Skip to main content
Legal

Privacy Policy

Last updated: November 2, 2026

This policy describes how Jobs CRM collects, uses, stores, and protects your personal information when you use our service.

Data We Collect

Account information

When you create an account we collect your username, email address and a hashed password. If you sign in with Google, we receive your Google profile name and email address. We also keep session records so you can review and revoke your sessions, and a record of the consent choices you make.

Job application data

Companies, role titles, statuses, interview stages, notes, reminders, answers, profile facts and related details that you enter or import. This is stored so the service can track your job search.

Documents

Resumes, cover letters and other files you upload, and tailored resume files the service generates for you. Files are kept in private storage.

Email data

If you connect Gmail, the service uses Google's APIs to read messages and to send messages you ask it to send. Messages synced from your mailbox and messages sent through the app are stored in your account so they can be shown next to the related application. Connecting Gmail is optional.

Configuration data

Settings you provide, including AI provider API keys and Gmail connection tokens, are encrypted before they are stored.

Operational data

Our servers and error monitoring record technical information such as errors and request details so we can keep the service running. We do not use advertising or analytics tools.

AI Processing

What is sent

AI features (job analysis, resume tailoring, email drafting and replies, interview preparation) send the text needed for the request to an AI provider. Depending on the feature this can include job descriptions, your resume or profile text, and, when you ask for a reply to a recruiter message, the conversation text you are replying to.

Which provider

You choose the provider (OpenAI, Anthropic, Google Gemini or Z.AI) and can supply your own API key; your key is stored encrypted and used only to make your requests. Where the service offers a built-in AI allowance, requests are sent to the provider the service operator has configured, using the operator's key. Each provider handles the content under its own terms and privacy policy.

What we keep

We store the results of AI features (for example a tailored resume or a drafted email) in your account.

Service Providers (Subprocessors)

We use these providers to operate the service. Each processes data under its own terms and privacy policy.

  • Vercel: Application hosting, private file storage (Vercel Blob) and background workflows.
  • Neon: PostgreSQL database hosting for account and application data.
  • Resend: Sending transactional email such as password-reset messages.
  • Sentry: Error monitoring and diagnostics.
  • Google: Sign-in with Google and, if you connect it, Gmail access.
  • OpenAI, Anthropic, Google Gemini, Z.AI: AI processing, using the provider you select or the operator's built-in AI configuration.
  • Browserless: Rendering resume HTML into PDF files.
  • JobRadar: Job listings feed used by the Discover feature.
  • Stripe: Payment processing, when credit purchases launch. Card details are entered with Stripe, not with us.

How We Use Your Information

  • To provide and operate Jobs CRM and its features.
  • To store and display your applications, documents and email communications as you direct.
  • To run the AI-assisted features you choose to use.
  • To authenticate you, keep sessions secure and send account emails you request.
  • To keep the service reliable, investigate errors and prevent abuse.

Google User Data

  • Sign-in with Google requests the openid, email and profile scopes, used only to verify your identity and create or open your account.
  • Connecting Gmail is optional and requested separately. It requests the gmail.readonly scope (to read messages so they can be shown and matched to your applications) and the gmail.send scope (to send emails you compose or approve).
  • Gmail connection tokens are stored encrypted and used only to perform those actions for you.
  • Jobs CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • We use Google user data only to provide the user-facing features described here. We do not use it for advertising, including retargeting or interest-based ads, and we do not sell it.
  • We do not allow humans to read your Google user data unless you give consent for specific messages, it is necessary for security purposes such as investigating abuse, or it is required to comply with applicable law.
  • We do not transfer Google user data to others except as needed to provide the features you use (for example to our hosting and database providers, and to the AI provider you select when you ask an AI feature to work on message text), for security purposes, or to comply with law.
  • Disconnecting Gmail in your settings deletes the stored Gmail tokens from our systems. To also revoke access at Google, remove Jobs CRM from the third-party access settings of your Google Account.

Data Sharing

  • We do not sell, rent or trade your personal data.
  • Data is shared only with the service providers listed above, as needed to operate the service, and where required by law or to protect the rights and safety of our users.

Retention

  • Your data is kept while your account is active.
  • When you delete your account it is removed after the 30-day period described below.
  • Our database provider keeps point-in-time recovery history for up to 6 hours, so deleted data leaves those backups within 6 hours.

Deleting Your Account

  • Open Settings, then Privacy, and choose Delete my account. You confirm by typing DELETE MY ACCOUNT.
  • Deletion is scheduled for 30 days after your request. Signing in again during those 30 days cancels it.
  • When it runs, your account record is deleted together with everything linked to it (applications, emails, stored settings and sessions), and the uploaded files behind your documents are removed from file storage on a best-effort basis.
  • Deletion runs when sign-in attempts trigger a sweep, so it can occur somewhat after the 30-day mark.
  • A minimal audit record that a deletion occurred, identified only by your account ID, is kept.

Your Rights

  • Access and correction: you can view and edit your data in the application.
  • Export: Settings, then Privacy, offers Export my data, a JSON file of your account, applications, emails, profile and related records. It lists your documents by name and type but does not include the uploaded files themselves.
  • Deletion: as described above.
  • Consent: you can change your consent choices in Settings, then Privacy.
  • For other requests, contact us at the address below.

Cookies

  • We use a httpOnly session cookie to keep you signed in. It lasts 7 days, or 30 days if you choose Remember me.
  • During Google or Gmail authorization we set a short-lived state cookie (10 minutes) to protect the sign-in flow.
  • Your browser's local storage keeps display preferences such as theme and list view. This stays on your device.
  • We do not use advertising, tracking or analytics cookies.

Security

  • API keys and Gmail tokens are encrypted at rest with AES-256-GCM.
  • Passwords are stored hashed, never in plain text.
  • Traffic between your browser and the service uses HTTPS.
  • No system is perfectly secure, so we cannot guarantee absolute security.

Changes to This Policy

  • We may update this policy from time to time and will change the date above. Continued use after a change means you accept the updated policy.

Contact

  • For privacy questions or data requests, contact us at support@jobscrm.app.