Privacy Policy
Template — not legal advice. Have a lawyer review before launch.
1. Controller
JBHNTR is the data controller. Contact: [email protected].
2. What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Email, password hash | Your account | Contract |
| CV, cover letters, LinkedIn export | To match you to jobs and write documents | Contract |
| Profile answers (objective, sectors, locations…) | To filter and rank jobs | Contract |
| Search results and your feedback | To show results and improve matching | Contract / legitimate interest |
| Page views (URL, country, referrer, and a persistent anonymous visitor token — a one-way hash of your IP and browser used to count distinct devices; the IP address itself is never stored, and no cookie is set) | Basic usage statistics, including how many distinct people visit | Legitimate interest |
| Marketing preference | Product emails, only if you opt in | Consent |
We do not ask for special-category data and ask you not to include it. Please don't upload other people's personal data.
3. Who we share it with (sub-processors)
| Processor | Purpose | Location |
|---|---|---|
| Railway | Hosting and database | EU / US |
| OpenRouter and the model provider it routes to | Matching and document generation — this receives the text of your CV, your about-me and job adverts | US |
| Cloudflare | DNS, TLS, security filtering | Global |
Analytics is first-party and cookieless; we do not use a third-party analytics provider.
International transfers. Sending your CV text to a US AI provider is a transfer outside the EEA. It is covered by Standard Contractual Clauses and/or the EU–US Data Privacy Framework. We never sell your data, and your content is not used to train third-party models.
4. How long we keep it
- Account and profile — until you delete your account.
- Uploaded documents — until you delete them or your account.
- Searches and results — 12 months, then deleted automatically.
- Page views — 24 months, aggregated.
5. How we protect it
Uploaded files are encrypted at rest. Passwords are hashed with bcrypt and are never recoverable. All traffic is over HTTPS. Access is restricted and every query is scoped to your own account.
6. Your rights
You can access, correct, export, restrict, object to, or erase your data, and withdraw consent at any time.
- Access / portability — download everything we hold
- Erasure — delete your account, which is a real deletion
- Correction — edit anything on your profile
You may also complain to your data-protection authority (in Italy, the Garante).
7. Cookies
One strictly-necessary cookie keeps you signed in. Analytics is cookieless. See Cookies.
8. Automated decision-making and profile visibility
We score and rank jobs automatically. This produces recommendations only. It has no legal or similarly significant effect on you and makes no hiring decision. You can ignore any result, and your feedback adjusts future rankings.
We do not make your profile available to employers or recruiters in the current service. If we introduce candidate discoverability in future, it will be off by default and will require a separate, explicit choice describing what is shared and for which opportunities. We do not sell identifiable profile data as a lead list.
9. Changes
We'll tell you about material changes by email or in-app before they take effect.