Privacy Policy

Last updated: April 24, 2026

1. Introduction

Jobiz ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our job search platform ("Service").

Data Controller. The Jobiz service is operated by ANTARES, based in Salerno, Italy (VAT 06439710655). The operator is the data controller within the meaning of Article 4(7) GDPR.

We comply with the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), the California Consumer Privacy Act (CCPA) for California residents, and other applicable privacy laws.

2. Information We Collect

2.1 Information You Provide

Account Information: Email address, name, password (hashed)
Profile Information: Job preferences, saved job searches, custom AI scoring criteria
Resume Data: Education history, work experience, skills, certifications, and other professional information you upload or enter
Payment Information: Payment method details are processed by our payment processor and not stored on our servers. We retain only transaction IDs and subscription status.
Communications: Support requests, feedback, and messages you send us

2.2 Information Collected Automatically

Usage Data: Pages visited, features used, search queries, jobs viewed, AI requests made
Device Information: Browser type, operating system, device type, screen resolution
Log Data: IP address, access times, referring URLs, error logs
Cookies and Similar Technologies: See our Cookie Policy

2.3 Information from Third Parties

Google OAuth: If you sign in with Google, we receive your name, email, and profile picture from Google
Google Drive: If you connect Google Drive, we create and access only spreadsheets we generate in your Drive for job-data export. We do not access your other Drive files, and we never access Gmail or any other Google service.

3. How We Use Your Information

We use your information for the following purposes:

3.1 Providing the Service

Creating and managing your account
Processing job searches and displaying results
Running AI extraction on job listings
Generating tailored resumes and cover letters
Executing automated job searches
Sending email notifications about job matches
Exporting data to Google Sheets

3.2 Processing Payments

Processing subscription payments through our payment processor
Managing billing cycles and quotas
Handling refund requests (in exceptional cases)

3.3 Improving the Service

Analyzing usage patterns to improve features
Debugging and fixing technical issues
Developing new features based on user needs

3.4 Communication

Responding to support requests
Sending service-related announcements
Notifying you of changes to our terms or policies

3.5 Legal Compliance

Complying with legal obligations
Protecting our rights and preventing fraud
Responding to legal requests from authorities

3.6 Automated Processing and AI

We use artificial intelligence to deliver core features of the Service:

CV analysis: We extract structured data (skills, experience, education, languages) from the CV you upload, to enable matching and editing features.
Job match score: We compute a compatibility score between your profile and job listings to help you prioritize applications.
Content generation: We generate tailored resumes and cover letters based on your CV and the target job.

These features are advisory. The match score is a recommendation: you decide which jobs to apply to. Generated content is a draft that you review and edit before submitting. No automated decision producing legal or similarly significant effects on you is taken within the meaning of Article 22 GDPR.

How it works, at a high level: your CV text and the job listing text are sent to a large-language-model provider acting as our data processor under a Data Processing Agreement with appropriate transfer safeguards. The provider returns extracted fields, a numeric score, or generated text, which we store in your account. The current AI provider is listed in Section 5.1.

Your controls:

You can stop using AI features at any time by not triggering them.
You can delete AI-generated content from your account.
You can request deletion of all your data (Section 8).
You can contact us at dpo@jobiz.io to ask for human review of any AI output that affects you.

For users in the EEA, we process your data based on:

Contract Performance: Processing necessary to provide the Service you requested (account management, job searches, AI features)
Legitimate Interests: Improving our Service, preventing fraud, ensuring security
Consent: For optional features like marketing communications (you can withdraw consent anytime)
Legal Obligation: When required by law (e.g., tax records, legal requests)

4.1 Whether You Are Required to Provide Data

Providing your email and password (or signing in with a third-party identity provider) is necessary to create an account; without it, we cannot offer the Service. Uploading a CV is necessary to use the AI features (CV analysis, match score, content generation); without a CV, those features will not function. Date of birth and gender are optional and do not affect access to the Service. Refusing to provide required data simply means the corresponding feature or the Service as a whole is unavailable to you; there is no further consequence.

The Service does not require, request, or solicit special categories of personal data within the meaning of Article 9 GDPR, that is, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, health data, or data concerning your sex life or sexual orientation.

We strongly recommend that you do not include such information in your CV, cover letters, or profile fields.

If you nevertheless choose to include such information (for example, a photograph that may reveal ethnic origin, a disability mention, or membership of a protected category), your voluntary inclusion constitutes explicit consent to our processing of that information for the purposes described in Section 3, on the legal basis of Article 9(2)(a) GDPR. The consent is demonstrated by a clear affirmative act: the deliberate upload or entry of the content after you have read this Privacy Policy.

You can withdraw this consent at any time by editing your CV or profile to remove the information, or by deleting your account (Section 8). Withdrawal does not affect the lawfulness of processing before withdrawal. We do not profile, score, or make automated decisions on the basis of special-category data.

We share your information with the following categories of third parties:

5.1 Service Providers

We rely on a small number of third-party processors to deliver the Service. Each of them is bound by a Data Processing Agreement and, where relevant, by Standard Contractual Clauses for transfers outside the EEA.

Category of provider	Purpose	Data shared	Location of processing
Authentication & database provider	Account authentication, user data storage	Account data, usage data	European Union
Cloud infrastructure provider	Application hosting, storage of user content including CVs	All service data	European Union
Payment processor	Subscription payments, billing	Email, payment details	European Union / United States
AI language-model provider	CV analysis, match score, tailored content generation	Job data and CV data (with a contractual no-training clause on user inputs)	United States
Error-monitoring provider	Application error logs, diagnostics	Error logs, device info	European Union
Product-analytics provider	Product analytics and session replay (client-side analytics and replay are consent-gated; limited product-usage measurement also runs under legitimate interest)	Masked interaction data; product-usage data	European Union
Live-chat platform	Customer support conversations	Chat messages, email (if provided)	European Union
Email delivery provider	Transactional email (verification, billing, account notices)	Email address, message content	European Union / United States

The specific identity of each provider is recorded in our internal Record of Processing Activities and is available on request: write to dpo@jobiz.io and we will share the current list, for instance if you need it for your own compliance documentation.

Google Drive/Sheets: Only when you explicitly connect and authorize access

5.3 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6. International Data Transfers

Most of your data is processed inside the European Union (see Section 5.1). The main exception is the AI language-model provider, which processes CV and job-listing text in the United States to deliver CV parsing, match scoring, and content generation.

For this transfer, and for any other transfer of personal data outside the EEA, we rely on the following safeguards under Chapter V of the GDPR:

Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision 2021/914), Module 2 (Controller-to-Processor), supplemented by a Transfer Impact Assessment documenting the technical and organisational measures applied to mitigate access risks in the destination country.
Adequacy decisions, where the European Commission has formally recognised that the destination country provides an essentially equivalent level of protection (for example, the EU-US Data Privacy Framework when the receiving organisation is certified).
Your explicit consent, only where no other safeguard applies and only after we have informed you of the specific risks of the transfer.

You can request a copy of the SCCs in force for any specific transfer by writing to support@jobiz.io.

7. Data Retention

We retain your data for as long as necessary to provide the Service and fulfill the purposes described in this policy:

Account Data: Retained while your account is active and for 30 days after deletion request
Usage Data: Retained for up to 24 months for analytics
Security Logs: A record of each request to our servers (your account, IP address, browser, what was requested, and how many job listings it returned) is kept for 90 days to detect scraping and abuse, then deleted
Payment Records: Retained for 7 years as required by tax laws
Support Communications: Retained for 3 years
AI-Generated Content: Retained while your account is active; deleted upon account deletion

7.1 Inactivity

We are implementing an inactivity-cleanup process under which an account that has not been signed into for 24 consecutive months will receive a reminder email and, if no sign-in occurs within the following 30 days, will be permanently deleted together with the CV and all associated AI-generated content. Billing and tax records retained under legal obligation (see above) are the only exception. Until this process is fully operational you can request account and CV deletion at any time under Section 8.

8. Your Rights

8.1 Rights for All Users

Access: Request a copy of your personal data
Correction: Update or correct inaccurate data
Deletion: Request deletion of your data (subject to legal retention requirements)
Data Portability: Receive your data in a structured, commonly used, machine-readable format. To request an export, email us at support@jobiz.io or use the "Request" button under the "Export your data" section in Settings → Help → Privacy & your data. We respond without undue delay and within one month of receipt of the request, as required by GDPR Art. 12(3). Where the request is particularly complex or where we receive a high volume of requests, we may extend that period by up to two further months and will inform you of the extension and its reasons within the first month.

Restriction: Request restriction of processing in certain circumstances
Objection: Object to processing based on legitimate interests
Withdraw Consent: Withdraw consent at any time (where processing is based on consent), without affecting the lawfulness of processing carried out before withdrawal
No Solely Automated Decisions (Art. 22): Not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. As stated in Section 3.6, the Service does not engage in such decision-making.
Lodge Complaint: File a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country of residence or place of work

8.3 Additional Rights for California Residents (CCPA)

Notice at Collection. We collect the categories of personal information listed in Section 2 for the purposes described in Section 3, retain them in line with Section 7, and disclose them only to the categories of recipients listed in Section 5. We do not sell personal information for monetary consideration. To exercise your right to limit sharing for cross-context behavioral advertising, use the "Cookie Settings" link in the site footer.

Know: Know what personal information is collected, used, and shared
Delete: Request deletion of personal information
Correct: Request that we correct inaccurate personal information we hold about you (CPRA §1798.106)
Opt-Out: Opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell your personal information for monetary consideration. We use processors for product analytics; client-side analytics and session replay are consent-gated (see Section 10). You can confirm or change your choice at any time using the "Cookie Settings" link in the site footer.
Limit Use of Sensitive Personal Information: Restrict our use of sensitive categories of personal information to what is necessary to provide the Service. We do not use sensitive personal information to make inferences about your characteristics, see Section 4.2 for details.
Non-Discrimination: Not be discriminated against for exercising your rights

To exercise any of these rights, contact us at support@jobiz.io or through your account settings.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption of data in transit (TLS/SSL) and at rest
Secure authentication with session management
Access controls limiting data access to authorized personnel
Regular security assessments and monitoring
Encryption of sensitive data like Google OAuth tokens

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Cookies and Tracking

We use cookies and similar technologies to provide and improve the Service. For detailed information, please see our Cookie Policy.

10.1 Product Analytics and Session Recording

We use a product-analytics provider (a data processor based in the European Union, with data stored in Germany) to understand how our product is used, diagnose issues, and improve features. This includes aggregate usage analytics and replays of your interactions with our interface.

Sensitive fields (your CV, cover letters, profile information, and other content areas that display personal data) are masked client-side before leaving your browser. All input fields are masked by default, and we do not store your IP address.

Client-side analytics and session replay use cookies / local storage and run only with your consent (see Section 10.2). Separately, we process limited product-usage data on the basis of legitimate interest to operate, secure, and improve the Service (see Sections 3–4); this first-party processing places no cookies on your device, and you can object to it under Section 9.

Because privacy laws differ by jurisdiction, what you see when you first visit the Service depends on where you are:

European Union, European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR / nFADP): you will see a consent banner on your first visit, and cookie-based, client-side analytics and session recording are disabled until you explicitly accept. The legitimate-interest processing described in Section 10.1, which uses no cookies, may still apply. You can change your choice at any time via the "Cookie Settings" link in the site footer.
Other jurisdictions (including the United States, Canada, LATAM, and Asia-Pacific): product analytics and session recording are enabled by default, consistent with local notice-and-opt-out privacy regimes. You can opt out at any time via the "Cookie Settings" link in the site footer. California residents: toggling analytics off there is equivalent to exercising your "Do Not Sell or Share My Personal Information" right under the CCPA/CPRA.

We detect your region from the country code provided by our content delivery network. If our detection is incorrect or if you want the stricter consent experience regardless of location, use the "Cookie Settings" link in the footer to disable analytics.

10.3 What You Can Control

Click "Cookie Settings" in the site footer at any time to open the consent settings. From there you can enable or disable product analytics and session recording.

Disabling analytics stops client-side, cookie-based analytics and session recording immediately, and places no analytics cookies on your device. The legitimate-interest processing described in Section 10.1 uses no cookies and is not affected; you can object to it under Section 9. Previously collected data remains subject to the retention rules in Section 7 and can be deleted on request under Section 8.

11. Children's Privacy

The Service is not intended for children under 16 years of age, or such lower age (between 13 and 16) as the Member State of the user's residence may have set under Article 8(1) GDPR. Where the user is below the applicable age threshold, processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility.

We do not knowingly collect personal information from children below the applicable age threshold. If we learn that we have collected such information without the required parental authorisation, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

Posting the updated policy on this page with a new "Last updated" date
Sending an email notification for material changes
Displaying a notice in the application

Your continued use of the Service after changes indicates acceptance of the updated policy.

13. Contact Us

For privacy-related questions or to exercise your rights under this Policy, contact our privacy contact:

Email: dpo@jobiz.io
General support: support@jobiz.io

We have not designated a Data Protection Officer, as the designation criteria of Article 37 GDPR do not apply to our processing activities. The address above reaches the data controller directly.

The data controller is identified in Section 1.

We will respond without undue delay and within the timeframes set out in Section 8.1.

If you are located in the EEA and you believe our processing of your personal data infringes the GDPR, you also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country of residence or place of work.