Privacy Policy

JobPilot AI (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains what data we collect, how we process it, and your rights regarding that data. By using our service, you consent to the practices described in this policy.

1. Information We Collect

We collect the minimum data necessary to provide our service:

• Account Information: Name, email address, and a securely hashed password (bcrypt) when you register.
• AI History: The outputs generated by our AI features (optimized resumes, cover letters, interview answers, scores, etc.) are saved to your account so you can access them later. You can delete individual results or your entire history at any time.
• Saved Content: Resumes, cover letters, saved jobs, portfolio data, and networking contacts you explicitly save to your account.
• Portfolio Data: If you create a portfolio, the content you add (name, experience, skills, projects, gallery items) is published at a public URL that anyone with the link can view.
• Usage Metadata: AI feature usage counts, subscription plan type, and quality feedback ratings — used for plan enforcement and service improvement.
• Audit Logs: We log security-relevant events (logins, AI requests, rate limit hits) with user IDs and IP addresses for abuse prevention and security monitoring.
• Payment Information: If you subscribe to a paid plan, payments are processed by Stripe. We receive only a customer ID and subscription status — never your full card details.

2. How We Process Your Career Data

When you use our AI features:

• Your input text (resume, LinkedIn profile, job description) is sent from your browser to our secure API endpoint.
• Our server forwards it to Google Gemini AI for processing.
• The AI-generated result is returned to your browser and saved to your AI History so you can access it later.
• Your original input text (the resume or job description you submitted) is not stored on our servers after the request completes — only the AI output is retained.
• You can view, re-use, or delete any saved AI result from your History page at any time.

Additionally, if you explicitly save a resume, cover letter, or other content to your account, that data is stored in our database until you delete it or delete your account.

3. Third-Party Data Processors

We use the following third-party services to operate:

• Google Gemini AI:Processes your text to generate AI outputs. Google's API terms state that data sent via API is not used to train their models. See: Google Cloud Data Processing Terms.
• Vercel:Hosts our application and handles HTTPS traffic. Data passes through Vercel's infrastructure during requests.
• Turso (LibSQL): Stores account data (name, email, hashed password, usage counts, AI history, saved content). Encrypted at rest and in transit.
• Stripe: Handles subscription billing. We receive only a customer ID and subscription status — never your full card details.
• Resend: Sends transactional emails (account verification, password resets, notifications). Receives your email address for delivery purposes only.
• Sentry: Monitors application errors and performance. May receive technical error context (never resume content or personal career data).
• Upstash Redis: Provides rate limiting and caching. Stores temporary, anonymized request counters — no personal content.

We do not sell, rent, or share your personal data with any third party for advertising, marketing, or profiling purposes.

4. Data Security

• All connections use TLS/HTTPS encryption in transit.
• Passwords are hashed with bcrypt (cost factor 12) — we cannot see your password.
• Database is encrypted at rest by our database provider (Turso).
• Sessions use secure, HTTP-only JWT tokens.
• API endpoints require authentication — no anonymous access to user data.

While we implement industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security and are not liable for breaches beyond our reasonable control.

5. Data Retention

• Account data: Retained until you delete your account.
• AI-generated outputs: Saved to your AI History for future reference. You can delete individual results or your full history at any time.
• Original input text: Not retained on our servers after the AI request completes.
• Saved content (resumes, cover letters, portfolios, jobs): Retained until you manually delete them or delete your account.
• Audit logs: Security event logs are retained for up to 90 days for abuse prevention, then automatically purged.
• After account deletion: All personal data is permanently removed from our active database immediately. Backup copies, if any, are purged within 30 days.

6. Your Rights

Regardless of your location, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Deletion: Delete your account and all associated data at any time from Settings, or by contacting us.
• Right to Rectification: Correct inaccurate personal data.
• Right to Data Portability: Export your data in a machine-readable format.
• Right to Withdraw Consent: Stop using the service at any time. Previously processed data (ephemeral) is already gone.
• Right to Object: Object to processing of your data for specific purposes.

These rights apply under GDPR (EU/UK), CCPA (California), Australian Privacy Act, and similar regulations. To exercise any right, use the account deletion feature in Settings or email us.

7. Cookies

We use essential cookies only for authentication session management. We do not use tracking cookies, advertising pixels, third-party analytics (no Google Analytics), or any form of cross-site tracking. No cookie consent banner is required because we only use strictly necessary cookies.

8. Children's Privacy

Our service is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we discover that a user is under 16, we will delete their account and data immediately.

9. International Data Transfers

Our servers and third-party processors may be located outside your country of residence. By using our service, you consent to the transfer of your data to these locations. We ensure all processors maintain adequate data protection standards.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered users at least 14 days before taking effect. Your continued use of the service after changes constitutes acceptance.

11. Contact Us

For privacy-related questions, data access requests, or to exercise any of your rights, contact us at: privacy@jobpilotai.co

We aim to respond to all privacy requests within 14 business days.