Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how Joballyzer ("we", "us") collects, uses, and protects your personal data when you use the service at this website. Joballyzer is operated by Erik Alfred Larsson, an individual sole trader based in Sweden, who is the data controller for the purposes of the EU General Data Protection Regulation (GDPR).

1. What data we collect

• Account data: your email address, and your name if you provide one when signing up or via Google sign-in.
• Application content: the CV, job description, and cover letter text and/or files you submit for analysis.
• Usage data: IP address and request timestamps, used only to enforce fair-use limits and prevent abuse.
• Analytics data: only if you accept the cookie banner — page views and general usage patterns, collected via Google Analytics. See section 7 below.
• Payment data: if you purchase a plan, payment is processed entirely by Stripe. We never see or store your card details, we only receive confirmation that a payment succeeded and an identifier for your Stripe customer record.
• Feedback: if you use the in-app feedback form, we collect your message, an optional star rating, the page you submitted it from, and your account email (or an email you choose to provide) so we can review it and follow up if needed.

Your CV may contain sensitive details (such as a photo, nationality, or health information) if you choose to include them. We only ever use this content to generate your analysis, never for any other purpose, and we recommend leaving out anything you don't want processed unless it's relevant to your application.

2. Why we process your data

• To provide the service (performance of a contract with you): generating your CV/job-match analysis, maintaining your account and analysis history, and processing payments.
• To keep the service secure and fair (legitimate interest): rate-limiting and abuse prevention using IP addresses and usage timestamps.

We do not use your data for advertising, and we do not sell your data to anyone.

3. Who we share data with

We use the following sub-processors, each solely to help us deliver the service:

• Anthropic: receives your CV/job description/cover letter text to generate the analysis. Per Anthropic's API terms, data submitted through the API is not used to train their models.
• Supabase: provides authentication, our database, and file storage.
• Stripe: processes payments for one-time and subscription plans.
• Google: provides the optional "Sign in with Google" option, and, only if you accept the cookie banner, Google Analytics for understanding how the service is used.
• Vercel: hosts the application.
• Resend: sends transactional emails (like feedback confirmations) and, if you have an account, occasional product-update emails on our behalf.

Some of these providers may process data outside the EU/EEA (e.g. in the United States). Where that happens, they do so under their own GDPR-compliant safeguards (such as Standard Contractual Clauses).

If you create an account, your email address may be added to a product-update mailing list so we can let you know about major changes to the service. Every update email includes a working unsubscribe link, and unsubscribing takes effect immediately. It does not affect your account or any other email from us.

4. How long we keep your data

• Account, analysis history, and uploaded files: kept until you delete them or ask us to close your account. Deleting an analysis also deletes the files attached to it.
• Analysis usage logs (IP address or account reference, plus timestamps), used to enforce fair-use limits: automatically deleted after 40 days by a scheduled job.
• Other operational logs — per-endpoint request counts used for rate limiting, payment-event records, and internal error alerts: automatically deleted after 14 days.
• Feedback you submit through the in-app form: kept until we've acted on it, then deleted on request.
• Payment records: Stripe retains transaction records under its own policy, and we may need to keep basic invoice data for as long as Swedish bookkeeping law requires (currently seven years).

These retention periods are enforced automatically, not manually — the logs above are pruned on a daily schedule rather than kept indefinitely.

5. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Request a portable copy of your data
• Object to or restrict certain processing

You can exercise your right to erasure directly: Account settings contains a "Delete account" option that permanently removes your account, your saved analyses, and your uploaded files straight away, with no need to contact us. For any of the other rights above, email us at joballyzer@gmail.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY, short for Integritetsskyddsmyndigheten), or your local supervisory authority.

6. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and why, to request a copy of it, to request its deletion, to correct inaccurate information, and to not be discriminated against for exercising any of these rights. The categories of personal information we collect are listed in section 1 above, and the purposes in section 2.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — under the CCPA/CPRA definitions of those terms. We have not done so in the preceding 12 months. Because we don't, we do not offer a "Do Not Sell or Share My Personal Information" link.

To delete your data, use the "Delete account" option in Account settings. For any other California right, email joballyzer@gmail.com. We will verify your request using the email address associated with your account and respond within the timeframe the law requires. You may also use an authorised agent to submit a request on your behalf.

7. Cookies and local storage

We use your browser's local storage to keep you signed in. This is strictly necessary for the service to work and is not a tracking or advertising mechanism, and it doesn't require consent.

Separately, we'd like to use Google Analytics to understand how people use Joballyzer — things like which pages get visited and general usage patterns. This is optional and off by default: it only runs if you click "Accept" on the cookie banner shown on your first visit, and Google Analytics sets its own cookies only once you do. We do not use Google Analytics for advertising, and we have not enabled Google Signals or any Google Ads integration. You can change your decision at any time via "Cookie preferences" in the footer, and declining or later withdrawing consent stops new analytics cookies from being set.

8. Security

All traffic to Joballyzer is encrypted (HTTPS). Uploaded files are stored in a private storage bucket and are only ever accessible via short-lived signed links generated for you specifically. Access to your data is restricted at the database level so that only you (or our backend, to provide the service) can read or modify it.

9. Children

Joballyzer is not intended for anyone under 18 years old. We do not knowingly collect data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above.

11. Contact

Questions about this policy or your data? Email joballyzer@gmail.com.