Privacy Policy

Overview

This Privacy Policy explains how Jobbi ("we", "us", "our") collects, uses, stores, and discloses personal data when you use our website and application (the "Service").

Jobbi is a job-tracking and productivity service. This policy applies to personal data processed through the Service, including account information, job-tracking records, uploaded documents, and data generated when you use AI-powered features.

By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

Jobbi is the data controller for personal data processed through the Service.

Contact: use the same support channel where you obtained access to this service.

2. Personal Data We Collect

We collect only the data reasonably necessary to provide, secure, and improve the Service.

2.1 Information You Provide

• Account information, including email address and login credentials (authentication is managed by Supabase).
• Profile and preference information, such as nationality, preferred locations, salary expectations, and preferred currencies.
• Job-tracking data, including saved jobs, statuses, descriptions, notes, tags, and cover letter text.
• Uploaded documents, including CVs, cover letters, and attachments.
• Support messages and other correspondence you send to us.

2.2 AI Evaluation Data

• Document text and job description text submitted for AI analysis.
• Evaluation outputs, including scores, recommendations, feedback, and timestamps.
• Evaluation history and cached results used to reduce redundant processing.

2.3 Automatically Collected Data

• IP address and approximate location derived from IP.
• Device type, browser type, and operating system.
• Authentication events, session events, and security events.
• Pages visited and feature usage patterns.

We do not collect precise GPS location for core Service operation.

2.4 Payment Data

Paid plan purchases are processed by LemonSqueezy. We do not store full card numbers or CVC codes. We receive limited payment metadata such as transaction identifiers, plan status, amount, currency, and payment status.

2.5 Third-Party Login Data

If you sign in using Google, we may receive basic profile information (such as name, email, and profile image) needed to provide account access. We do not receive your third-party provider password.

3. How We Use Personal Data

Service Operation

• Create and manage accounts.
• Provide job tracking, document storage, and workflow features.
• Deliver AI evaluations you request.
• Manage subscriptions, billing status, and plan limits.
• Provide user support and service communications.

Safety and Integrity

• Protect accounts and prevent abuse, fraud, or unauthorized access.
• Maintain security logs and detect suspicious activity.

Improvement and Analytics

• Measure feature usage and app performance.
• Improve reliability, usability, and product quality.

We do not sell your personal data and we do not use your data for third-party behavioural advertising.

4. Legal Bases for Processing (UK GDPR / GDPR)

We process personal data under one or more of the following bases:

• Contract performance: to provide the Service you request.
• Legitimate interests: security, fraud prevention, and service improvement.
• Legal obligation: where required by applicable law.
• Consent: where specifically requested (for example, optional analytics).

In practice, core account features, subscription management, and AI evaluations are primarily processed under contract performance; security monitoring and fraud prevention under legitimate interests; tax/accounting and compliance records under legal obligation; and optional analytics or similar non-essential tracking under consent.

5. Data Sharing

We share personal data only where necessary.

Service Providers

We use providers including Supabase, Vercel, Mapbox, Google Gemini, LemonSqueezy, and PostHog to operate the Service. These providers process data under contractual obligations and their own privacy terms.

Legal Requirements

We may disclose data where required by law, court order, lawful government request, or where necessary to protect rights, safety, or security.

Business Transfers

If the Service is sold, merged, or reorganized, personal data may be transferred as part of that transaction.

No Data Selling

We do not sell personal data or share it for third-party marketing.

6. AI Processing and Model Providers

When you request AI-powered evaluations, relevant document and job-description text is sent to Google Gemini for processing. This processing is used to provide the requested output and related product functionality.

AI outputs may be cached to reduce duplicate processing and improve responsiveness.

Third-party AI providers process data under their own terms and policies, and may retain limited service data in accordance with those terms and applicable law.

7. Data Retention

We retain data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

• Account and job-tracking data: retained while your account is active.
• Payment and subscription records: retained for audit and compliance purposes.
• Security and access logs: typically retained for up to 12 months.
• Support communications: typically retained for up to 24 months.
• AI evaluation cache and history: retained until deleted by you or your account is deleted.

We may delete or anonymise data when it is no longer required.

8. Data Security

We use reasonable technical and organisational safeguards, including encrypted transmission, access controls, authentication protections, and monitoring.

No method of transmission or storage is completely secure.

9. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to request portability where applicable.

You may also withdraw consent where processing relies on consent. We may need to verify identity before fulfilling rights requests.

10. UK and US Privacy Disclosures

UK residents may lodge complaints with the Information Commissioner's Office (ICO).

Residents of certain US states may have additional rights under applicable state privacy laws. We honor applicable legal requirements.

11. Cookies and Similar Technologies

We use cookies and similar technologies for authentication, session management, security, and (where consented) analytics.

PostHog analytics is consent-gated. If you decline analytics, tracking for analytics and session replay is not activated.

12. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal data from children under 16.

If we learn that personal data from a child under 16 has been collected, we will take reasonable steps to delete it.

13. International Data Transfers

Personal data may be processed in countries outside your place of residence, including the United Kingdom and the United States.

Where required, we use recognized legal safeguards for cross-border transfers.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes become effective when posted on this page with an updated effective date.

15. Contact

For privacy questions or rights requests, use the same support channel where you obtained access to this service.