Legal & Privacy

Privacy Policy

Effective Date: August 30, 2026 · Last Updated: August 2026

Privacy at a Glance

  • We never sell your data or share it with third parties for marketing or behavioral advertising.
  • AI Privacy: Your CVs, tailored resumes, and chat prompts are processed under enterprise agreements with zero AI foundational model training.
  • Google API & Gmail Data: When connected, Gmail access is read-only (gmail.readonly) and strictly restricted to detecting automated job-alert emails. We strictly adhere to the Google API Limited Use Policy.
  • Chrome Extension: Scoped exclusively to supported job boards (LinkedIn, Indeed, Greenhouse, Workday) and communicates only with jobby.website.
  • Security: All integration tokens, passwords, and API keys are encrypted at rest using AES-256-GCM encryption.

1. Introduction & Overview

Welcome to Jobby ("we", "us", "our", or "the Platform"). Jobby provides an AI-powered career operating system, resume tailoring pipeline, job match scoring engine, and browser automation extension accessible via https://jobby.website.

This Privacy Policy explains what personal data we collect, how we process and protect it, and the rights you retain over your information. By creating an account or using any Jobby services, you agree to the practices outlined herein.

2. Information We Collect

We collect only the information necessary to provide, personalize, and secure our career services:

A. Information You Provide

  • Account Credentials: Name, email address, salted password hashes (bcrypt), and profile avatar.
  • Master Career Profile: Master resumes and CVs (LaTeX, PDF, Word), structured skills taxonomy, career history, education, academic publications, and project links.
  • Voluntary Profile Characteristics (EEO / Demographics): Optional demographic information provided to speed up job applications (e.g., gender identity, race/ethnicity, veteran status, disability status, pronouns, target salary range, and notice period).
  • Work Authorizations: Country-specific legal work authorizations and visa sponsorship requirements.
  • Application Answer Bank: Pre-configured answers to recurring job application screening questions.
  • AI Assistant Conversations: Chat history and prompts submitted to our career and job advice responders.

B. Connected Integrations & Encrypted Credentials

  • Email Integrations: OAuth tokens and IMAP credentials used to fetch job-alert emails. All stored tokens, passwords, and custom API keys are encrypted at rest via AES-256-GCM.
  • Custom AI Inference Keys: If you supply your own API keys (e.g., Anthropic, Google Gemini, OpenAI), they are encrypted at rest and used solely to process your requests.

C. Automatically Collected Data & Chrome Extension

  • Chrome Extension In-Page Analysis: Operates strictly on allowlisted job boards (LinkedIn, Indeed, Greenhouse, Workday) to read visible job descriptions and assist with application form autofill.
  • AI & Quota Telemetry: Input/output token counts, task types, model identifiers, and plan usage counters.
  • Technical Logs: IP address, user-agent, request timestamps, and security audit logs.

3. How We Use Your Information

We process your data strictly for legitimate operational purposes:

  • Calculating match fit scores between your profile and job postings.
  • Compiling customized LaTeX resumes and cover letter PDFs tailored to specific roles.
  • Autofilling supported application forms via our Chrome extension.
  • Managing subscription tiers, billing cycles, and feature access limits.
  • Maintaining system security, audit trails, and abuse prevention.

4. Artificial Intelligence & LLM Processing

Jobby leverages enterprise Large Language Model (LLM) APIs from providers such as Anthropic and Google Cloud (Vertex AI) to parse job descriptions, compute fit scores, and rewrite resume bullet points.

Zero Model Training: In accordance with our commercial enterprise agreements, your personal data, resume text, and prompts are never used to train or fine-tune public foundation AI models.

5. Google API Limited Use Policy Disclosure

Jobby's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements:

  • Scoped Access: We request read-only access (https://www.googleapis.com/auth/gmail.readonly) solely to identify job alert emails matching specific job search queries.
  • No Advertising: Google user data is never used or transferred for serving advertisements, retargeting, or data brokering.
  • No Human Viewing: No employee or contractor views your raw email content unless you explicitly grant consent for technical support, or where required by law.
  • No AI Model Training: Data retrieved via Google APIs is never used to train AI/ML models.

6. Chrome Browser Extension Data Handling

The Jobby Chrome Extension adheres to Chrome Web Store User Data policies:

  • Single-Purpose Scoping: Content scripts are injected only on specific domains where job postings or application forms exist (e.g. indeed.com, linkedin.com, boards.greenhouse.io, myworkdayjobs.com).
  • Strict Origin Security: The extension establishes communication solely with https://jobby.website.
  • No Background Web Tracking: The extension does not record browsing history, capture keystrokes outside active job forms, or monitor unrelated browser tabs.

7. Data Sharing & Third-Party Services

We do not sell, rent, or trade your personal data. We share information only with sub-processors necessary to provide our service:

  • Stripe: Payment processing and billing lifecycle management.
  • Anthropic & Google Cloud: Enterprise AI inference APIs.
  • Cloud Infrastructure Providers: Application hosting, database storage, and secure backups.

8. Data Retention & Deletion

We retain your account and career profile data for as long as your account remains active. You may delete your account and all associated master CVs, skill profiles, and answer banks at any time in your profile settings. Upon deletion, personal data is permanently purged from active databases within 30 days.

9. Your Legal Privacy Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you possess the following rights:

  • Access & Portability: Request a copy of your personal data or export your master LaTeX CVs and application records.
  • Correction & Erasure: Update inaccurate data or request complete deletion of your records.
  • Opt-Out & Consent Revocation: Disconnect linked email accounts or revoke OAuth tokens at any time.
  • Non-Discrimination: We will never discriminate against you for exercising your privacy rights.

To exercise any of these rights or submit a formal data inquiry, please use our online tracking request form below. Every inquiry automatically generates a unique reference number, logs into our compliance system, and triggers an email confirmation to you.

10. Contact Us & Submit an Inquiry

Have a privacy inquiry, data request, or support question? Fill out the form below. Your request will be directly routed to our operations team and logged with a permanent tracking number.

Submit a Privacy Request or Inquiry

Submit formal GDPR/CCPA data requests, report security issues, or reach our support team. You will receive a tracking reference number and email confirmation immediately upon submission.

0 / 5000