Privacy policy

Saison (joinsaison.com) matches seasonal workers ("seasonaires") with the establishments that hire them. This page explains what data the matching needs, where it lives, and what your rights are. The short version: we collect what the matching needs, we store it in the EU, and we don't sell it, run ads on it, or let marketing trackers near it.

Who is responsible

Saison is operated by its founder, Adil Tousbih, based in Belgium, who is the "data controller" in GDPR terms. For anything in this policy, whether questions, requests or complaints, email hello@joinsaison.com.

What we collect

• Account: your email address and password. Sign-in is handled by our authentication provider (Supabase); your password is stored in hashed form and we never see it.
• Profile: what you choose to add. For seasonaires the profile asks for the role you want, when you can work, whether you need housing, and your work rights. Name, photo, skills, languages, past seasons, and whether you are looking, hired or paused, are added when you choose. For establishments: name, type, location, season dates, housing offer, photos, and description.
• Activity: job postings, and applications including the message you attach.
• Sourced listings and outreach: facts taken from a public job posting, the link to that posting, and a business contact address published on the venue’s own site. The section “Sourced listings and venue outreach” is the detail, including how to ask us to stop writing or to take a listing down.
• Match scores: a 0 to 100 score computed from your profile and a job's requirements. This is derived from data you provided, and we don't collect anything extra to calculate it.
• Technical: our hosting providers briefly process your IP address and request data to deliver the site and keep it secure.

Why we're allowed to (legal basis)

• Running the service you signed up for (profiles, matching, applications) is performance of a contract (the terms you accept when you create an account).
• Keeping Saison secure and working is our legitimate interest.
• Writing to a venue about a public posting of theirs, at a business address from their own site, is also a legitimate interest. It is business-to-business, and the sourced-listings section is the limit on it.
• Anything genuinely optional relies on your consent, which you can withdraw at any time.

Where your data lives

The database runs on Supabase in the EU (Ireland). The website is hosted on Vercel, which delivers it through a global network. Both act as processors on our behalf. They store and serve data, they don't get to use it for their own purposes. Because Vercel's network is global, requests may transit outside the EU; Vercel commits to GDPR-standard safeguards (EU Standard Contractual Clauses) for any such processing.

We use Vercel Analytics: privacy-friendly, cookie-free, aggregate page statistics only. It cannot follow you across other sites. Opening a sourced role, or using Apply on the venue’s site, stores that job, the time, and a random id kept in this browser. Signing up, saving a profile or a role, and opening or using a claim link store the same kind of id, plus the source, medium and campaign from the link you arrived on when those were on it — not your IP address, and not a third-party tracker.

What we don't do

No advertising, no selling or renting data, no third-party marketing trackers. The only browser storage Saison uses is what's needed to keep you signed in, plus that random id for these counts and the campaign labels from the link that brought you.

Who sees your data

Being visible to the other side of the marketplace is the product: when you apply to a job, the establishment sees your profile, your message, and your match score. If an establishment makes you an offer and you accept it, it also receives your email address, plus your phone number if you've added one, so the two of you can arrange the season. An offer you haven't accepted shares nothing beyond your application. Who can open a seasonaire profile is your choice, and the next section is that choice. Open job postings, and the venue name and description beside them, are not limited to signed-in seasonaires. That is set out after the visibility settings. The only third parties that touch your data are the processors named above, unless the law compels us to disclose something, in which case we disclose only what's required.

A report or a block is stored for review and is not shown to the other person.

Who can see your profile, and how you control it

Your seasonaire profile has three visibility settings. You choose which, on your own profile page, and you can change it whenever you like. The default is the most private one.

• Venues on Saison — the default. Establishments signed in to Saison can see your profile. Nobody else can open it, including people with the link.
• Anyone with the link — the page opens for anyone holding its address, so you can send it as your seasonal CV. It is kept out of search engines, but treat it as shareable rather than secret: a page that opens without a login is not private, and we would rather say so than imply a guarantee we can't make.
• Public — as above, and search engines may list it, so people can find you by name. This one is worth a thought before you pick it. Search engines take time to remove a page after you change your mind, and we can't make that happen faster than they do.

None of these settings ever reveal your email address or phone number. Those are released only to an establishment that hires you, and only then.

Withdrawing a public profile. Setting it back to venues-only or link-only stops us serving it to anyone new straight away. It does not remove copies a search engine has already indexed or cached, and we can't reach into their systems to delete those. If a page is still showing in search results after you have changed the setting, email hello@joinsaison.com and we will file removal requests with the search engines on your behalf and tell you when each one confirms. You can also ask us to delete the profile outright, which is your right under the GDPR and which we act on the same way.

Open job postings are public. Anyone can read one without an account, and search engines may index the page. It shows the venue’s name, the resort, the role, and the facts that were stated (pay, dates, housing, and the rest). A role Saison found elsewhere also names where it was found and links to the original. A role that is not open is not on those pages.

An establishment’s name, type, resort, photos and description can be read without an account. That is how the database is set: the row is not restricted to signed-in seasonaires. The venue screen currently asks you to sign in before it draws a venue that has an account. That sign-in is not the privacy boundary. A venue that has not claimed an account has a short public page, so the listing can be found and, if it should not be here, removed. Outreach contact addresses are not on any of these pages. They sit in a private record that has no public read.

Seasonaire profiles are not in that public set. The three settings above are the whole of who can open yours.

Sourced listings and venue outreach

Some roles on Saison were not posted by the venue. Saison reads a public job posting, writes its own short summary, and shows the facts that posting stated. The page names the source and links to the original. Anything the original did not say is marked as not stated. These pages are public in the same way as a role a venue posts here.

To tell a venue that the listing exists, Saison may use a business contact address taken from that venue’s own public website, such as a published info@ or jobs@ address, or the address printed on the page. This is business-to-business contact about a role the venue is already advertising. The legal basis is legitimate interest: letting the venue know, and offering them the chance to claim the listing, correct it, or ask for it to come down. These addresses are not used to advertise anything unrelated to that listing, and they are not sold.

Prospect data means the contact address, the notes of an outreach attempt, and the unclaimed claim link for that venue. We keep unused prospect data for 12 months from the last contact or the last check, and then delete it.

If you do not want to be contacted, email hello@joinsaison.com and say so. We will not write to that venue again. The same address is how you ask for a listing to be removed, or for the prospect record to be deleted. You can also use “Remove this listing” on a sourced role, or on the page of a venue that has not claimed an account. That hides the listing while we review it. The notice goes to hello@joinsaison.com. It is not sent to the venue. The request stores a hash of the network address so the form can be rate-limited, not the address itself. We aim to answer within a month, and sooner when the listing is still public.

How long we keep it

Account data stays for as long as the account exists. Delete your account and your data goes with it: profile, applications, messages, and scores. To request deletion, email hello@joinsaison.com and we'll confirm when it's done. We only keep something longer if the law requires it. Prospect data for a venue that has no account is a different clock: 12 months from the last contact or the last check, as the section above describes.

Your rights

Under the GDPR you can ask to access, correct, delete, or receive a copy of your data, and to restrict or object to how it's used. Email hello@joinsaison.com and we'll respond within a month. If you're not happy with how we handle it, you can complain to the Belgian Data Protection Authority or the supervisory authority in your own EU country.

A note on match scores

Scores are computed automatically, but they only rank and inform. Every hiring decision on Saison is made by a person, never by the algorithm.

This policy may be updated as Saison evolves. The date at the top always reflects the current version, and meaningful changes will be announced on the site.