Privacy Policy

1. Data Controller

The data controller for the purposes of the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws is:

• Trading name: JobSurf AI
• Business type: Sole proprietorship
• Location: Barcelona, Spain
• Email: hello@jobsurfai.com

JobSurf AI is a SaaS platform designed to help job seekers streamline their job application process using artificial intelligence. This Privacy Policy explains how we collect, use, store, share, and protect your personal data.

For any privacy-related inquiries or to exercise your data rights, contact us at hello@jobsurfai.com.

2. Information We Collect

When you use JobSurf AI, we collect the following types of information:

• Account Information: Name, email address, and hashed password when you create an account.
• CV and Profile Data: Resume/CV content you upload, including parsed data such as full name, email, phone number, physical address, work history, education, skills, certifications, and job preferences. This is the core data the Service processes.
• Job Application Data: Records of jobs you apply to, application status, AI-generated cover letters, AI-optimized CVs, and interview preparation materials created by the Service.
• Payment Information: Billing details (name, billing address, last four digits of card) processed securely through Stripe (our payment processor). We never store your full credit card numbers on our servers.
• Usage and Analytics Data: Pages visited, features used, session duration, device type, browser information, IP address, and approximate location. This data is collected through our internal analytics system and, where you have consented, Google Analytics.
• Communication Data: Emails sent/received through the platform, customer support interactions, and feedback submitted.
• Automatically Collected Data: Essential cookies, authentication tokens, device identifiers, and server log data necessary to operate the Service securely.

3. How We Use Your Information

We use your information for the following purposes:

• To provide and maintain the JobSurf AI service, including CV parsing, job matching, and application tracking
• To generate AI-tailored cover letters, CV optimizations, and interview preparation materials using your profile data
• To match you with relevant job opportunities based on your profile, skills, and preferences
• To submit job applications on your behalf where you have explicitly enabled this feature
• To send transactional emails about your applications, job matches, and account updates
• To process subscription payments and manage your billing through Stripe
• To analyze platform usage and improve our service (via internal analytics and, where consented, Google Analytics)
• To detect, prevent, and respond to fraud, abuse, or security incidents
• To enforce our Terms of Service and prevent prohibited uses
• To comply with legal obligations

4. AI Processing of Your Data

A core function of JobSurf AI involves processing your personal data through artificial intelligence. You should understand:

• What is processed: Your CV content, work history, skills, education, and job preferences are sent to AI providers to generate personalized cover letters, CV optimizations, job match scores, and interview preparation content.
• Who processes it: We use OpenAI's API as our primary AI service provider (data processor). Your data is transmitted securely to OpenAI's servers for processing. OpenAI processes this data under their enterprise data privacy policy, which states that API data is not used to train their models.
• Automated decision-making: The Service uses automated scoring to rank job matches against your profile. These scores are advisory only and do not limit your ability to apply to any job. You are never required to rely on automated recommendations.
• Human review: All AI-generated content is presented to you for review before submission. You are responsible for reviewing and approving all materials.

5. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the service you signed up for, including CV parsing, job matching, AI content generation, and application submission.
• Legitimate Interest (Art. 6(1)(f)): Improving our platform, preventing fraud, ensuring security, enforcing our terms, and analyzing usage patterns.
• Consent (Art. 6(1)(a)): Where you explicitly opt in, such as analytics cookies, email digest notifications, marketing communications, and enabling auto-apply features.
• Legal Obligation (Art. 6(1)(c)): Where required by law (e.g., financial record-keeping, responding to lawful data requests).

6. Data Sharing, Third Parties, and Processor Roles

We do not sell your personal data. We share information only with the following service providers (acting as data processors or independent controllers as noted), strictly for the purposes described:

• OpenAI (Data Processor): We send CV and job data to OpenAI's API to generate personalized cover letters, CV optimizations, and interview prep content. OpenAI acts as a data processor. API data is not used to train their models per their enterprise data privacy policy.
• Stripe (Data Processor / Independent Controller): Handles all payment processing securely. We do not access or store your full card details. Stripe processes payment data as an independent controller for compliance purposes. See Stripe's privacy policy.
• SendGrid (Data Processor): Delivers transactional and digest emails on our behalf. Email addresses and message content are shared with SendGrid acting as a data processor for this purpose.
• Google Analytics (Data Processor, where consented): Where you have accepted analytics cookies, Google Analytics collects anonymized usage data (pages visited, session duration, device information) to help us understand platform usage. You can opt out using the Google Analytics Opt-out Browser Add-on or by declining analytics cookies via our cookie consent banner.
• Job Data Providers: We fetch job listings from third-party APIs (JSearch/Adzuna, Jobicy, Himalayas, The Muse, RemoteOK). Your personal data is not shared with these providers for the purpose of fetching listings.
• Employer Platforms and Job Boards: When you initiate or enable an application, your CV, cover letter, and relevant profile data may be submitted to third-party employer platforms and job boards as part of the application process. This is the core function of the Service and is performed only with your authorization.

We may also share data if required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of assets (in which case you will be notified).

7. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

• Essential Cookies (always active): Required for authentication, session management, security, and cookie consent preference storage. These cookies are strictly necessary for the Service to function and cannot be disabled.
• Analytics Cookies (consent required): Google Analytics uses cookies to collect anonymized usage statistics (pages visited, time on site, device info). These cookies are only activated if you click "Accept All" on our cookie consent banner. If you click "Essential Only", analytics cookies are not loaded and Google Analytics is disabled for your session.

We do not use third-party advertising, retargeting, or tracking pixels. You can manage your cookie preferences at any time through your browser settings. To change your consent after initial selection, clear your browser's local storage for this site and the cookie banner will reappear on your next visit.

For more details on how Google Analytics processes data, see Google's Privacy Policy.

8. Data Security and Incident Response

We implement reasonable technical and organizational measures to protect your data, including:

• All data is transmitted over HTTPS (TLS encryption) in transit
• Passwords are hashed using bcrypt before storage — we never store passwords in plain text
• Authentication uses secure JWT tokens with expiration
• Database access is restricted via authentication credentials and network policies
• Payment data never touches our servers — it is handled directly by Stripe
• Access to production systems is restricted to authorized personnel only
• Rate limiting and anti-bot protections are implemented to prevent abuse

While we take reasonable measures to protect your data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

Incident response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by the GDPR, and will notify affected users without undue delay where the breach is likely to result in a high risk. If you suspect unauthorized access to your account or data, please contact us immediately at hello@jobsurfai.com.

9. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Account and CV Data: Retained while your account exists. Permanently deleted within 30 days of account deletion.
• Application Records: Retained while your account exists for your tracking purposes.
• Payment Records: Retained as required by financial regulations (typically 7 years for tax/accounting purposes).
• Analytics Data: Google Analytics data is retained for 14 months, then automatically deleted by Google.
• Server Logs: Retained for up to 90 days for security and debugging purposes.

After account deletion, all personal data is permanently removed from our active systems within 30 days. Some data may persist in encrypted backups for up to 90 days before being purged.

10. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of these rights, email us at hello@jobsurfai.com or use the self-service options in your account settings. We will respond within 30 days (or sooner where required by law). We may need to verify your identity before processing your request.

11. International Data Transfers

Your data may be processed by third-party service providers located outside the European Economic Area (EEA), including in the United States (OpenAI, Stripe, Google, SendGrid). These transfers are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements (DPAs) with each sub-processor
• EU-U.S. Data Privacy Framework certifications where applicable

12. Children's Privacy

JobSurf AI is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately at hello@jobsurfai.com and we will promptly delete the data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date, and where practicable, sending you an email notification. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you do not agree, you must stop using the Service.

14. Contact and Complaints

If you have questions, concerns, or complaints about this Privacy Policy or our data practices:

• Email: hello@jobsurfai.com
• Trading name: JobSurf AI
• Business type: Sole proprietorship
• Location: Barcelona, Spain

If you are in the EU and believe your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es or your local supervisory authority.