Privacy Notice

Last updated 28 May 2026 · v2026-05-28

JobFoundry ("we", "us") is the data controller for personal data you provide while using this service. This notice explains what we collect, why, on what legal basis, and the rights you have under the UK GDPR and EU GDPR. We are committed to processing your data in line with the principles of ISO/IEC 27001 (information security) and ISO/IEC 27701 (privacy information management).

1. What we collect

• Identity & contact: name, email, avatar (if you sign in with Google).
• Career data you upload: CV files, CV text, career goals, target roles, skills.
• Generated content: AI analyses, rewrites, cover letters, interview transcripts.
• LinkedIn data: only the profile fields you explicitly authorise via OAuth.
• Usage data: feature counters, plan tier, and minimal request logs.
• Cookies: strictly necessary session cookies; optional analytics with consent.

2. How we use it (purposes & lawful bases)

• Provide the service - contract (Art. 6(1)(b)).
• AI analysis of your CV / LinkedIn / interviews - contract.
• Account security and abuse prevention - legitimate interests (Art. 6(1)(f)).
• Product analytics - consent (Art. 6(1)(a)), revocable at any time.
• Marketing emails - consent, with one-click unsubscribe.

3. Automated decision-making

We use AI to generate scores and suggestions (ATS score, role fit, interview feedback). These are decision-support outputs, not automated decisions with legal effects under Art. 22 GDPR. You can request human review of any output by emailing privacy@career-os.app.

4. Sharing & sub-processors

• Cloud hosting & database (Lovable Cloud, infrastructure region: EU).
• AI model providers used to generate analyses (text only; no training on your data).
• LinkedIn (only when you connect your account and only for authorised scopes).

We do not sell your personal data. Ever.

5. International transfers

Data is hosted in the EU by default. Where sub-processors operate outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

6. Retention

• Account & career data: while your account is active, then deleted within 30 days of closure.
• Consent records: 6 years (audit obligation).
• Backups: rolling 30-day window, then overwritten.

7. Your rights

Under UK/EU GDPR you have the right to:

• Access your data and receive a copy (Art. 15) - use Export my data.
• Rectify inaccurate data (Art. 16).
• Erase your data (Art. 17) - use Delete my account.
• Restrict or object to processing (Art. 18 & 21).
• Data portability - your export is a machine-readable JSON file (Art. 20).
• Withdraw consent at any time without affecting prior processing.
• Lodge a complaint with the ICO (UK) or your local supervisory authority.

Self-service controls live in Privacy settings. For anything else, contact privacy@career-os.app.

8. Security

We apply controls aligned with ISO/IEC 27001 Annex A: encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access, row-level security on every user table, audit logging of data subject requests, least-privilege service credentials, and regular dependency scanning.

9. Children

JobFoundry is not directed at children under 16. We do not knowingly collect their data.

10. Changes

We will notify you in-app of any material change before it takes effect. The current version identifier is shown at the top of this page and recorded against your consent.