Privacy Policy

This policy describes how the Company handles personal information in Jobician (the "Service"). The panel above says who the Company is and which law governs this document.

A resume is unusually revealing: name, contact details, employment history, education, sometimes nationality or a photograph. Please read Section 4 before uploading anything you would not want processed by an external AI provider.

1. WHAT WE COLLECT

1.1 Because You Give It to Us

(a) Account — email address, and a one-way hash of your password. We never store the password itself. If you sign up or sign in through a third-party identity provider we offer (such as Google), we receive your email address and basic profile from that provider instead of a password;

(b) Profile — display name and, if you upload one, an avatar;

(c) Resume content — the files you upload (PDF resumes, LinkedIn exports), a LinkedIn profile URL you ask us to import and the public profile data fetched from it (Section 4), the structured resume data extracted from any of those, everything you type into the builder, and the resumes, cover letters and application answers generated from them;

(d) Job applications you track — the postings you save and the status you give them;

(e) Contacts you provide — if a feature asks you to provide information about other people (for example, references, or your own exported connections), we process it only to provide you that feature;

(f) Application correspondence — if you use an email feature (Section 4.3): mail received at a Service-provided tracking address you chose to hand out, or, if you connect an email account of yours, the messages the feature is scoped to read. Correspondence naturally includes the sender's information (a recruiter's name, address and message); we process it as part of your application tracking and for nothing else;

(g) Support correspondence — whatever you write to us.

1.2 Because Using the Service Produces It

(a) Sign-in and device history — timestamps, IP address, browser and device description, and an approximate location derived from the IP address, kept so you and we can spot access you do not recognise;

(b) Usage records — which tools you ran, when, and how many credits they spent, including a record of each AI request (its size, cost and outcome);

(c) Agreement records — when you accept the Terms at signup, we keep a receipt of exactly which document versions were offered and accepted, when, and from where (IP address and browser description), so both of us can later prove what was agreed;

(d) Technical logs — ordinary web-server and application logs, and self-hosted, cookie-less page analytics (Section 6).

1.3 Because You Pay Us

Billing records — a customer identifier from our payment processor, subscription and purchase state, and receipts. Card numbers go directly to the processor; they never reach our servers.

We do not buy personal information about you from data brokers, and we do not sell it.

2. WHY WE USE IT

(a) To run the features you ask for, and to show your own content back to you;

(b) To keep your account secure and to investigate abuse, fraud and attacks;

(c) To meter credits and take payment;

(d) To send service email: confirmation, password reset, receipts, security notices, and account changes;

(e) To keep the Service working — debugging, capacity, and fixing what breaks.

3. BOT PROTECTION

Sign-up, sign-in and the public tools are protected by Cloudflare Turnstile, which receives your IP address and challenge data to decide whether a submission is automated.

4. AI AND IMPORT PROCESSING

4.1 AI Processing

The checker, the import step, the builder's rewrites and the application tools work by sending the relevant content to an external AI provider (Anthropic) over its API, which returns the output you asked for. In practice this means the text of your resume, and the job posting you paste in, leave our servers and are processed by that provider for as long as it takes to answer.

We send the minimum a feature needs, we do not send your email address or password with it, and we do not use your content to train models of our own. We do not control the AI provider's own processing; if that matters to you, read its terms before uploading.

Scores and findings are produced automatically. They have no legal effect and are not a decision about you — they are suggestions on a document you control.

4.2 LinkedIn Profile Import

If you give us a LinkedIn profile URL to import, we send that URL to a data provider (Enrich Layer), which returns the profile's public data — the information LinkedIn shows to the world. We do not ask for your LinkedIn password, we never sign in to your account, and we only receive what is public. Import a profile only if it is yours or its owner asked you to (see the Acceptable Use Policy).

4.3 Email Features

If we offer email features and you use them:

(a) A Service-provided tracking address receives whatever is sent to it. We store those messages, show them to you, and may process their content automatically — including through the AI provider in Section 4.1 — to detect application status (interview, rejection, offer) and link messages to the applications you track;

(b) A connected inbox is accessed only with your explicit authorization, only within the scope the feature describes when you connect it, and only to provide the feature. You can disconnect at any time from your settings or at your email provider, which ends our access. We do not use your mailbox for advertising, and we do not read correspondence beyond the feature's scope;

(c) If you connect a Google account, our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements;

(d) Status classifications are automated, best-effort suggestions with no legal effect — the message itself is always available to you, unchanged.

4.4 Browser Extension

If we offer a browser extension and you install it:

(a) It reads and processes page content only on pages where you invoke it — for example, a job posting or application form you ask it to work on — and only to provide the feature: recognizing the form, filling it from your Content, and linking the posting to your tracked applications. It does not collect your browsing history, does not read pages you did not invoke it on, and does not sell or share what it sees;

(b) Its use and transfer of information adheres to the applicable browser store's user-data policies (for Chrome, the Chrome Web Store User Data Policy), including their Limited Use requirements;

(c) You can uninstall it at any time, which ends its access entirely.

5. WHO ELSE SEES IT

5.1 Service Providers

We use these providers to run the Service. Each gets only what its job requires:

Provider	What it handles
Anthropic	resume and job-posting text sent for AI generation (Section 4)
Enrich Layer	the LinkedIn profile URL you submit for import, returning its public data (Section 4)
Stripe	payments, subscriptions, receipts
Amazon Web Services (SES)	outbound service email
Cloudflare (R2, Turnstile, network)	file storage, bot protection, traffic
Backblaze B2	encrypted off-site database backups
MaxMind	IP-to-approximate-location lookup for the sign-in history
Our hosting provider	the servers the Service runs on

We also send ourselves operational alerts about errors and unusual activity through a private internal channel; those can include an account identifier.

5.2 Content You Publish

If you choose to publish something through the Service — for example, a hosted public profile or a shareable resume URL — that material is public by your choice: anyone with the link can see it, and search engines may index it. Unpublishing stops us serving it, but copies others already made are outside our control.

5.3 Recipients You Choose

If you enable a feature that sends materials somewhere at your direction — for example, submitting an application you approved to an employer or its applicant-tracking system — the materials you approved go to the recipient you chose, and from that moment are handled under the recipient's own practices, which we do not control.

5.4 Aggregated and De-identified Data

We may create, use and publish statistics derived from use of the Service in a form that does not identify you or any person — for example, aggregate scoring benchmarks. De-identified data is kept de-identified.

5.5 Everything Else

Beyond that we disclose personal information only when the law requires it, when it is needed to protect the Service or someone's safety, or as part of a sale or reorganisation of the business — in which case this policy continues to apply until it is replaced and you are told.

6. COOKIES AND ANALYTICS

We set a session cookie so you stay signed in, and a "remember me" cookie if you ask for one. Turnstile sets what it needs to run the challenge. We do not run third-party advertising or cross-site tracking cookies.

For page analytics we run Umami on our own infrastructure: it counts page views and referrers, sets no cookies, does not fingerprint you across sites, and no third-party analytics company receives anything.

7. KEEPING AND DELETING

Your content stays until you delete it or close your account. Closing your account from your account settings deletes your account and the content attached to it, including resumes, uploads, analyses, tracked applications and stored application correspondence; a Service-provided tracking address stops receiving, and any connected-inbox authorization ends.

Two things outlive that on purpose:

(a) Billing records, which we and our payment processor keep for as long as tax and accounting rules require;

(b) Encrypted database backups, which are kept on a rolling window and then expire. Deleted content can persist in a backup until that window passes.

8. YOUR CHOICES

(a) See and change your account details, and close your account, in your account settings;

(b) Review and sign out your active devices from your session history;

(c) Export any resume as a PDF at any time;

(d) Ask us for a copy of your data, a correction, or deletion by writing to the privacy address below. We will ask you to confirm you control the account before acting.

Service email (confirmations, receipts, security notices) is part of having an account and cannot be unsubscribed from while the account is open.

9. SECURITY

Traffic is encrypted in transit. Passwords are stored only as bcrypt hashes. Access to production data is limited to the people who operate the service. Databases are backed up off-site and encrypted. No system is perfectly secure; if a breach affects you, we will tell you.

10. CHILDREN

The Service is not directed at children. Do not use it if you are under 16, and do not upload a child's information. If we learn we hold information about a child we will delete it.

11. WHERE PROCESSING HAPPENS

The Company and the providers listed in Section 5 operate in several countries, including the United States. Using the Service involves transferring your information to those countries, which may have different data-protection rules from yours.

12. CHANGES

We may update this policy. The date at the top of this page is when it last changed. If a change materially affects how we handle your information, we will tell you by email or in the app before it takes effect.

Questions, or a request about your data, go to the privacy address below.