Privacy Policy

Controller: the individuals operating the unregistered MolarJobs project in Georgia. MolarJobs is currently an unregistered project, not an LLC. Plans are paid by arrangement on WhatsApp and activated by hand; there is no online payment on the site. Small business registration is planned; it has not yet taken place. We will update our operator details and this Policy when it does. Privacy contact: support@molarjobs.ge, or use the Support page on the site.

We respond to privacy requests within the applicable statutory deadline, generally 10 working days. For information and access requests, a justified extension of up to 10 further working days may apply; we will notify you immediately if we use it.

Clinics that receive your application, CV or Revealed profile are separate, independent controllers of that data for their own recruitment; their processing is governed by their own obligations under the Data Protection Law and by Section 6 of our Terms.

Account data: name, surname, email address, password (stored only as a salted hash), or your Google account identifier, name and profile picture if you sign in with Google; language preference; role (professional or clinic); account status.

Professional profile data: professional type and role(s), specialty and areas of dentistry, city and preferred districts, age (optional), bio, education, experience, skills, career stage, job-search status and availability (including weekly availability slots and start date), schedule and compensation preferences, contact email and phone (optional), profile photo, CV (built in the Service), certificates, clinical case descriptions and photos, Talent Board listing and Boost status.

Verification data: documents you upload to prove professional status (diploma, certificate, student or residency confirmation), their type, our review decision and reason. These may reveal education and professional membership; we do not request or use health data of yours.

Clinic data: clinic name, address and map coordinates, city, phone, website, logo, gallery, description, specialty; team members, their roles and your relationship to the clinic; vacancies and branches.

Supplier data (Supplies section): shop name, logo, description, WhatsApp number, phone, branches, delivery terms and the product Listings with prices and photos. A Supplier’s shop page and Listings are public because the Supplier chooses to publish them. For each Listing we keep daily counts of views, adds to cart, and taps on “Order on WhatsApp”, “Call” and “Copy text”; the counts are not tied to a person, and only the Supplier whose Listing it is can see them. To limit abuse, your browser keeps a random visitor id and your cart; we do not take orders or payments.

Activity data: applications and cover notes, CV submissions, profile openings, saved and hidden posts, votes, reports, messages and their read status, interview and shift requests, calendar entries, shift outcomes and ratings, active days, response times, Professional Score events and adjustments, notifications, forum posts and comments, referrals and feedback.

Access records: selected plan, free or promotional access, access periods and limits, and listing or Boost status. Payment records: when you pay for a plan on WhatsApp we keep the amount, date, period and who activated it. The site does not collect card or bank-account details.

Technical data: IP address, browser and device information, timestamps and request logs kept by our hosting providers for security and diagnostics; the cookies described in Section 5.

Data about others: if you upload clinical images or write about cases, you must remove anything that identifies a patient (see Section 10 of the Terms). Patient-identifying data is not permitted; contact Support if you find it so we can remove it.

You provide most of this data yourself. Clinics supply recruitment responses, shift outcomes and ratings; other users may supply messages, votes and reports about content. Google supplies account details when you choose Google sign-in, and the Service generates activity and access records. Required fields and verification or profile-completion requirements are shown in the relevant form; without them the corresponding feature may be unavailable.

• To operate accounts, profiles, recruitment, messaging, calendar requests, free access and service notifications — performance of our agreement with you (Article 5(1)(b) of the Data Protection Law).
• To verify professional status and manage access to features — performance of that agreement and our important legitimate interest in reliable professional information (Article 5(1)(b) and (i)).
• To order listings, suggest vacancies and candidates, and recognise community contributions — our important legitimate interest in useful recruitment and community features (Article 5(1)(i)).
• To prevent abuse, moderate content, resolve support requests and defend claims — our important legitimate interest in a secure, reliable service (Article 5(1)(i)); a legal obligation applies where a specific law requires processing (Article 5(1)(c)).
• To review aggregate service statistics — our important legitimate interest in improving the Service. Marketing communications, if introduced, require your consent, which you may withdraw.

Automated matching uses your role, specialty, location and availability or schedule preferences. We also record active days, responses, shift outcomes, ratings and community activity and calculate a Professional Score. That score is currently hidden and is not used to order the Talent Board or schedule matches; its underlying records are still stored. Listing and application eligibility also depend on verification and profile completeness. These processes involve automated evaluation of profile and activity data (profiling). Clinics make their own hiring decisions. Contact Support to question an evaluation or request human review.

When we rely on legitimate interest, processing must be necessary and must not override your rights. You may raise an objection through Support as described in Section 8.

Visitors and search engines: clinic pages, vacancies, forum posts and comments (with author name, role and photo). If you enable your Talent Board listing, its public preview includes your first name and surname initial, blurred photo, role, specialty, city or district, career and experience indicators, availability, compensation preferences, and professional badges or response and rating indicators. This preview is not anonymous. It does not include your full surname, sharp photo, bio, CV, certificate files, case photos or contact fields.

Clinics with the required Talent Board access can see your full name and sharp photo within their access scope and open your full professional profile, CV, portfolio and weekly availability. A clinic can also receive your profile when you apply, send it a CV or accept its shift request. Applications and CV attachments go to the clinic you choose and may contain contact information. Talent Board access alone does not display your contact fields: clinics receive them when you explicitly share contacts in chat or accept a shift request; information you put into an application, CV or message is shared with its recipient.

Other professionals: your forum posts, comments and public profile fields; verified professionals can also see the professional directory (name, role, city).

Supplies section: a Supplier’s shop page, contacts and Listings are visible to everyone, including search engines, by the Supplier’s own choice. Per-Listing counts are visible only to that Supplier and to administrators.

Operators and administrators: access to account and activity records, verification documents and content for verification, moderation, support and access management.

Service providers: Convex — database, file storage, authentication and real-time backend; Vercel — website hosting and delivery; Resend — account and service email, receiving the recipient address and email content. Google receives sign-in requests if you choose Google sign-in. Map providers receive requests for tiles and location searches: your browser sends its IP address and the requested map area to OpenStreetMap, and our server sends address searches or coordinates to OpenStreetMap Nominatim. A provider may also process service-related technical data under its own terms and privacy policy; not every provider acts solely as our processor. There is no active payment-provider data flow.

Also: Cloudflare Turnstile checks that a person, not a bot, is sending the password-reset and sign-up forms; it receives your IP address and browser signals. Vercel Web Analytics counts page visits without cookies and without identifying you (page address, referrer, country, device type). If you switch on notifications, your browser’s push service (Google, Apple or Mozilla, depending on the browser) delivers them and receives the notification text. If you choose to message us or pay on WhatsApp, WhatsApp (Meta) processes that conversation under its own terms.

Authorities and others: where required by law, court order or a lawful request from a competent authority, to protect the rights, property or safety of MolarJobs, our users or the public, or in connection with a merger, acquisition or sale of the Service (with notice to you).

We do not sell personal data and do not share it with advertisers.

We use browser storage for sign-in tokens, return links, clinic invitations and referral codes; language and signed-in display preferences; local sign-up, onboarding, CV and forum drafts; feedback-prompt dismissals; and a marker that avoids recording the same active day repeatedly in a browser session. The language cookie is named mj_lang; mj_signed_in is a display hint, not proof of authentication. Some of this storage is necessary for sign-in; other entries support preferences and drafts.

Supplies: your cart (product ids and quantities) and a random visitor id that keeps one person from being counted many times stay in your browser only.

We do not use advertising, tracking or cross-site analytics cookies. Everything we store is needed for the site to work or was asked for by you, so no cookie banner is shown. Our page-visit counting (Vercel Web Analytics) sets no cookies. If we ever add optional tracking we will ask for your consent first and update this section.

Artificial intelligence: we do not use AI on your data today, and no automated decision with legal or similarly significant effect is made about you. The Professional Score described in Section 3 is a rule-based count, not AI. We will update this Policy before adding any AI feature.

You can delete cookies and site data in your browser at any time. Removing sign-in storage signs you out; removing draft storage can delete unsaved drafts. Clearing browser storage does not delete data already saved to your account.

The providers named in Section 4 operate internationally. Account data, uploaded files, emails and technical request data may be stored or processed outside Georgia, including in the United States and other countries used for hosting, email delivery and maps. To request information about storage locations and safeguards for a particular transfer, contact Support. International transfers must meet the Data Protection Law, including any required safeguards and authorisation; using a foreign provider does not by itself establish that these requirements are met.

Account, profile, recruitment, message, community, support and moderation records generally remain stored until you remove them through available controls or we handle a deletion request. These records currently have no fixed automatic expiry. Retention must be limited to what is needed for the account, ongoing recruitment or support, security, or another lawful purpose; switching off the Talent Board removes your listing but does not delete your account or prior applications.

Verification files are deleted when a review is approved or rejected. Files awaiting review or further information remain until the review is resolved or the document is removed. The review status, reason and date remain as account records; they do not have a three-year automatic deletion rule.

System monitoring events are scheduled for removal after 30 days. Hosting-provider logs and backups may have separate retention periods; contact Support for information about copies relevant to your request. We do not promise that deleting a live record immediately removes every backup or a recipient’s separate copy.

To close your account or request deletion, contact Support. We will assess the request within the legal deadline, explain any lawful need to retain specific data, and confirm the outcome. Clinics are responsible for handling data they retain independently, including applications or CVs you sent them.

Under the Data Protection Law you have the right to: obtain confirmation of whether we process your data and a copy of it; have inaccurate data corrected and incomplete data completed; have data deleted or destroyed, or its processing stopped, blocked or restricted, where the law provides; object to processing based on legitimate interest; withdraw consent at any time without affecting prior processing; receive data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible; not be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and be informed of a data breach that is likely to create a high risk to you.

Most of these you can do yourself: edit or delete profile fields, documents, cases and posts; switch the Talent Board off; close your account from account settings. To get a copy of your data in a portable format, write to Support; we send it within 30 days. For anything else write to the privacy contact in Section 1. We may ask you to confirm your identity. Requests are free unless manifestly unfounded or excessive.

You have the right to lodge a complaint with the Personal Data Protection Service of Georgia (pdps.ge, 7 Nino Ramishvili St., Tbilisi) and to apply to court. We would appreciate the chance to resolve your concern first.

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS) and at rest by our providers; salted password hashing; access to data restricted by role and enforced on the server for every request; administrator access limited to named staff; file access through short-lived links only after an access check; rate limiting and abuse monitoring; security headers; regular dependency updates; and backups. No system is perfectly secure, and you are responsible for keeping your password confidential and your devices secure.

If a breach of security leads to a risk to your rights, we will notify the Personal Data Protection Service within 72 hours of becoming aware and inform you without undue delay where the risk is high, as the Data Protection Law requires.

The Service is for adults working or training in dentistry. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

We will post any changes here and update the date at the top. For changes that affect how your data is used or shared, we will notify registered users by email or an in-app notice at least 14 days before they take effect. Where a change requires your consent, we will ask for it.