Privacy Policy

• Account data: email address and password hash (stored on our own authentication server).
• Sign-in providers: if you sign in with Google, LinkedIn or GitHub, that provider sends us the email address on that account and, where the account has them, your name and profile picture. We get no password and no access to anything else on that account. Each provider decides for itself what it records about the sign-in, under its own privacy policy.
• How you found us: when you join, we record the campaign tags on the link you arrived from (the utm_ part of the address), or the name of the website that sent you, or that you came directly. We keep the site name only, not the full address of the page you came from. It is recorded once, kept with your account, used only to see which channels bring people to Jobzyl, and deleted with your account.
• Job alerts: if you have an email alert - its name, keywords, location, and when it last fired. Used solely to send you the digests you asked for; every digest has a one-click unsubscribe.
• Saved jobs: the listings you choose to track, their status, and any notes you add.
• Search history: keywords, locations, and filters you have used.
• Resume text: only if you paste or upload a CV and explicitly save it. Every CV record in our database is encrypted at rest with field-level Fernet encryption, and the encryption key is held by the application, not the database. A copy is also held in your browser’s sessionStorage (key jobzyl_resume) so the in-browser keyword match can run without sending the text anywhere; that copy is discarded when you close the tab. A saved CV is deleted automatically after 24 months without being updated, and we email you 30 days before that happens so you can keep it. Deleting a CV removes the stored record, the server-side copy that feeds match scoring, and the copy in this browser, all three.
• Search analytics: per-search metadata for admin troubleshooting (keywords, location, IP-masked source, referrer source, user agent, how long the search took, and whether it succeeded). The IP address is truncated before storage: an IPv4 address keeps only its first two numbers and an IPv6 address only its first 48 bits.
• Country: we derive a two-letter country code from your IP address and store only that code. The lookup runs on our own server against a bundled offline table (IP Geolocation by DB-IP, licensed CC BY 4.0), so your IP address is not sent to any third party and is never stored in full. We do not derive or store your city, and we do not use precise location. Kept for 90 days with the search record it belongs to. If you are signed in, the code is also kept with your account, as described under Account activity.
• Account activity: if you are signed in, when we last saw your account, when you last signed in, a count of your visits, and the two-letter country code of the first and of the most recent visit we recorded for your account, worked out as described above. We use it to see how many accounts are active and where they are. It is linked to your account and deleted with it.
• Outbound clicks: when you click Apply, the click passes through our own server so we can send you to the live posting and count it. We record which listing, which job board it came from, the employer, the search location it was indexed under, your browser’s user-agent string, and the two-letter country described above. The click record does not contain your IP address, and nothing is written to your device to make it. If you are signed in, the click is linked to your account. That link is made with a short-lived token held only in your browser’s memory for the page you are on; it is not a cookie, nothing is stored on your device, and a signed-out click is not linked to anyone. It is how we notice an apply link has stopped working, how we check a job board’s own click figures against ours, and how we see whether the jobs we show you are ones you actually want. Kept for 180 days.
• Jobs you open: when you open a listing to read it, we record which listing, the employer and the job board, and link it to your account if you are signed in. We use it to see which postings people actually read and whether the results we return are the ones they want. We do not record how long you spent reading, and we do not record scrolling or mouse movement. Kept for 180 days.
• AI usage: when you use a CV match, cover letter, interview prep or CV tips, we record which feature ran, how many tokens it used, what it cost, how long it took and whether it failed. We do not store the prompt or the generated text. Kept for 365 days.
• Application tracker history: when you save a job, remove a saved job, or move one between stages, we record the change and when it happened, so we can measure how long each stage takes and how many saved jobs turn into applications. Kept for 730 days. If you delete your account, these records are unlinked from you rather than deleted: what is left is the stage change and when it happened, with no account attached.
• Label beta (invited accounts only): if we invite you to try our job verification labels before they are public, we keep the email address we invited, when the invite was sent, when you first signed in with it, and whether you have the labels switched on. If you answer “Is this right?” on a label, we store your answer, which listing and label it was about, any note you add, and when. We also record how long your searches took and how much of that time the label check used. We use this only to check the labels are right and to see what they cost before anyone else gets them; your answers are never shown to other users. It is linked to your account and deleted with it. An address we invited that never signs in is kept until we take it off the list.
• Email delivery: for each alert digest, beta invite or welcome email we send you, whether it was accepted for delivery or failed, and the provider reference. We do not use tracking pixels and do not record whether you opened an email. Kept for 30 days, or until you delete your account if that is sooner. For the welcome email we also keep, with your account, when it was sent, so that it is only ever sent once; that is deleted with your account. And we record that it was sent and how many minutes after you confirmed your address, linked to your account, to check it does not arrive on the heels of the confirmation; that record is kept for 180 days.
• Usage analytics: with your consent, an anonymous Plausible visit ping and PostHog product-behaviour events. Autocapture and session recording are disabled. If you are signed in, PostHog events are linked to your account ID (not your email); signed-out visits create no PostHog person profile. Choosing necessary-only, or withdrawing consent later, stops PostHog capture immediately. No third-party advertising trackers.
• Performance + error telemetry: Sentry captures errors from our servers, with PII suppression on. Error reporting from the website itself is not switched on. If we switch it on, website error reports are relayed through our own server, so your browser does not contact Sentry and your IP address is not passed on, and a report carries the page address without its query string, your browser and device type, and the error itself. We run no client-side performance or Web Vitals telemetry at all.

We use this data only to operate Jobzyl: showing you relevant jobs, syncing across your devices, scoring CV-to-JD matches, generating tailored cover letters and interview prep when those tools are available, and improving the service. We do not sell or share personal data with advertisers.

We rely on the following lawful bases under Art 6 GDPR:

• Contract performance (Art 6(1)(b)): account creation, authentication, syncing tracked jobs, search, CV match scoring, AI cover-letter generation when it is available, email verification, OTP login, the one-time welcome email we send after you confirm your address, and the job-alert email digests for any alert you have (stopped instantly by the one-click unsubscribe in every digest).
• Consent (Art 6(1)(a)): Plausible analytics and PostHog product analytics. Neither is loaded until you click “Accept all” on the cookie banner. You can withdraw consent at any time from the Cookies Policy.
• Legitimate interest (Art 6(1)(f)): Sentry error tracking (security and reliability), admin audit logging (investigating security incidents, and being able to show which administrator did what), the outbound-click record above (keeping apply links working, and reconciling a job board’s reported clicks with our own), and the label beta above (inviting people to try the labels, and keeping the answers they choose to give so we can check them). Balancing tests are documented in our internal Records of Processing register, available on request. You can object to processing on this basis at any time; see Your rights below.
• Legitimate interest (Art 6(1)(f)), running and improving the service: the search analytics record and the country code (troubleshooting searches, and seeing where they come from), how you found us (seeing which channels bring people to Jobzyl), account activity (seeing how many accounts are active), jobs you open (seeing which postings people read and whether our results fit), AI usage (keeping the cost and reliability of the AI tools in check), application tracker history (measuring how long each stage takes), and email delivery (knowing whether an email reached you). The same balancing tests and the same right to object apply.

We do not ask for special category data and we have no feature that uses it. Nothing on Jobzyl requests your health, religion, ethnicity, political opinions, trade-union membership, sex life or sexual orientation, and no filter, score or ranking is derived from any of them.

A CV is free text you write yourself, so it can contain that kind of detail incidentally, for example a health condition mentioned in an employment gap or a religious organisation named as an employer. Where it does, we process it only as an inseparable part of the document you chose to give us, and for no purpose beyond the CV features you asked for: keyword matching, match scoring, and the AI drafting tools you trigger yourself.

Our condition for that is your explicit consent under Art 9(2)(a). We ask for it as a separate tick box at the moment you save a CV, with the wording on screen, unticked, and the save blocked until you tick it. It is not part of the Terms and there is nothing to opt out of later, because nothing is stored until you agree. We keep a record of which wording you agreed to and when. Deleting the CV withdraws it, and when your last CV goes the consent record goes with it, so a later upload asks again rather than relying on something you agreed to years ago.

Separately from consent, and true whether or not you give it: no filter, sort, score or ranking anywhere in the product reads for a special category, and no feature infers one. The match score you see is keyword overlap: which of the skills a posting names appear in your CV. A vector similarity over the whole document is also computed, and only ever used to order jobs with the same score. We treat it as confidential regardless of what is in it, it is encrypted at rest, it is never used for advertising or profiling and never sold or shared, and you can delete it from your account page at any time without deleting your account. Saving a CV is entirely optional: search, filters and the job tracker all work without one, which is also why asking for consent at that step is a real choice rather than a condition of using Jobzyl.

Some job adverts we index name a recruiter or hiring manager, or give their work email address, because the employer wrote it into the advert. We get it from the job board where the advert was published, together with the advert, and hold it only as part of that advert so job seekers can read the posting as written. Our basis is legitimate interest (Art 6(1)(f)). A contact address that a board supplies as a separate field is stored and never displayed; a name or address written into the advert text is shown with the advert. Both drop out of search with the advert after 45 days (see Retention). If you are named in an advert and want your details removed, or object to us holding them, email privacy@jobzyl.com with a link to the posting.

Account data, tracked jobs, search history, job alerts, encrypted CV records, OTP codes, and email-verification tokens live in our self-hosted database (a PostgreSQL/Supabase stack we operate ourselves) on Oracle Cloud Infrastructure in Frankfurt, Germany (EU). The backend application is served from AWS App Runner (Frankfurt, eu-central-1). The website itself runs on AWS Amplify Hosting (Frankfurt, eu-central-1), which renders pages on a server we deploy, behind a content delivery network whose edge location may be anywhere in the world.

Some processing happens outside the EU. When they are available, the AI writing features (cover letters, interview prep, CV tips) send your job-description text and the relevant section of your CV to Anthropic in the United States; the data is processed transiently and not used to train models, per the Anthropic API terms. Error reports from our servers go to Sentry’s EU region in Germany, with PII suppression on, so that is not a transfer out of the EU. All US transfers rely on the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum (IDTA). See “International transfers” below.

• Oracle Cloud Infrastructure (EU, Frankfurt, eu-frankfurt-1): Hosts our self-managed database and authentication server (a self-hosted Supabase/PostgreSQL stack at sb.jobzyl.com). Oracle provides the server only; it has no access to the data.
• AWS App Runner (EU, eu-central-1): Backend application hosting (Frankfurt, eu-central-1).
• AWS Amplify Hosting (EU, eu-central-1, edges global): Frontend hosting and server-side rendering (Frankfurt, eu-central-1), fronted by a content delivery network whose edge locations are worldwide.
• Resend (EU): Transactional email (account verification, OTP, password reset, support replies) and the job-alert digests you subscribe to. Every digest carries a one-click unsubscribe link.
• Plausible (EU, plausible.io, consent-gated): Anonymous, aggregated traffic analytics. No cookies.
• PostHog (EU, eu.i.posthog.com, consent-gated): Product behaviour analytics (pages viewed, feature usage, funnels). Loaded only after you choose Accept all. If you are signed in, events are linked to your Jobzyl account ID (never your email) so they can be tied to your account. Autocapture and session recording are off.
• Anthropic (US; EU SCCs Module 2 + UK IDTA addendum): Cover-letter generation, interview prep, and CV-tailoring tips, when those tools are available. The CV match score is not one of these: it is computed in our own database or in your browser and is never sent to Anthropic. Data is processed transiently; per Anthropic API terms, content is not used to train models.
• Sentry (EU, ingest.de.sentry.io (Germany)): Error tracking for our servers, plus backend performance monitoring. send_default_pii is disabled and stack-frame local variables are not sent, so exception traces carry the file, line and error chain but not the data in scope. URL paths are captured. Error reporting from the website is not switched on; if it is, its reports drop query strings and are relayed through our own server, so the browser never contacts Sentry and no reader IP address is passed on.

Listings come straight from job boards, national employment services and remote-only sites including Adzuna, Reed, Careerjet, Jooble, USAJOBS, France Travail, JobTechDev, Taiwan Ministry of Labor, Arbeitnow, Himalayas, Remote OK, Remotive, Jobicy, 4 Day Week, We Work Remotely and Jobspresso, and are collected automatically from other publicly available job sites and employer career pages. The sources we query receive only the search keywords and location you choose, never personal data. See the Terms.

We rely on the following safeguards for personal data transferred outside the EU/UK:

• Anthropic, United States. EU SCCs Module 2 + UK IDTA addendum

We do not transfer personal data to any country without an adequacy decision unless an SCC- or IDTA-equivalent safeguard is in place. A current copy of the relevant transfer agreement is available on request to privacy@jobzyl.com.

When they are available, our AI writing tools use Anthropic Claude (Haiku) to produce automated outputs:

• Cover-letter generation, interview prep, CV-tailoring tips: the model receives the job description and the relevant section of your CV (truncated to 4000 characters) and returns drafted text.
• Not the CV match score. That score is computed in your browser, and the similarity that orders ties in our own database. It is never sent to Anthropic or to any other third party.

These outputs are advisory. They do not gate your access to any feature, are not shared with third parties, and are not used to make legal or similarly significant decisions about you. If you disagree with a score or want a human to review one, email privacy@jobzyl.com and we will manually review within 30 days. You can also contest a score in the same email.

We use localStorage to remember your search preferences and tracked jobs offline. Supabase Auth uses a secure session token in localStorage. Your CV text is kept in sessionStorage instead, so it is discarded when you close the tab rather than persisting across browser restarts. We do not set any third-party advertising cookies. The full list of keys is on the Cookies Policy page.

• Access & export: use the “Export my data” button on your account page to download everything we hold about you in JSON.
• Deletion (right to erasure): use the “Delete account” button on the same page. Your live data, meaning profile, CV, tracked jobs, search history and alerts, is deleted immediately and cannot be recovered. We keep a nightly database backup on our database server for 3 days, so deleted rows persist in backup for up to 3 days before the backup is removed. Backups are not queryable in normal operation.
• Correction: edit your profile from the account page or contact us.
• Restriction & objection: contact us to restrict processing or object to a specific use of your data.
• Portability: the JSON export is machine-readable and can be imported elsewhere.
• Withdraw consent: change your cookie preference at any time from the Cookies Policy.
• Right to human review of automated outputs: see the “Automated decision-making” section above.
• Complaint: tell us first if you can, at privacy@jobzyl.com. We acknowledge a complaint within 30 days of receiving it, look into it, and tell you the outcome. You may also, or instead, lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk), the European Data Protection Board (edpb.europa.eu), your EU member state’s data-protection authority, or any equivalent supervisory authority. See the dedicated GDPR & Data Requests page for response timelines and contact details.

If you are a California resident, we give you the rights the California Consumer Privacy Act (as amended by the CPRA) describes, in addition to those above:

• Right to know: what personal information we collect, the sources, the purposes, and the categories shared.
• Right to delete: request deletion of personal information we hold about you (use the account page or email us).
• Right to correct: ask us to correct inaccurate personal information.
• Right to opt-out of sale or sharing: we do not sell or share your personal information for cross-context behavioural advertising. There is nothing to opt out of.
• Right to limit use of sensitive personal information: we collect no sensitive PI in the CCPA sense (no SSN, no payment info, no precise geolocation, no biometrics). CV text you upload is treated by us as confidential and is encrypted at rest, but it is not “sensitive personal information” under CCPA per se.
• Non-discrimination: we will not deny service, charge different prices, or provide a different level of service if you exercise these rights.

To exercise any of these rights, email privacy@jobzyl.com or use the self-serve actions on your account page. We respond within 45 days.

Aggregated public job listings drop out of search after 45 days, when a nightly sweep moves them into an archive table that nothing serves. They are employer postings rather than data about you, and the archive is not currently purged on a schedule, so we say that plainly instead of calling it deletion. Search analytics rows are kept for 90 days. Email delivery records are kept for 30 days, and deleted when you delete your account. Label beta records are kept while your account exists and deleted with it; an invited address that never signs in is kept until we remove it from the list. Admin audit-log entries are retained for 365 days, on the legitimate interest described above. A saved CV is deleted after 24 months without being updated, with an email 30 days beforehand so you can keep it; that removes the CV only and leaves the rest of your account intact. The clock runs from when you last saved that CV, not from your last sign-in. Your other account data is kept for as long as your account exists; deletion from the account page removes your live data immediately, and nightly backups age out within 3 days.

One exception to that. Admin audit-log entries record which administrator performed which action, and some of those actions reference a user id. Those rows survive account deletion for the 365 days described above, because a log that can be erased by its own subject cannot serve its security and accountability purpose. They hold the action, the timestamp and the id - never your CV, your searches or your tracked jobs, all of which are removed with the rest of the account.

Jobzyl is not meant for anyone under 16, and you must be 16 or older to join. We do not knowingly hold personal data about anyone younger. If you think a child under 16 has given us their data, email privacy@jobzyl.com and we will delete it.

Jobzyl is the controller of the personal data described on this page.

Jobzyl is a trading name of Hammad Ahmad.

For general privacy questions, email privacy@jobzyl.com. For data subject requests, see our GDPR & Data Requests page. For general support questions, use support@jobzyl.com.