Privacy Policy

• Account data: email address and password hash (stored on our own authentication server).
• Job alerts: if you create an email alert - its name, keywords, location, and when it last fired. Used solely to send you the digests you asked for; every digest has a one-click unsubscribe.
• Saved jobs: the listings you choose to track, their status, and any notes you add.
• Search history: keywords, locations, and filters you have used.
• Resume text: only if you paste or upload a CV and explicitly save it. Every CV record in our database is encrypted at rest with field-level Fernet encryption, and the encryption key is held by the application, not the database. A copy is also held in your browser’s sessionStorage (key jobzyl_resume) so the in-browser keyword match can run without sending the text anywhere; that copy is discarded when you close the tab. A saved CV is deleted automatically after 24 months without being updated, and we email you 30 days before that happens so you can keep it. Deleting a CV removes the stored record, the server-side copy that feeds match scoring, and the copy in this browser, all three.
• Search analytics: per-search metadata for admin troubleshooting (keywords, location, IP-masked source, referrer source, user agent, how long the search took, and whether it succeeded). The IP address is truncated before storage so the lower octets are not retained.
• Country: we derive a two-letter country code from your IP address and store only that code. The lookup runs on our own server against a bundled offline table, so your IP address is not sent to any third party and is never stored in full. We do not derive or store your city, and we do not use precise location. Kept for 90 days with the search record it belongs to.
• AI usage: when you use a CV match, cover letter, interview prep or CV tips, we record which feature ran, how many tokens it used, what it cost, how long it took and whether it failed. We do not store the prompt or the generated text. Kept for 365 days.
• Application tracker history: when you move a saved job between stages, we record the change and when it happened, so we can measure how long each stage takes. Kept for 730 days, and deleted with your account.
• Email delivery: for each alert digest we send you, whether it was accepted for delivery or failed, and the provider reference. We do not use tracking pixels and do not record whether you opened an email. Kept for 180 days.
• Usage analytics: with your consent, an anonymous Plausible visit ping and PostHog product-behaviour events. Autocapture and session recording are disabled; PostHog person profiles are identified-only. No third-party advertising trackers.
• Performance + error telemetry: Sentry captures backend exceptions, with PII suppression on. We run no client-side performance or Web Vitals telemetry at all.

We use this data only to operate Jobzyl: showing you relevant jobs, syncing across your devices, scoring CV-to-JD matches, generating tailored cover letters and interview prep, and improving the service. We do not sell or share personal data with advertisers.

We rely on the following lawful bases under Art 6 GDPR:

• Contract performance (Art 6(1)(b)): account creation, authentication, syncing tracked jobs, search, CV match scoring, AI cover-letter generation, email verification, OTP login, and the job-alert email digests you create (stopped instantly by the one-click unsubscribe in every email).
• Consent (Art 6(1)(a)): Plausible analytics, PostHog product analytics, and Logo.dev company-logo images. None of the three is loaded until you click “Accept all” on the cookie banner. You can withdraw consent at any time from the Cookies Policy.
• Legitimate interest (Art 6(1)(f)): Sentry error tracking (security and reliability), and admin audit logging. Balancing tests are documented in our internal Records of Processing register, available on request.
• Legal obligation (Art 6(1)(c)): retention of admin audit log entries to demonstrate accountability under Art 32.

We do not ask for special category data and we have no feature that uses it. Nothing on Jobzyl requests your health, religion, ethnicity, political opinions, trade-union membership, sex life or sexual orientation, and no filter, score or ranking is derived from any of them.

A CV is free text you write yourself, so it can contain that kind of detail incidentally, for example a health condition mentioned in an employment gap or a religious organisation named as an employer. Where it does, we process it only as an inseparable part of the document you chose to give us, and for no purpose beyond the CV features you asked for: keyword matching, match scoring, and the AI drafting tools you trigger yourself.

Our condition for that is your explicit consent under Art 9(2)(a). We ask for it as a separate tick box at the moment you save a CV, with the wording on screen, unticked, and the save blocked until you tick it. It is not part of the Terms and there is nothing to opt out of later, because nothing is stored until you agree. We keep a record of which wording you agreed to and when. Deleting the CV withdraws it, and when your last CV goes the consent record goes with it, so a later upload asks again rather than relying on something you agreed to years ago.

Separately from consent, and true whether or not you give it: no filter, sort, score or ranking anywhere in the product reads for a special category, and no feature infers one. The match score is keyword overlap and vector similarity over the whole document. We treat it as confidential regardless of what is in it, it is encrypted at rest, it is never used for advertising or profiling and never sold or shared, and you can delete it from your account page at any time without deleting your account. Saving a CV is entirely optional: search, filters and the job tracker all work without one, which is also why asking for consent at that step is a real choice rather than a condition of using Jobzyl.

Account data, tracked jobs, search history, job alerts, encrypted CV records, OTP codes, and email-verification tokens live in our self-hosted database (a PostgreSQL/Supabase stack we operate ourselves) on Oracle Cloud Infrastructure in Frankfurt, Germany (EU). The backend application is served from AWS App Runner (Frankfurt, eu-central-1). The static frontend is served from AWS S3 with CloudFront (origin in eu-central-1; the CloudFront edge that delivers the page may be anywhere in the world).

Some processing happens outside the EU. The AI writing features (cover letters, interview prep, CV tips) send your job-description text and the relevant section of your CV to Anthropic in the United States; the data is processed transiently and not used to train models, per the Anthropic API terms. Backend exceptions go to Sentry’s EU region in Germany, with PII suppression on, so that is not a transfer out of the EU. With your consent, Logo.dev serves company logo images from the United States; the request carries the employer’s domain and no data about you. All US transfers rely on the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum (IDTA). See “International transfers” below.

• Oracle Cloud Infrastructure (EU, Frankfurt, eu-frankfurt-1): Hosts our self-managed database and authentication server (a self-hosted Supabase/PostgreSQL stack at sb.jobzyl.com). Oracle provides the server only; it has no access to the data.
• AWS App Runner (EU, eu-central-1): Backend application hosting (Frankfurt, eu-central-1).
• AWS S3 + CloudFront (EU, S3 origin EU, edges global): Static frontend hosting (origin in eu-central-1; CloudFront edges global).
• Resend (EU): Transactional email (account verification, OTP, password reset, support replies) and the job-alert digests you subscribe to. Every digest carries a one-click unsubscribe link.
• Plausible (EU, plausible.io, consent-gated): Anonymous, aggregated traffic analytics. No cookies.
• PostHog (EU, eu.i.posthog.com, consent-gated): Product behaviour analytics (feature usage, funnels). Autocapture and session recording disabled; identified-only profiles.
• Anthropic (US; EU SCCs Module 2 + UK IDTA addendum): Cover-letter generation, interview prep, and CV-tailoring tips. The CV match score is not one of these: it is computed in our own database or in your browser and is never sent to Anthropic. Data is processed transiently; per Anthropic API terms, content is not used to train models.
• Sentry (EU, ingest.de.sentry.io (Germany)): Backend error tracking and performance monitoring. send_default_pii is disabled and stack-frame local variables are not sent, so exception traces carry the file, line and error chain but not the data in scope. URL paths are captured.
• Logo.dev (US, img.logo.dev, consent-gated; EU SCCs): Company logo images on job cards. The request carries the employer's domain and no user data. Only fired for employers whose domain we can verify; everyone else renders as initials.

Job listings are aggregated from public job-board APIs and feeds; those upstream providers receive only the search keywords and location you choose, never personal data. The full list of upstream sources is in the Terms.

We rely on the following safeguards for personal data transferred outside the EU/UK:

• Anthropic, United States. EU SCCs Module 2 + UK IDTA addendum
• Logo.dev, United States. EU SCCs

We do not transfer personal data to any country without an adequacy decision unless an SCC- or IDTA-equivalent safeguard is in place. A current copy of the relevant transfer agreement is available on request to privacy@jobzyl.com.

Some of our features use Anthropic Claude (Haiku) to produce automated outputs:

• Cover-letter generation, interview prep, CV-tailoring tips: the model receives the job description and the relevant section of your CV (truncated to 4000 characters) and returns drafted text.
• Not the CV match score. That percentage is computed in our own database or in your browser. It is never sent to Anthropic or to any other third party.

These outputs are advisory. They do not gate your access to any feature, are not shared with third parties, and are not used to make legal or similarly significant decisions about you. If you disagree with a score or want a human to review one, email privacy@jobzyl.com and we will manually review within 30 days. You can also contest a score in the same email.

We use localStorage to remember your search preferences and tracked jobs offline. Supabase Auth uses a secure session token in localStorage. Your CV text is kept in sessionStorage instead, so it is discarded when you close the tab rather than persisting across browser restarts. We do not set any third-party advertising cookies. The full list of keys is on the Cookies Policy page.

• Access & export: use the “Export my data” button on your account page to download everything we hold about you in JSON.
• Deletion (right to erasure): use the “Delete account” button on the same page. Your live data, meaning profile, CV, tracked jobs, search history and alerts, is deleted immediately and cannot be recovered. Encrypted off-site backups rotate on a 14-day cycle, so deleted rows persist in backup for up to 14 days before ageing out. Backups are not queryable in normal operation.
• Correction: edit your profile from the account page or contact us.
• Restriction & objection: contact us to restrict processing or object to a specific use of your data.
• Portability: the JSON export is machine-readable and can be imported elsewhere.
• Withdraw consent: change your cookie preference at any time from the Cookies Policy.
• Right to human review of automated outputs: see the “Automated decision-making” section above.
• Complaint: you may lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk), the European Data Protection Board (edpb.europa.eu), your EU member state’s data-protection authority, or any equivalent supervisory authority. See the dedicated GDPR & Data Requests page for response timelines and contact details.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) grants you these rights, in addition to those above:

• Right to know: what personal information we collect, the sources, the purposes, and the categories shared.
• Right to delete: request deletion of personal information we hold about you (use the account page or email us).
• Right to correct: ask us to correct inaccurate personal information.
• Right to opt-out of sale or sharing: we do not sell or share your personal information for cross-context behavioural advertising. There is nothing to opt out of.
• Right to limit use of sensitive personal information: we collect no sensitive PI in the CCPA sense (no SSN, no payment info, no precise geolocation, no biometrics). CV text you upload is treated by us as confidential and is encrypted at rest, but it is not “sensitive personal information” under CCPA per se.
• Non-discrimination: we will not deny service, charge different prices, or provide a different level of service if you exercise these rights.

To exercise any of these rights, email privacy@jobzyl.com or use the self-serve actions on your account page. We respond within 45 days as required by California law.

Aggregated public job listings drop out of search after 45 days, when a nightly sweep moves them into an archive table that nothing serves. They are employer postings rather than data about you, and the archive is not currently purged on a schedule, so we say that plainly instead of calling it deletion. Search analytics rows are kept for 90 days. Email open/click events are kept for 180 days. Admin audit-log entries are retained for 365 days for forensic accountability under Art 32 GDPR. A saved CV is deleted after 24 months without being updated, with an email 30 days beforehand so you can keep it; that removes the CV only and leaves the rest of your account intact. The clock runs from when you last saved that CV, not from your last sign-in. Your other account data is kept for as long as your account exists; deletion from the account page removes your live data immediately, and encrypted off-site backups age out within 14 days.

One exception to that. Admin audit-log entries record which administrator performed which action, and some of those actions reference a user id. Those rows survive account deletion for the 365 days described above, because a log that can be erased by its own subject cannot serve the accountability purpose Art 32 requires of it. They hold the action, the timestamp and the id - never your CV, your searches or your tracked jobs, all of which are removed with the rest of the account.

For general privacy questions, email privacy@jobzyl.com. For data subject requests, see our GDPR & Data Requests page. For general support questions, use support@jobzyl.com.