Job Sources

Who we are

Xadaro helps people tailor their CV to the jobs they apply for. Signed-in users can also see job matches: new jobs scored against their profile and the search they have told us about. To find those jobs, we read the public feeds that employers publish through their applicant tracking systems.

Every request we make to a job feed sends a User-Agent that names Xadaro and links to this page. The current User-Agent is Xadaro/0.1 (+https://xadaro.com/job-sources).

What we fetch

We fetch public job listings from employers’ own feeds on Greenhouse, Lever, Ashby, and Personio. A feed holds the listings that an employer’s applicant tracking system publishes without a login. Each listing links to the employer’s own posting.

We fetch each feed on a schedule, no more than once a night. Users can also ask us to check for new jobs sooner. Such a check fetches a feed again only if our last fetch of it was more than 6 hours ago.

Every request we make to a feed follows the same rules, including the requests we make when a user tailors a CV, described below. We send no more than one of those requests per second to each host. We follow the host’s robots.txt, including any rules written for Xadaro, and never request a path it disallows. When it sets a Crawl-delay, we wait at least that long between requests.

The feeds receive nothing about our users. No feed request carries who a user is or what they searched for.

We never store a job that its feed marks as unlisted, and a job that becomes unlisted is treated as one that has left its feed. When a job leaves its feed, it stops appearing in Xadaro after our next fetch. We delete our copy of it 60 days later. If we have not been able to read a feed for 14 days, its jobs stop appearing in Xadaro too, and we delete our copies 60 days after that.

What signed-in users see

When a job fits a signed-in user’s search, they see its title, company, location, employment type, salary if the listing gives one, and when it was posted. They also see up to the first 600 characters of the description, cut at a word. An explanation written by AI tells them how well the job fits their profile and search.

In their matches, users see no more of a description than that excerpt. To read the rest, or to apply, they follow a link to the employer’s own posting.

When a user tailors a CV

A user can choose to tailor a CV to one of their matches. When the description we hold for that job is complete and long enough to use, we tailor from it and send no request. Otherwise, we ask the job’s feed for that job again, provided we still fetch that feed every night.

Where the feed can return a single job, we request that job alone. Where it cannot, we fetch the whole feed again. The request follows the rules set out under What we fetch. It does not depend on when we last fetched the feed, and we do not retry it if it fails.

If we cannot ask the feed, the request fails, the feed no longer lists the job, or its text is still too short, we tailor from the description we already hold, as long as there is enough of it. We do not write what the feed returns into our stored copy of the listing.

Tailoring never opens the employer’s own posting page. A user can still add a job to Xadaro themselves by giving us a link to its page, and we offer that route when we cannot tailor a match. When they do, we open that page in a headless browser on our servers to read the job. That visit does not send the Xadaro User-Agent, is not paced, and is not checked against robots.txt, even when the page is served from the same host as a feed. A page that fails to load is tried again.

What we send to our AI provider

Our AI provider is OpenAI. We send it listing text in two cases. Our Privacy Policy says more about what it receives.

To score how well a job fits a user’s profile and search, we send the listing’s details and the first 800 characters of its description.

When a user tailors a CV to a job, we send the job’s description: the text we hold, or the text its feed returned for that tailoring. That text is then saved in the user’s own account, as a job they added themselves would be.

What we do not do

We never apply to a job on anyone’s behalf. Every application goes to the employer through its own posting.

We do not sell or license listings to anyone. Listings are not published on our website. Only signed-in users see them, and only the jobs that fit their search.

We do not use listing text to train AI models.

People named in a listing

A listing’s text can name a person, for example a recruiter or a hiring manager. We get it from the employer’s public feed, not from that person, and telling each one would take disproportionate effort, so under Article 14(5)(b) of the UK GDPR we publish this notice instead. We keep the name only as part of the listing, show it only to users whose search the listing matches, and send it to OpenAI with the rest of the description when we score the listing, and again when a user tailors a CV to it. Our basis is legitimate interests: showing job seekers the listing as the employer published it. We delete the name with the listing 60 days after the listing closes. If a user tailored a CV to the listing, its description stays in that user’s account until they delete it.

Anyone named in a listing can ask us to remove or correct it, using the contact form or by emailing hello@xadaro.com. You can object, and we remove the name unless we have a strong reason to keep it. You can also complain to the Information Commissioner’s Office (ICO), the UK regulator.

How an employer can opt out

To stop Xadaro fetching your jobs, tell us through the contact form or by emailing hello@xadaro.com. Include a link to your careers page or to one of your jobs, so we can find the right feed. If you use the form, any reply goes to the email address you give us there.

When we act on your request, we stop fetching that feed, including for tailoring, and close all of its listings at once. Users no longer see them as matches. We delete our copies 60 days later. A job that a user has already tailored a CV to stays in that user’s account.

A user can still paste a link to one of your jobs into Xadaro, and we open that page as described above. We do not start fetching your feed again because of it.

Your feed is served from your applicant tracking system’s domain, so its robots.txt is set by that provider rather than by you. The contact form is how you opt out.