1. Who is responsible for your data
The data collected through Jobra (jobra.app and the app) is controlled by INVENTIO LLC, a Delaware limited liability company (United States), file no. 10748778.
- Registered office: c/o A Registered Agent, Inc., 8 The Green, Suite A, Dover, DE 19901, United States
- Operating office: 601 North Federal Highway, Hallandale Beach, FL 33009, United States
- Privacy contact: support@jobra.app
If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to the processing described here, although we are based in the United States.
2. What data we process
- Account data: first and last name, email, password (stored only in hashed form). If you sign in with Google or LinkedIn, we receive your name, email and profile picture from the provider.
- Professional profile: job title, experience, skills, education, languages, location, industries and goals you enter at sign-up and in the settings.
- CVs and documents: the files you upload and the CVs, cover letters and texts you create or generate.
- Applications: the jobs you apply to, the text sent, the status and your notes.
- Usage data: searches, jobs viewed, features used, notification preferences.
- Payment data: we don’t see or store your card details: Stripe collects them (card, Apple Pay, Google Pay, Link). We receive your plan status, customer and payment IDs and amounts. To work out the tax that applies, we record the IP address at the time of payment with the country it indicates, and the country of the card. We never record the card number.
- Support: the messages you send to the support chat and tickets.
- Companies’ replies: when a company replies to an application sent with Jobra, the reply reaches us. We keep it to forward it to you, to show you where the application stands and for support: the Jobra team can read it.
- Opens of application emails: emails sent with Jobra contain an invisible image that tells us, as an estimate, whether the company opened them. We show it to you as “Opened (estimate)”.
- Technical data: IP address, browser and device type, error and security logs.
A CV can contain information you choose to include. We don’t ask for sensitive data (for example health, religion, ethnicity) and we advise you not to include it; if you do, we process it only to provide the service.
3. Why we process it
- To provide the service — create and keep your account, find and rank jobs for your profile, generate CVs, cover letters and analyses, send the applications you decide to send (automatically too, if you switch it on), manage your plan and support. UK legal basis: performance of the contract.
- Service messages — emails about applications, reminders, summaries of matching jobs, your plan and security. UK legal basis: performance of the contract; you can switch the summaries off in the settings.
- Security and operation — preventing abuse and fraud, usage limits, error monitoring, aggregate usage statistics. UK legal basis: legitimate interests in keeping the service safe and working.
- Legal obligations — keeping accounting records, tax, and answering requests from authorities. UK legal basis: legal obligation.
- Analytics and advertising in the browser — Google Analytics 4, Google Ads (remarketing and conversion measurement) and the Meta pixel. Only with your consent, given in the cookie banner and withdrawable at any time from “Manage cookies”.
- Campaign measurement from our servers — when you sign up or pay, we report the event to Google (with your advertising consent status: without consent Google doesn’t use it for personalized advertising or remarketing) and to Meta (with your email in hashed form). UK legal basis: legitimate interests in knowing which campaigns work; you can object by writing to support@jobra.app.
- Marketing messages, if and when we start them, only with your consent, withdrawable at any time.
4. AI and automated decisions
Jobra uses language models to estimate how well your profile fits each job, summarize postings and write texts. Scores are suggestions: the decision to apply is always yours. Automatic applications start only if you switch them on, for the criteria and daily limits you set, and you can switch them off at any time. No processing produces legal effects on you without human involvement.
The AI providers we use process your data only to produce the answer and, by contract, do not use it to train their models.
5. How long we keep data
- Account, profile, CVs, applications: for as long as your account exists; deleted within 30 days of closing it (the backup rotation time). You can delete single CVs and your whole account yourself from the settings.
- Support messages: 12 months after the request is closed.
- Companies’ replies to your applications: 12 months after they arrive.
- Technical and security logs: 90 days.
- Payment data and accounting records: for the period required by applicable tax law, even if you delete your account.
- Consent to marketing messages: until you withdraw it.
6. Who processes data for us, and where
We don’t sell your data for money. We share it only with providers that process it on our behalf under a data processing agreement:
- Supabase (United States) — database, authentication and file storage. Accounts, profiles, CVs and applications live here.
- Vercel (United States) — application hosting.
- Mistral AI (France, European Union) — AI processing: match scores, CV analysis, text generation. No training on your data.
- Groq (United States) — backup AI processing, used only when the main provider is unavailable. No training on your data.
- Stripe (United States/Ireland) — payments by card, Apple Pay, Google Pay and Link, and subscription management; also an independent controller for fraud prevention and its own legal obligations.
- Resend (United States) — sending service emails and the applications you send.
- Hunter (France, European Union) — receives only a company's website domain and returns the contact addresses for applications published on its pages, or confirms that a company mailbox for applications (such as careers@) exists. None of your data is sent.
- Sentry (United States) — application error reporting.
- Plausible (European Union) — aggregate traffic statistics, with no cookies and without identifying people.
- Google (United States/Ireland) — usage statistics with Google Analytics 4 and advertising with Google Ads, on browsing data and cookie IDs, in the browser only with your consent. No CV or application data is sent.
- Meta Platforms (United States/Ireland) — measurement of advertising campaigns: the pixel in the browser, only with your consent; sign-up and payment events from our servers with your email in hashed form. No CV or application data is sent.
- Google and LinkedIn — only if you choose to sign in with their account (independent controllers for sign-in).
Job sources (such as Adzuna and Google Jobs through SearchApi) receive only the search words and the place searched, never your profile. When you apply, the data you choose to send (CV, cover letter, contact details) goes to the employer or the job platform, which handles it as an independent controller.
The companies of cold applications. The names, addresses, websites and contact details that businesses publish themselves come from our catalog, built from open data: Overture Maps Foundation (data from Meta, Microsoft, Foursquare, AllThePlaces and others, under the CDLA-Permissive-2.0, Apache-2.0 and CC0 licences), Foursquare Open Source Places (Apache-2.0 licence) and OpenStreetMap (© OpenStreetMap contributors, ODbL licence). None of your data is sent to these sources.
Affiliate program. If you use a partner’s code or link, that partner sees your first name and last-name initial, your subscription date, plan and status, and the commission it earns. They receive no email or other contact details. We do this under our legitimate interest in calculating what we owe them; partners are bound to confidentiality.
International transfers. We are based in the United States and your account, profile and CV data is stored in the United States; AI processing happens in the European Union. You can ask us for a copy of the safeguards we use by writing to support@jobra.app.
7. Cookies
We use necessary cookies to keep you signed in and remember your preferences (including jobra_consent, your cookie choice), and two first-party measurement cookies that are never shared: jobra_vid (a random ID, to see where sign-ups stop) and jobra_utm (the campaign you came from). Google Analytics 4, Google Ads and the Meta pixel are switched on only with your consent. Details in the Cookie Policy.
8. Your rights
You can:
- Access your data and get a copy
- Correct inaccurate or incomplete data
- Delete your data
- Port your data in a structured, machine-readable format
- Object to processing based on legitimate interests, or ask us to restrict it
- Withdraw consent at any time, without affecting processing already done
You can download your data (JSON or CSV) and delete your account yourself from Settings → Your data, or write to support@jobra.app. We reply within 30 days. We won’t discriminate against you for exercising your rights.
If you are in the UK and think we handle your data unlawfully, you can complain to the Information Commissioner’s Office (ico.org.uk).
9. Children
Jobra is for people aged 18 and over. We don’t knowingly collect data from children; if we learn we have, we delete it.
10. Security
We use appropriate technical and organizational measures: encryption in transit and at rest, sign-in through verified providers, row-level access control in the database, key separation, usage limits and continuous monitoring. No system is impenetrable: if a breach puts your rights at risk, we will tell you as the law requires.
11. Changes
If this policy changes materially, we tell you by email or with a notice in the app before the changes take effect. The date at the top shows the latest version.
12. Contact
For any question about this policy or to exercise your rights: support@jobra.app.