Privacy Policy

The controller of your data is TETA ABC SRL (tax ID 22404824, trade register J2007001135104), with its registered office at Str. Centrală nr. 169, sat Mărăcineni, Buzău County, postal code 127325, Romania. We provide Joben at joben.eu.

For any question about your data, write to privacy@joben.eu. We have not appointed a Data Protection Officer (DPO) because we do not fall under the cases in Article 37 GDPR, and privacy@joben.eu is our data protection contact point.

We process data under Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018, Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in electronic communications, and Directive 2002/58/EC (ePrivacy).

Each category of data has a specific purpose and legal basis:

• Account data (email address, first and last name, the sign-in method managed by Clerk, including the name, email and profile picture received from Google if you sign in with Google, chosen language, date and version of the Terms accepted): we create and secure your account and prove acceptance of the Terms. Basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in proving acceptance of the terms (Art. 6(1)(f)).
• Your content (CVs, cover letters, text pasted into the editor, files uploaded for import, AI analyses and results): we provide the features you created the account for. Basis: performance of the contract.
• Payment data (Stripe customer, subscription and payment IDs, chosen plan, promo codes used): we process payments and keep accounting records. Your card number is entered directly at Stripe and never reaches us. Basis: performance of the contract and the legal obligation to keep accounting records (Art. 6(1)(b) and (c)).
• Free ATS checker without an account: the CV file is analysed in memory and is not saved. We keep the score, the generated report (categories and issues found), the language, a hash of the IP address, a random device identifier from the jb_atsdid cookie and, if you enter it, your email address. Purposes: delivering the report, the daily anti-abuse limit and linking the report to your account if you create one. Basis: steps at your request before a contract (Art. 6(1)(b)) for the report, legitimate interest in preventing abuse (point (f)) and your consent for the follow-up emails described below.
• Service emails (confirmations, reports, invoices, notices about your account or subscription): basis performance of the contract. Follow-up emails to visitors of the ATS checker without an account (up to 2, after 48 hours and after 7 days): basis your consent (Art. 6(1)(a) GDPR and Art. 12 of Law no. 506/2004), given when you submit your address. Emails about similar features to users with an account: basis legitimate interest and Art. 12(2) of Law no. 506/2004. Every email contains an unsubscribe link. After you unsubscribe we keep the address on a suppression list so that we respect your refusal.
• Referral programme (the referral code, the link between the person who invites and the person invited, date, Pro days granted): we grant rewards and apply programme limits. Basis: performance of the contract and legitimate interest in preventing abuse.
• Security and diagnostics (technical logs, request identifiers, error messages, the IP address in error reports, IP hash for rate limiting): we protect the service, prevent abuse and fix errors. Basis: legitimate interest (Art. 6(1)(f)) and the security obligation in Art. 32 GDPR.
• Usage analytics and session recordings (PostHog, Google Analytics, Sentry Replay): we understand how the product is used. Basis: your consent only (Art. 6(1)(a) GDPR and Art. 4(5) of Law no. 506/2004). Without your consent these tools do not load.
• Feedback and correspondence (the email address and message you send us): we reply and improve the product. Basis: legitimate interest and, where relevant, performance of the contract.

Account data is required to create an account. Without it we cannot provide the service. The optional analytics and the follow-up emails from the ATS checker depend only on your choice.

When you use an AI feature (CV analysis, job tailoring, cover letter, bullet rewriting, CV file import), we send the relevant text and, on import, the file to Anthropic (the Claude models), our AI provider, solely to generate the result you asked for. We do not send your account data (email, user ID). The CV text does contain whatever you wrote in it, including your name and contact details. Under Anthropic commercial API terms, data sent through the API is not used to train its models. Anthropic deletes API inputs and outputs within 30 days, unless the law or enforcement of its usage policy requires longer retention.

We do not use your CVs to train our own or anyone else's models.

The ATS score, evaluations and suggestions are indicative estimates generated automatically. They produce no legal effects on you, are not sent to employers and are not decisions based solely on automated processing within the meaning of Art. 22 GDPR. You decide what to use from them. Results are generated by an artificial intelligence system and may contain errors, so check them before use.

Please do not include special-category data in your CV (health, religious or political beliefs, ethnic origin, sex life). If you choose to include it anyway, we process it only to provide the service, based on your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw by deleting the information or the account.

We do not sell your data and do not use it for advertising. We share it only with providers acting as processors under data processing agreements, and only as far as necessary:

• Clerk (authentication and account management, USA)
• Supabase (database and storage of account content, AWS US-East region)
• Anthropic (AI processing, USA)
• Stripe (payments; also acts as an independent controller for fraud prevention and its own legal obligations, USA/EU)
• Resend (delivery of transactional and follow-up emails, USA)
• Upstash (rate limiting, cache)
• Vercel (application hosting and aggregated performance metrics without cookies, USA)
• Oracle Cloud Infrastructure (VPS server for parsing CV files and generating PDFs)
• Sentry (error monitoring, EU instance; Sentry Replay only with consent)
• PostHog (product analytics and session recordings, EU instance, only with consent)
• Google Ireland Limited (Google Analytics 4 through Google Tag Manager, only with consent)

We may also disclose data to authorities when the law requires it and to professional advisers (accountant, lawyer) bound by confidentiality.

Some providers (Supabase, Clerk, Anthropic, Stripe, Resend, Vercel, Google, Oracle) process data in the United States or in other countries outside the EEA. Transfers rely on the European Commission adequacy decision on the EU-US Data Privacy Framework for certified providers or, failing that, on the Standard Contractual Clauses (Decision (EU) 2021/914), supplemented by additional measures where needed.

You can request a copy of the applicable safeguards by writing to privacy@joben.eu.

• Account, CVs, cover letters and AI analyses: while the account is active. When you delete the account in Settings, the data is deleted immediately from the live database, and the provider's backups expire within 30 days.
• Inactive accounts: we delete them after 24 months without sign-in, following a warning email sent 30 days before. Accounts with an active subscription are not part of this deletion.
• ATS scans without an account: 90 days, if not linked to an account. If you create an account, the scan becomes part of your account.
• Sign-up terms acceptance token: 30 days.
• Logs of emails sent, product events and webhook logs: 12 months.
• Feedback messages: 24 months.
• Payment and invoicing records: the periods set by the Romanian Accounting Law no. 82/1991 (between 5 and 10 years), with us and with Stripe.
• Email suppression list (unsubscribed addresses): as long as needed to respect your refusal, only the address and the reason.
• Referral programme: while the accounts involved exist.
• Monitored public posts (section 12): 90 days.
• Error reports (Sentry): about 90 days. Rate limiting data (Upstash): from a few hours up to one month.
• Analytics data: PostHog events 12 months, PostHog session recordings 30 days, Google Analytics data at most 14 months.

Under the GDPR you have the following rights:

• access to the data we hold (Settings > Export my data gives an instant JSON export)
• rectification of inaccurate data (you can edit it directly in the app)
• erasure of your data (Settings > Delete account, processed immediately)
• restriction of processing
• data portability, in a structured, machine-readable format (the JSON export)
• objection to processing based on legitimate interest
• withdrawal of consent at any time, without affecting the lawfulness of earlier processing (the cookie banner, the unsubscribe link in emails or privacy@joben.eu)
• the right not to be subject to a decision based solely on automated processing with legal effects (Joben makes no such decisions)

For rights that cannot be exercised directly in the app, write to privacy@joben.eu. We reply within one month (extendable by up to two further months for complex requests, with notice to you) and do not charge fees, except for manifestly unfounded or excessive requests. We may ask for proof of identity to protect your data.

You have the right to lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro. If you live in another member state you can contact the authority in your country. You also have the right to apply to the competent courts.

We use strictly necessary cookies and, only with your consent, analytics tools. The full list, the purpose and duration of each, and how to change your choice are in the Cookie Policy, available at /cookies. You can change your choice at any time from the Cookie settings link in the footer of every page.

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS), row-level security (RLS) on tables holding personal data, database access only through server-side services, secret keys kept apart from client code, request rate limiting, hashing of IP addresses used for limiting and mandatory re-authentication when deleting an account.

If a personal data breach occurs that poses a risk to your rights, we notify ANSPDCP within 72 hours and inform you directly when the risk is high (Art. 33 and 34 GDPR). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Joben is intended for people aged 16 or over, the age of digital consent in Romania. We do not knowingly collect data from anyone under that age. If you believe a minor has given us data, write to privacy@joben.eu and we will delete it.

Joben may contain links to third-party sites (for example Stripe, ANPC or career resources). Those sites have their own privacy policies, for which we are not responsible.

We follow public posts on forums and social platforms where people ask for help with a CV or a job search, so that we can offer useful replies. For these posts we keep the link, the author's public username, the title and the text of the post for 90 days. Basis: legitimate interest (Art. 6(1)(f)). This is the notice required by Art. 14 GDPR for people whose public posts we process.

You can object at any time by writing to privacy@joben.eu, and your post is deleted.

We update this policy from time to time. For significant changes we send an email or show an in-app notice before they apply. The date of the last update appears at the top of the page, and earlier versions are available on request.

For requests or questions about personal data write to privacy@joben.eu. For other subjects use hello@joben.eu.