Privacy Policy
Template — not legal advice. Have a lawyer review before launch.
1. Controller
JBHNTR is the data controller. Contact: [email protected].
2. What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Email, password hash | Your account | Contract |
| CV, cover letters, LinkedIn export | To match you to jobs and write documents | Contract |
| Profile answers (objective, sectors, locations…) | To filter and rank jobs | Contract |
| Search results and your feedback | To show results and improve matching | Contract / legitimate interest |
| Page views (URL, country, referrer — no IP, no cookie) | Basic usage statistics | Legitimate interest |
| Marketing preference | Product emails, only if you opt in | Consent |
We do not ask for special-category data and ask you not to include it. Please don't upload other people's personal data.
3. Who we share it with (sub-processors)
| Processor | Purpose | Location |
|---|---|---|
| Railway | Hosting and database | EU / US |
| OpenRouter and the AI model provider it routes to | Matching and document generation — this receives the text of your CV, your about-me and job adverts | US |
| Cloudflare | DNS, TLS, security filtering | Global |
| Plausible Analytics | Cookieless page statistics | EU |
International transfers. Sending your CV text to a US AI provider is a transfer outside the EEA. It is covered by Standard Contractual Clauses and/or the EU–US Data Privacy Framework. We never sell your data, and your content is not used to train third-party models.
4. How long we keep it
- Account and profile — until you delete your account.
- Uploaded documents — until you delete them or your account.
- Searches and results — 12 months, then deleted automatically.
- Page views — 24 months, aggregated.
5. How we protect it
Uploaded files are encrypted at rest. Passwords are hashed with bcrypt and are never recoverable. All traffic is over HTTPS. Access is restricted and every query is scoped to your own account.
6. Your rights
You can access, correct, export, restrict, object to, or erase your data, and withdraw consent at any time.
- Access / portability — download everything we hold
- Erasure — delete your account, which is a real deletion
- Correction — edit anything on your profile
You may also complain to your data-protection authority (in Italy, the Garante).
7. Cookies
One strictly-necessary cookie keeps you signed in. Analytics is cookieless. See Cookies.
8. Automated decision-making
We score and rank jobs automatically. This produces recommendations only — it has no legal or similarly significant effect on you, makes no hiring decision, and is never shared with employers. You can ignore any result, and your feedback adjusts future rankings.
9. Changes
We'll tell you about material changes by email or in-app before they take effect.