt out later, use Privacy choices in the footer, which works as our "Do Not Sell or Share My Personal Information" link. You can ask to know, correct or delete your data by emailing hello@remotelyscaled.com. We will not discriminate against you for using these rights. We do not knowingly collect data from children under 16.
• Canada: we only send marketing emails with your express consent (double opt-in, CASL). Every email identifies us, gives our mailing address and has an unsubscribe link that we act on within 10 business days. Quebec residents: optional tracking is off unless you turn it on. Questions about our privacy practices: hello@remotelyscaled.com (person in charge: M. Subedi).
• Your data is stored and processed in the EU and the USA as described above.

10. Changes

We update this policy when the site changes. Version 2.6, 4 Nov 2026 (featured role orders from employers, 4d). Previous version 2.5, 1 Nov 2026 (we no longer sell downloads: section 4 and 7 wording for past digital download purchases). Previous versions 2.4 (1 Nov 2026, free test: anonymous score and time for percentiles, 3e; section 3b now covers only the embeddable exchange-rate widget), 2.3 (30 Oct 2026, career service orders via Stripe and the follow-up email after sign-up, 4b), 2.2 (30 Oct 2026, digital downloads), 2.1 (29 Oct 2026, email open and click measurement), 2.0 and 1.0 (27 Oct 2026) available on request.