Privacy Policy

Controller

Nenad Franjic, reachable at info@job-badger.com — see the Imprint for full details.

What information we collect

When you use the free tools on this site, we collect what you submit: a job posting URL, your email address, and career details you provide (current role, years of experience, optional name, optional salary expectation, optional work-location preference, and the career text you provide — typed, pasted (e.g. from your LinkedIn profile), or extracted from a CV you upload). Uploaded CV files are parsed in memory and never stored; only the extracted text you can see and edit is processed. There is no account.

When you reserve a spot for the premium service, we collect the posting URL, your email, and, if you add them, a note and a link to your LinkedIn profile. We do not fetch or read anything from LinkedIn automatically; the link is kept so the profile can be looked at when your package is prepared.

Technical data: our infrastructure processes your IP address to protect the service against abuse (rate limiting) and in short-lived server logs. Generated letters and request details are stored under the retention policy below. Hashed email/IP quota keys enforce limits; hashes are pseudonymous, not anonymous.

Where you came from: when you submit a form, we record any campaign tag in the page's address (a utm_source-style parameter) and the domain that referred you — for example reddit.com, never the full referring address. This tells us which channels actually help people, and it is stored only alongside your submission. We use no advertising pixels and no third-party tracking of any kind, and nothing is stored on your device for this.

Your finished letters are also kept in your own browser(session storage) so a page refresh doesn't lose them; that copy includes your unfinished profile, posting and search drafts. It is local to that browser tab; closing the tab normally clears it, though browsers may restore tabs. Use “Clear profile and results” to remove the preparation draft explicitly.

My jobs.The jobs you save, and the ones you write a letter for, are kept in your browser's local storage on that device: title, company, place, link, the status you choose and any note you add. They are never sent to us. They stay until you remove them on the My jobs page or clear this site's data in your browser, and they do not follow you to another device.

How we use your information

• To generate the application materials you requested
• To find and show you matching job postings
• To notify you about your reservation when the premium service opens
• To operate and improve the service

We do not sell, rent, or share your personal information with third parties for their marketing purposes. No newsletter is sent unless you separately ask for one.

Legal basis for processing (GDPR Art. 6)

If you are located in the European Economic Area, we process your data under:

• Performance of a contract / pre-contractual steps — processing your fit-check, application-prep, or job-search request to deliver the result you asked for.
• Consent — you actively accept this policy and the terms before application generation. CV AI review has its own explicit consent checkbox. Upload extraction itself uses no AI. Optional marketing messages require a separate choice; you can withdraw it by contacting us.
• Legitimate interest — retaining submissions to operate the service, enforce fair-use limits, prevent abuse, measure what the service costs per user, and (with your reservation) contact you when the paid service opens.

AI processing of your data

To generate your application materials, the career details you submit (including text extracted from an uploaded CV) and the job posting text are sent, after your explicit confirmation, to an AI model provider — currently OpenAI(United States). We may route requests through Vercel's AI Gateway and may add other model providers (such as Anthropic) in the future; this policy will be updated when that happens. API data at these providers is not used to train their models under their API terms. The model is instructed to use only the facts you provide and never to invent achievements, numbers, or employers — still, review any AI-generated draft before you send it; you decide what to submit and where.

Job searches are different: when we query job boards and aggregators on your behalf, we send only your search keywords and location— never your name, email, CV text, or any other personal detail. One exception: your keywords may be machine-translated into the search location's language by the same AI provider to find local-language postings. When you search without a location, we also run the same search for the country your connection appears to come from (country level only, from our hosting provider's standard location header), so we can tell you how many jobs are there; and when a city search finds very few jobs, we run it for the whole country. On our remote job pages and guides, a box offering remote jobs open to people in your country uses that same country, and on a remote role page it runs that role's search, remote only, in your country, to say how many there are. Those boards receive the keywords and that country name, nothing else, and the check is not stored.

Data storage and security

Submissions are stored in a Postgres database (Neon, via Vercel's Marketplace, currently hosted in the United States under EU Standard Contractual Clauses; a migration to an EU region is planned). New submissions do not copy CVs or drafts into application logs or founder notification emails. Those notifications carry only the anonymous counters described below — country, role family, experience band and similar — and never your email address, name, CV text, generated letter, exact salary or the job link. An email service (Resend) delivers requested reports, reservation notices and the founder's sign-in codes. Connections use TLS encryption in transit.

Retention — what we delete and what we keep. An automated job is scheduled daily. Submission content becomes eligible for deletion after 7 days and is removed on the next successful run: the career text or CV you provided, the letters and analyses we generated for you, your name, your salary expectations, and the search terms held against your submission. This removes content from the live submissions table. Provider logs, database backups and reports delivered by email have separate retention; the seven-day rule does not control those copies. (The separate anonymous tally of searched job titles described below is not part of your submission and is not linked to you.) One exception: if you reserve a place for the paid package, we keep that request in full — your email address, the role you named, any note you added and the LinkedIn link, if you gave one. It is the record of what you asked us for, and an address without it would be useless to you and to us. We keep it until the package opens and we have contacted you, or until you ask us to delete it, whichever comes first. Ask at any time by emailing info@job-badger.com and it is removed.

What we keep beyond that point is deliberately minimal: your email address and, if you gave one, your LinkedIn URL — so we can reach you and recognise a returning user; plus the job-posting link and a marker of whether a letter was a revision, which is only what the free daily limits and the one-free-revision rule need in order to work. Your salary expectation and work-location preference are used only to produce the anonymous counters below — they are never written into a letter — and the values themselves are deleted with the rest of your submission after seven days. We retain consent choices and their version/source, attribution tags, and token-usage metadata. The founder's sign-in codes are hashed, expire after ten minutes and are cleaned up by the daily job. Administrator sessions expire after eight hours; quota keys expire according to their limit window, while a per-job revision marker is retained to enforce the one-revision rule. We also keep aggregate daily counts (how many searches and letters, from which country and channel) that are not linked to any person and cannot be traced back to you. The same counts record how far visits get through the flow — that a search was run, that results appeared, that the letter form was opened, that a field was filled in, that a letter was requested, that a suggested wider search, place, spelling or job title was used, that a search was opened from a link, that a search for remote jobs open to your country was started from one of our pages, that a job was saved or marked as applied, that results were sorted by date — so we can see which step loses people. Each is one anonymous daily number. We record that a field was filled, never what was typed into it, and because we set no cookie or identifier for visitors these counts cannot be joined together into one person's path. If you choose to search from your CV instead of typing a job title, the CV text is sent once to the AI provider named below to derive the job titles it supports, and only those titles are sent to the job boards. The CV text is not stored with the search and is never sent to a job board. When a search returns nothing or almost nothing, we additionally count the searched job title together with the searched location, so we know which places and roles we cover badly and can add a job source for them. That counter is subject to the same rule as the title tally below: anything that could carry contact detail is replaced by a broad role family instead, and like the other counters it is not linked to you.

If you ask a free tool to email you its result we send that one report and keep your email address together with your choice about future emails, so we can recognise you if you come back. That send is transactional: you asked for it, so it needs no marketing consent. Hearing from us again is a separate, unticked box you have to choose, and we do not add you to anything by default. The report itself is not stored — it is your own text and we have no reason to keep it, though the delivered copy naturally exists with the email provider and in your inbox. Reply “delete me” to any email and the address goes.

One addition to those counts: we keep a tally of the job titles people search for— the words themselves, such as “paid media specialist”, with a count of how often they were searched. This is what tells us which job titles mean the same thing, so a search for one finds postings advertised under the other. It is stored as a plain tally, never attached to your submission, your email or your IP address, and a search containing anything that could identify someone (an email address, a phone number, a link, a postcode) is not recorded at all rather than recorded in a cleaned-up form. Your location is not stored alongside it; the search log described next is a separate record.

The search log. For every search we keep one anonymous record: what was searched (the job title you typed, or the job titles derived from your CV), the location you typed, your country (never your city), the type of device, the channel you arrived from, how many results came back and from which job boards, and how long the search took. Titles and locations follow the same rule as the title tally: anything that could identify someone is not recorded at all. The record holds no email address, no IP address and no identifier of any kind, so it cannot be linked to you or to your other searches. We keep it to understand demand over time and to improve our coverage.

What the AI costs to run. For every request to the AI provider we record the model, how many tokens it used, what it cost at the provider's list price and how long it took, linked to the search or letter it served. When you gave an email address for a letter, that record also carries the same pseudonymous hash of your email that enforces the daily limits, so we can measure what the service costs per user. It never carries the address itself, and the hash is removed from these records after 90 days. Searches carry no identifier, so their cost is never attributed to a person.

You can ask us to delete your email and LinkedIn URL at any time — a plain email is enough, and we will do it.

Third-party services

We use the following services, each with its own privacy policy:

• Vercel — website hosting, privacy-friendly cookieless visitor analytics (aggregate page counts; no cross-site tracking, no persistent identifiers), and page-speed measurement (how quickly pages load, by page, browser, device type and country; no cookies, nothing tied to you or your IP address)
• Neon — database storage (US region, SCCs; EU migration planned)
• Resend — email delivery
• OpenAI (or another configured AI provider, possibly routed via Vercel AI Gateway) — generating application drafts and translating search keywords
• Public job boards and aggregators (e.g. EURES, national employment services, company career APIs) — queried with your search keywords and location only (or a country, as described above)

International transfers

Some providers above process data in the United States (Vercel, Neon, OpenAI). These transfers rely on EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. We plan to move primary data storage to an EU region.

Children

The service is intended for people of working age and is not directed at children under 16. We do not knowingly collect data from children.

California residents (CCPA/CPRA)

We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. California residents have the rights to know, delete, and correct — exercise them via the contact below.

Cookies

The public tools use no advertising or analytics cookies. Visitor statistics are collected without persistent visitor identifiers. The founder dashboard uses an essential, HTTP-only session cookie after administrator sign-in; it expires after eight hours. An administrator can also mark one of their own browsers as a test device, which sets a second cookie in that browser only, so that testing is kept out of the statistics. Neither cookie is ever set for visitors. Browser session storage keeps form drafts, and local storage keeps My jobs, as described above.

Your rights

You have the right to access, correct, delete, restrict, or port your data, and to object to its processing (GDPR Art. 15–21), as well as the right to lodge a complaint with a supervisory authority. A plain email is enough — contact info@job-badger.com.