Privacy policy
Template: not legal advice
This page is a starting template. It describes what the software does, but it has not been reviewed by a lawyer and must not be published until a qualified lawyer has reviewed it and every highlighted placeholder has been replaced.
Effective: [EFFECTIVE DATE]
1. Who we are
JobFinder is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] ("we"). We decide why and how your personal data is used (we are the controller). For anything in this policy, write to [DATA PROTECTION CONTACT EMAIL].
This policy is written to be read in any country. Where the Nigeria Data Protection Act 2023, the GDPR or the UK GDPR applies to you, the rights in section 8 apply as those laws provide.
2. What we collect and why
| Data | What it is | Why (legal basis) |
|---|---|---|
| Account | Email address; a salted password hash (never your password), or your Google account identifier if you sign in with Google; whether your email is verified; the time and version of your AI consent. | To run your account (contract); to prove your consent (legal obligation). |
| Profile and preferences | Name, headline, location, phone, links, years of experience, seniority; target titles, locations, work modes, salary expectations, sponsorship needs, excluded companies and industries. | To find and rank jobs for you (contract). |
| CVs | The PDF or DOCX files you upload, the structured content read from them, and numeric search vectors derived from that content. | To parse, match and tailor (contract; and your consent for the AI processing in section 4). |
| Your work in the product | Jobs you saved, hid, viewed or applied to; match scores and explanations; tailored CVs, cover letters, screening answers and application packs; generated PDF and DOCX files; your application tracker, notes and reminders; interview preparation and mock-interview answers and feedback; saved searches. | To provide those features (contract; consent for AI processing). |
| Your email settings, a log of the emails we sent you (digests, alerts, reminders) and the unsubscribe state. | To send what you asked for (contract); you can switch it off at any time. | |
| Billing | Your plan, subscription status and reference numbers at the payment provider, your credit ledger, and a record of each AI call made for you (feature, model, token counts, cost; never its content). We never see or store your card details: they go to the payment provider. | To charge and to apply credits (contract); to keep our accounts (legal obligation, legitimate interest). |
| Technical | IP address and request counts, held for a short time to limit abuse; server logs and error reports with emails, phone numbers and tokens removed, plus a request identifier. | Security and reliability (legitimate interest). |
We do not sell your data, and we do not use it for advertising or to build profiles for others. We collect job listings from public job boards and employer career pages; those listings are about jobs, not about you.
3. Cookies and similar storage
We use one cookie, to keep you signed in, and nothing else is stored in your browser for tracking. We use no analytics or advertising cookies. See the cookie notice.
4. AI processing and your consent
Reading a CV, scoring jobs against it, tailoring a CV, writing a cover letter, preparing interview questions and similar features send the relevant text (your CV content, your profile and preferences, the job description) to AI model providers who process it for us (see the subprocessors). The AI model only drafts: tailoring is checked so that it cannot add employers, titles, dates or qualifications you do not have, and you approve every change.
We ask for your consent to this when you create an account. Without it no AI feature runs for you and no CV can be uploaded. You can withdraw consent at any time in Settings, Privacy and data; the AI features stop at once. Withdrawing does not delete what is already stored: delete it, or your account, there.
We use the providers' business API terms. [TRANSFER MECHANISM, e.g. standard contractual clauses] [CONFIRM, with each provider's current terms, that submitted content is not used to train its models and how long it is retained.]
5. Who receives your data
Only the providers that help us run JobFinder, each bound by a data processing agreement (list): AI model and embedding providers, payment providers, email delivery, hosting and storage, and error reporting. Google receives a sign-in request if you use Google sign-in. We disclose data to authorities only where the law requires it. We never send your data to the job boards or employers: when you apply, you do it on their site.
6. International transfers
Our providers may process data in countries other than yours. Where the law requires a safeguard we rely on[TRANSFER MECHANISM, e.g. standard contractual clauses].
7. How long we keep data
- Account, profile, CVs and everything you create: until you delete it or your account.
- When you delete your account, everything about you is erased at once from our database, file storage and caches, in one step; if a step fails the deletion is refused and you can try again. The exceptions: records of AI calls (feature, model, token counts, cost) stay without any link to you; your payment provider keeps the records the law requires it to keep. Our database backups are kept for 30 days and then deleted, so data you deleted disappears from them at the latest 30 days later; a backup is only ever restored to recover from a failure, and nothing in it is used for any other purpose.
- Accounts whose email was never verified: deleted after 30 days. Expired sign-in and email tokens: deleted 7 days after they expire.
- Log of emails sent: 365 days. Generated PDF and DOCX files (they can be made again): 90 days.
- Job postings collected from job boards: 30 days (they are not about you).
- Database backups: 30 days (encrypted before they leave our server).
8. Your rights
You can, free of charge:
- Access and portability: download everything we hold about you as a zip of JSON files and your original files (Settings, Privacy and data, "Download my data").
- Rectification: correct your profile, preferences and parsed CV in the app, or write to us.
- Erasure: delete your account and data in the app (same page).
- Withdraw consent: switch off AI processing in the app, and email notifications in notification settings.
- Restriction and objection: write to [DATA PROTECTION CONTACT EMAIL]; switching off AI processing also stops the processing based on consent. We will answer within one month.
- Complain to the data protection authority: in Nigeria the Nigeria Data Protection Commission; in the EU or UK your national authority.
We do not make decisions about you with legal or similarly significant effect by automated means: scores and drafts help you decide.
9. Security
Passwords are hashed; CVs are in private storage that is only reachable through short-lived links; access is limited to the signed-in owner and checked on every request; logs are scrubbed of personal data; uploads are size- and type-checked. [CONFIRM AT LAUNCH: encryption in transit and at rest in the chosen hosting setup.] No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.
10. Children
JobFinder is not for anyone under [MINIMUM AGE, e.g. 18], and we do not knowingly collect their data.
11. Changes
We will tell you about material changes before they apply. The effective date is at the top of this page.