Privacy Policy

Version privacy-2026-07-22 · last updated 2026-07-22

Effective date: 2026-07-22 Last updated: 2026-07-22 Controller: DGLabs S.R.L., a limited liability company organized under the laws of Romania, with registered office at Str. Decebal nr. 31, ap. 8 și 9, Cluj-Napoca, județul Cluj, România, registered with the Romanian Trade Registry under J12/2135/2023, CUI RO48162325, EUID ROONRC.J12/2135/2023, VAT identification number RO48162325 (referred to in this Privacy Policy as "JobEmber", "we", "us", or "our"). Privacy contact: [email protected] Data Protection Officer: Not required under GDPR Article 37(1) at our current scale. Privacy queries and data-subject requests are handled by the founder directly at [email protected].

Plain-English summary (not legally binding — read the full Policy below). JobEmber is a paid AI service that helps you draft, audit, and track job applications. We collect your account, billing, writing samples, CV/cover-letter content, and how you use the product, in order to give you personalized AI outputs and to keep the service running. We do not sell your data, we do not use it to train AI models, and your writing samples are auto-deleted the moment your voice profile is built. Before any AI model ever sees your data, your identifying details — name, email, phone number, address, preferred cities — are replaced with placeholders; the real values stay in your account and are only re-inserted when you download a finished CV or cover letter. Anthropic processes prompts on our behalf and does not retain or train on them. You can self-serve a refund within 14 days, self-serve account-and-data deletion at any time, and you can complain to the Romanian Data Protection Authority (ANSPDCP) at any time. For anything else, write to [email protected].

At a glance — what / why / how long.

Category of data	Why we use it	How long we keep it
Account (email, name, password hash)	Run your account, log you in	Lifetime of account + 30 days
Billing data (last 4 of card, billing email, plan)	Process payments, comply with tax law	7 years after last transaction (Romanian/EU tax law)
Job-search preferences (roles, locations, salary, etc.)	Run the search agent, score job fit	Lifetime of account
Uploaded CVs and cover letters	Generate Outputs, populate the tracker	Lifetime of account
Writing samples	Build your voice profile	Auto-deleted on profile completion (max one retry)
Voice profile (derived)	Personalize Outputs to your style	Lifetime of account
Generated CVs / cover letters / messages	Show in your tracker, let you re-export	Lifetime of account
Application-tracker entries	Track applications you've sent	Lifetime of account
Feedback Channel verbatim text	Triage, respond, summarize	Purged ≤24h after we respond
Help Chat conversations	Generate the assistant's response	Not stored — in-memory only, purged at session end
Aggregate signals (Feedback / Help Chat / usage)	Improve product, no PII	Indefinite (anonymized)
Browser-extension activity	Run the extension features you invoke	Lifetime of account
Logs, security telemetry	Operate, debug, secure	90 days (then aggregated or purged)
Backups	Disaster recovery	30 days, then purged
Identity PII (name, email, phone, address, preferred cities) sent to AI providers	Replaced with placeholders before any LLM call	Real values never sent; placeholders are re-hydrated only at the moment you download a PDF / DOCX

1. Who we are

1.1 The data controller for personal data processed in connection with JobEmber is DGLabs S.R.L. (the "Controller"), a Romanian limited liability company. Full corporate identifiers are above.

1.2 Questions about this Privacy Policy or the processing of your personal data go to [email protected]. For formal data-protection requests (access, rectification, erasure, restriction, portability, objection, withdrawal of consent), use the same address — see Section 10 for how we handle each request.

1.3 Where applicable law requires the appointment of a Data Protection Officer (Article 37 GDPR), the DPO is reachable at [email protected].

2. Scope

2.1 This Privacy Policy describes how we collect and process personal data through:

The marketing site at jobember.ai;
The web application at app.jobember.ai;
The "JobEmber" Chrome browser extension;
The Feedback Channel and Help Chat features inside the web application;
Email, payment, and customer-support communications with us.

2.2 This Privacy Policy is referenced by the JobEmber Terms and Conditions at jobember.ai/terms and forms part of those Terms.

2.3 Linked third-party websites, employer career sites, ATS portals, job platforms, payment-processor checkout pages, and third-party login providers are governed by their own privacy notices. Use of those services is at your own discretion.

3. Personal data we collect

We collect personal data in three ways: (a) data you give us directly, (b) data generated as you use the Service, (c) data we receive from third-party providers (e.g. payment processors, OAuth providers).

3.1 Account data

When you create a JobEmber account we collect: email address, display name, hashed password (or OAuth provider identifier if you sign in with Google or GitHub), preferred language, time zone, and account creation timestamp. We log the timestamp and IP address of (i) your acceptance of the Terms during onboarding and (ii) your acceptance of the EU 14-day right-of-withdrawal waiver at paid checkout (if applicable) — these consent logs are retained for the lifetime of the account plus seven years as evidence of contractual consent.

3.2 Billing and payment data

If you upgrade to a paid plan, our payment processor (currently Stripe Payments Europe Ltd. — see Section 7) collects and processes your full payment-card details on our behalf. We do not see, store, or have access to your full card number. We do receive and store: the last four digits of the card, the card brand, the billing country, the billing email, the plan you purchased, the amount, the currency, and the transaction status. We retain billing records for seven years after the last transaction in line with Romanian and EU tax-law obligations.

3.3 Job-search preferences

To operate the search agent and score company fit, we collect the search criteria you set: target roles, seniority levels, target locations or remote preference, target salary range, target industries or company sizes, work authorization status, languages, blocklists of companies, and similar preferences.

3.4 Documents you upload

You may upload existing CVs, cover letters, LinkedIn exports, and similar career documents. We store them so that you can edit and re-use them within the Service. These documents are subject to the same access controls as the rest of your account data. Identifying details inside these documents — your name, email, phone number, postal address, and preferred onsite cities — are replaced with placeholders before the documents are passed to any AI model; the real values are stored once in your structured profile and rehydrated only when you download a finished CV or cover letter. See Section 5.5 for the full description.

3.5 Writing samples and voice profile

To produce CVs and cover letters that read like your own writing, you may provide writing samples — short pieces of your own text. We process those samples only to build your individual voice profile, a per-user model that informs the style of Outputs generated for you.

Auto-deletion of samples. As soon as your voice profile has been successfully generated, the underlying samples are no longer required to operate the Service and are automatically and permanently deleted from our active systems — no user action is required to trigger this deletion. If voice-profile generation fails, your samples are retained only long enough to surface the failure to you and to allow a single retry, and are then automatically deleted regardless of the retry outcome. This commitment is stated in Terms § 4.3.1.
Backup purge. Backup copies of writing samples (if any are created during the brief window the samples exist) are purged within the backup-rotation window stated in Section 9 below.
The voice profile itself. The voice profile derived from your samples is a derived stylistic representation. It is retained for the lifetime of your account so the Service can produce on-style Outputs, and is deleted with your account.
No pooling, no general-model training. Your samples and voice profile are not pooled with other users' data, are not used to train, fine-tune, or evaluate any general-purpose AI model (ours or any third party's), and are not used to build any other user's voice profile.
Writing samples are the one deliberate exception to PII redaction. The voice-extraction agent (Terms § 4.3) needs to read the unredacted text of your samples in order to capture the way you actually write. To compensate, the samples are subject to the strictest retention policy in the Service — auto-deletion immediately on profile generation, no manual step required (see above).

3.6 Application-tracker data

When you use the application tracker, we record: the company you applied to, the role title, the application date, the version of the CV / cover letter you submitted, your application status (applied / interview / offer / rejected / no response), and notes you add. Some of this data is generated by the Service when you act through the Chrome extension; some you add manually. The CV / cover-letter content stored against each tracker entry is subject to the placeholder substitution described in Section 5.5 — the historical record contains placeholders, not your raw identifying details.

3.7 Generated Outputs

Outputs (CVs, cover letters, messages, LinkedIn drafts, score reports) produced by the AI agents on your behalf are stored in your account so you can re-open, edit, and re-export them. You own the Outputs (Terms § 5.1) and may delete them at any time. Stored Outputs hold placeholders, not your raw identifying details — your name, email, phone, address, and preferred cities are re-inserted from your structured profile at the moment you actually download the PDF or DOCX (Section 5.5).

3.8 Feedback Channel submissions

When you submit a suggestion, complaint, or bug report through the in-product Feedback Channel (Terms § 4.6), we store the verbatim text of your submission, the category and severity you select, and the timestamp. The verbatim text follows a summarize-and-purge lifecycle:

The submission is reviewed by the feedback AI agent (and a human team member where required) and addressed via a personalized response;
After the response is delivered, we wait a brief grace window (default 24 hours, to allow for follow-up replies) and then permanently delete the verbatim original text from our active systems;
The summarized, anonymized signal that derives from your submission ("12 users this week reported issue X") may be retained indefinitely for product-improvement purposes;
Backup copies of verbatim text are purged in line with the backup-rotation window in Section 9.

This lifecycle is the GDPR Article 5(1)(c) data-minimization implementation for the Feedback Channel and is committed to in Terms § 4.6.

3.9 Help Chat conversations

The in-product Help Chat (Terms § 4.7) is the AI assistant you can ask "how do I do X in JobEmber?" The text of your Help Chat conversation is processed in memory only for the duration of generating the assistant's response. It is not written to our database, is not retained after the session ends, and cannot be retrieved, exported, or deleted — because no transcript exists in our systems.

What we do retain from the Help Chat: aggregated, anonymized signals — topic categories of questions asked, frequency counts, escalation rates, success rates. These signals contain no verbatim user text, are not associated with your user ID, and are used only to improve documentation and UX.

3.10 Browser-extension activity

The "JobEmber" Chrome extension reads page content from job-platform websites (LinkedIn Jobs, Indeed, Glassdoor, and similar) when you actively invoke an extension feature on those pages — for example, when you click the extension icon to extract a job posting into your tracker. We collect the data you act on (job posting fields, the URL of the posting, the timestamp of your action) and send it to our backend so the requested feature works. The extension does not run a passive scraper, does not exfiltrate page content from sites unrelated to job platforms, and only reads page content while you are actively using one of its features.

3.11 Device, log, and security data

When you use the Service we collect technical data including IP address, user-agent string, device and browser type, pages and features accessed, timestamps, error reports, and request identifiers. We use this data to operate the Service, debug failures, prevent abuse, and respond to security incidents (Article 6(1)(f) GDPR — legitimate interests). Application logs are retained for 90 days and then aggregated or purged.

3.12 Cookies and similar technologies

The Service uses cookies and equivalent technologies. See Section 11 for the full description.

3.13 Marketing preferences

If you opt in to product news and educational content emails, we record your opt-in event (timestamp, consent text shown). You can withdraw consent at any time using the unsubscribe link in any marketing email or in your account settings.

3.14 Data we receive from third parties

If you sign up with Google or GitHub via OAuth, we receive your email and basic profile data from that provider. If you connect a job-platform account (where supported), we receive the data fields the platform exposes via its API and that you have authorized us to read. We do not request more than is necessary for the feature you have asked for.

4. Why we use your data and our legal bases

We process your personal data only where one of the lawful bases in Article 6 GDPR applies. The table below lists the main processing activities, the categories of data they involve, the purpose, and the legal basis.

Activity	Categories of data	Purpose	Legal basis
Run your account	Account data (3.1)	Authenticate you and provide the Service	Article 6(1)(b) — performance of contract
Take payments	Billing data (3.2)	Charge you, prevent fraud	Article 6(1)(b) — performance of contract; Article 6(1)(c) — tax compliance
Generate AI Outputs (CVs, cover letters, messages)	Documents (3.4), voice profile (3.5), preferences (3.3)	Deliver the core feature you paid for	Article 6(1)(b) — performance of contract
Build your voice profile	Writing samples (3.5)	Deliver personalized Outputs	Article 6(1)(b) — performance of contract
Auto-delete writing samples once profile is built	Writing samples (3.5)	GDPR data minimization	Article 5(1)(c) — minimization principle
Redact identity PII before sending data to AI providers	Name, email, phone, address, preferred cities, all stored document content (3.4, 3.6, 3.7)	Keep identifying data out of upstream LLM processing	Article 5(1)(c) — minimization; Article 32 — security by design
AI-detection self-assessment	Outputs (3.7)	Deliver the AI Detector feature	Article 6(1)(b) — performance of contract
Search agent + 0–100 fit scoring	Preferences (3.3), public job-platform data	Deliver the search feature	Article 6(1)(b) — performance of contract
Application tracker	Tracker data (3.6)	Deliver the tracker feature	Article 6(1)(b) — performance of contract
Browser-extension features	Extension activity (3.10)	Deliver extension features you invoke	Article 6(1)(b) — performance of contract
Feedback Channel — process and respond	Submission text (3.8)	Respond to your feedback / resolve complaints	Article 6(1)(b) — performance of contract
Feedback Channel — summarize and purge	Submission text (3.8) → aggregate	Improve the product on aggregate signals	Article 6(1)(f) — legitimate interest in product improvement, balanced by minimization
Help Chat — generate response	Chat text (3.9) — in-memory only	Answer your product-usage questions	Article 6(1)(b) — performance of contract
Help Chat — aggregate signals	Anonymized topic counts	Improve documentation and UX	Article 6(1)(f) — legitimate interest
Operate, secure, and debug the Service	Logs and security data (3.11)	Keep the Service available, prevent abuse	Article 6(1)(f) — legitimate interest
Comply with legal obligations	Various	Tax records, lawful requests, security incident reporting	Article 6(1)(c) — legal obligation
Marketing emails	Email + opt-in record (3.13)	Send opt-in product news	Article 6(1)(a) — consent
Analytics cookies (where present)	See Section 11	Understand site usage	Article 6(1)(a) — consent (cookie banner)
Defend or assert legal claims	All categories as needed	Respond to disputes, enforce Terms, defend chargebacks	Article 6(1)(f) — legitimate interest

We do not process special categories of personal data (Article 9 GDPR — health, biometrics, ethnicity, religion, political opinion, etc.) intentionally. If you include such data in writing samples, CVs, or feedback submissions, you do so at your own discretion; we treat it under the same retention and access rules as the rest of the submission and apply additional protection where required by law. Please avoid putting special-category data into the Service unless it is genuinely needed.

5. AI processing and automated decision-making

5.1 What AI does in JobEmber

The Service uses large language models and related AI techniques to: extract a writing-style profile from your samples, generate CV and cover-letter drafts, assess outputs against an AI-detection methodology, score company fit on a 0–100 scale, and run the Feedback Channel and Help Chat assistants. The full feature inventory is in jobember.ai/features.

5.2 Article 22 GDPR — automated individual decision-making

JobEmber's AI features assist you; they do not make decisions about you that produce legal or similarly significant effects on you. You review every Output before deciding whether to use or send it (Terms § 5.2). You decide which jobs to apply to. You click submit on every application (Terms § 2.2(c) — JobEmber does not auto-apply). The AI Detector is an estimate, not a determination (Terms § 5.3); the 0–100 fit score is a recommendation, not a gate. Accordingly, the processing in this Service is not "automated decision-making" within the meaning of Article 22(1) GDPR, and the requirements in Article 22(3) and Recital 71 do not apply.

If we ever introduce a feature that does make automated decisions with legal or similarly significant effect on you, we will (a) update this Privacy Policy, (b) notify you, and (c) implement the safeguards required by Article 22(3) — meaningful information about the logic, the right to obtain human intervention, the right to express your view, and the right to contest the decision.

5.3 AI providers

Generated Outputs are produced by third-party large language models. Which provider processes a given request depends on your plan tier (Terms § 4.3.2, and the routing summary in Section 5.5):

Anthropic PBC (United States) — the Claude family. Handles sensitive operations (CV, cover-letter, and voice-profile generation, rewriting, and AI-detection) on the Medium and High tiers, and the entire pipeline on High. Under our agreement, Anthropic does not retain JobEmber prompts or completions for training or fine-tuning, and processes content only to return the requested completion.
DeepSeek (China) — used on the Low tier and for lower-cost, non-sensitive operations (job search, scoring, employer research). DeepSeek's data-handling terms are less protective and it may use API inputs to improve its models; for that reason the Low tier is not recommended for confidential documents, and your identifying details are replaced with placeholders before any prompt is sent (Section 5.5).
Google LLC (Gemini API) (United States) — used on the Free tier and for lower-cost operations. Google's free Gemini tier may use inputs to improve its models.
Local inference (Ollama) — runs on infrastructure we control and sends no data to any third party.

Transfers to the United States rely on Standard Contractual Clauses (Section 8), and on the EU–US Data Privacy Framework where the recipient is certified. The transfer to DeepSeek in China relies on Standard Contractual Clauses together with supplementary measures — principally the PII redaction described in Section 5.5 — because China does not benefit from an EU adequacy decision. If we change or add an upstream AI provider, we will update this Privacy Policy; material changes are notified per Section 16.

5.4 No model training on your data

Your writing samples, voice profile, Outputs, Feedback Channel submissions, and Help Chat content are not used by JobEmber to train, fine-tune, or evaluate any AI model — not ours, and not any third party's. This is reflected in our configuration of upstream model providers (e.g. Anthropic's no-training service tier).

5.5 Identity PII is redacted before any AI model sees your data

Even with the no-retention and no-training commitments above, the principle we work to is: the less identifying data the upstream AI provider sees, the better. Accordingly, before any text is passed to a large language model on your behalf, JobEmber replaces your identifying personal data with placeholders:

Field	Placeholder
Your name	`{{pii.name}}`
Your email address	`{{pii.email}}`
Your phone number	`{{pii.phone}}`
Your postal address	`{{pii.address}}`
Your preferred onsite cities	(replaced with a server-side match call — see below)

The real values are stored once in your structured account profile and are never sent to an LLM provider. They are re-inserted into the document only at the moment you actually download a finished CV or cover letter as PDF or DOCX — a step that happens entirely inside JobEmber, after the AI has returned its completion.

This applies to:

(a) Live prompts — the profile data that agents read at the start of every run is returned with placeholders, not real values;
(b) Stored document content — the CV templates, cover-letter templates, application versions, and Q&A answers in your account hold placeholders, not your raw identifying details. The historical record of past applications therefore contains no raw PII;
(c) Filter and scoring on city / location — when search-filter and job-scoring agents need to decide whether a job's location matches your preferred cities, the comparison happens server-side inside JobEmber, not in the LLM prompt. The agent sends the job's location to a JobEmber endpoint and receives a match-or-not answer; your preferred cities never enter the LLM context.

The one deliberate exception is the writing-sample text processed by the voice-extraction agent — the agent has to read the unredacted text in order to capture how you actually write. To compensate, those samples are subject to the strictest retention policy in the Service: auto-deletion immediately on voice-profile generation (Section 3.5, Terms § 4.3.1).

No API credentials in LLM prompts, ever. As a related guarantee, the per-run session token that lets JobEmber's agents call our own internal API is never placed in an LLM prompt. It travels on a separate wire field to our agent runtime and is substituted into HTTP requests on the server side — so even short-lived API credentials do not enter the upstream AI provider's payload, regardless of that provider's retention policy.

Detection of leaks. JobEmber runs an internal check that scans outbound document content for raw identifying values; if a value the redactor should have placeholdered slips through, the run is flagged as a security incident and investigated. This is a defence-in-depth measure on top of the redactor itself.

Per-account safety control. PII redaction is on by default for every JobEmber account. Each account carries an internal escape-hatch setting that can be disabled by JobEmber support if redaction interferes with a specific user's workflow (for example, a CV whose content depends on a name being literal text rather than substituted at render time). Disabling the setting removes the redaction commitment for that account; we will only do so on the affected user's request, will record the request, and will notify them in writing of the effect.

This commitment satisfies the data-minimization principle in Article 5(1)(c) GDPR and the security-by-design obligation in Article 32 GDPR in respect of upstream AI processing.

6. Recipients of your data

Inside JobEmber, your personal data is accessible only to authorized personnel who need it to operate or support the Service, and only to the extent needed for the task.

Outside JobEmber, we share data with the following categories of recipients, all of whom are subject to written data-processing agreements that include the safeguards required by Article 28 GDPR.

6.1 Sub-processors (current list)

Sub-processor	Purpose	Location	Transfer mechanism
Anthropic PBC	AI model inference (Claude) — sensitive operations on Medium/High tiers	United States	EU Standard Contractual Clauses (2021/914)
DeepSeek	AI model inference — Low tier and non-sensitive operations (search, scoring, research)	China	EU SCCs + supplementary measures; identifiers redacted before inference (§ 5.5)
Google LLC (Gemini API)	AI model inference — Free tier and lower-cost operations	United States	EU SCCs; EU–US Data Privacy Framework where applicable
Stripe Payments Europe Ltd.	Payment processing	Ireland (HQ); processing in EU + US	EU SCCs for any US transfer
Cloudflare, Inc.	Marketing-site hosting and CDN (jobember.ai)	Global edge with EEA processing for EEA users	EU Standard Contractual Clauses (2021/914) per Cloudflare DPA
Application backend host — to be confirmed before paid-tier launch <!-- TODO: name the backend hosting provider (Hetzner / OVH / AWS / etc.) once the final production environment is chosen; add location + SCC mechanism -->	Application hosting (jobs-search-web, database)	To be confirmed	To be confirmed
Resend, Inc.	Transactional email (signup welcome, account-deletion confirmation, refund confirmation, EU withdrawal-waiver durable-medium copy, GDPR Article 34 breach notifications)	EU region (`eu-west-1`, Frankfurt)	Processing in EEA — no transfer outside the EEA
Functional Software, Inc. (dba Sentry)	Application error reporting and performance monitoring	Germany (EU region: `de.sentry.io`)	Processing in EEA — no transfer outside the EEA
Product analytics provider — to be confirmed before paid-tier launch <!-- TODO: name analytics provider (Plausible / PostHog / etc.) once adopted, or remove row if shipping without analytics; add location + SCC mechanism -->	Aggregate product analytics	To be confirmed	To be confirmed

The current sub-processor list is also published at jobember.ai/privacy/subprocessors and updated when we add or replace a sub-processor. Material additions are notified per Section 16.

6.2 Job-platform integrations

When you use the search agent or extension features that interact with a public job platform (LinkedIn, Indeed, Glassdoor, etc.), JobEmber sends queries derived from your preferences to those platforms and receives publicly listed job postings in response. We do not send your CV, voice profile, account credentials, or other sensitive data to those platforms. If you choose to connect a job-platform account through an authorized integration, we send only the data fields the integration requires for the feature you have asked for.

6.3 Disclosure to authorities and in legal proceedings

We may disclose personal data where required by Romanian or EU law, by a binding court order, by a regulator with jurisdiction over us, or where reasonably necessary to (a) defend or assert a legal claim by or against us (including chargeback disputes — Terms § 7.5), (b) protect the safety of users or the public, or (c) prevent or investigate fraud or abuse of the Service. We disclose the minimum necessary in each case and, where lawful, we notify the affected user.

6.4 Business transfers

If JobEmber or DGLabs S.R.L. is acquired, merged, sold, or reorganized, personal data may be transferred to the surviving or acquiring entity. The surviving entity will continue to be bound by this Privacy Policy or notify you of changes per Section 16.

6.5 No sale of personal data

We do not sell personal data, do not rent it, and do not share it with advertising networks for cross-context behavioral advertising.

7. International data transfers

JobEmber operates from the European Union (Romania) and stores data in the European Economic Area where practical. Some of our sub-processors are located in or process data in the United States — most notably Anthropic for AI inference, and possibly Stripe and our transactional-email and hosting providers depending on the routing of a particular request.

For each such transfer:

(a) We rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) as the legal mechanism for transfer (Article 46(2)(c) GDPR);
(b) Where the EU–US Data Privacy Framework applies and the recipient is certified under it, we may also rely on the adequacy decision for that recipient (Article 45 GDPR);
(c) We perform a transfer-impact assessment for each US sub-processor and put in place supplementary measures (encryption in transit, tenant isolation, contractual prohibitions on training, no-retention configuration where available);
(d) You may obtain a copy of the safeguards we use, redacted as necessary for confidentiality, by writing to [email protected].

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes for which it is processed and as required by law. The retention table is summarized at the top of this Policy and is set out in full below.

Data category	Retention
Account data (3.1)	Lifetime of account, then deleted within 30 days of account closure
Consent logs (Terms acceptance, 14-day waiver, marketing opt-ins)	Lifetime of account + 7 years (evidence of contract / consent)
Billing and tax records (3.2)	7 years after the last transaction (Romanian / EU tax law)
Job-search preferences (3.3)	Lifetime of account; deleted with account
Uploaded documents (3.4)	Lifetime of account or until you delete the document
Writing samples (3.5)	Auto-deleted on successful voice-profile generation (or after a single retry on failure)
Voice profile (3.5)	Lifetime of account or until you delete it
Tracker data (3.6)	Lifetime of account or until you delete the entry
Generated Outputs (3.7)	Lifetime of account or until you delete the Output
Feedback Channel verbatim text (3.8)	Deleted ≤24h after we send our response (grace window for follow-up)
Feedback Channel anonymized signals (3.8)	Indefinite (no PII)
Help Chat verbatim text (3.9)	Not stored — in-memory only, purged at session end
Help Chat anonymized signals (3.9)	Indefinite (no PII)
Browser-extension activity (3.10)	Lifetime of account; deleted with account
Application logs and security telemetry (3.11)	90 days, then aggregated or purged
Backup copies of any of the above	30 days maximum, then purged
Records needed to defend a legal claim or comply with a legal hold	For the duration of the claim / hold + the applicable limitation period

When you delete your account using the self-service deletion page (jobember.ai/account/delete), all categories above marked "lifetime of account" are hard-deleted from our active systems within 30 days, and from backups on the next backup-rotation cycle (30 days maximum). Categories with statutory retention (billing, consent, legal-hold) survive deletion to the extent and for the period required by law, and are isolated from the active systems.

9. Your rights under the GDPR

If the GDPR applies to you (you are in the EU/EEA, or we are processing your personal data in the EU), you have the rights set out below. Equivalent rights apply under the UK GDPR for users in the United Kingdom, and similar rights apply under the California Consumer Privacy Act (CCPA / CPRA) for residents of California — we treat all users to the highest applicable standard regardless of location.

9.1 Your rights

Access (Article 15) — Get a copy of the personal data we hold about you and confirmation of how it is being processed.
Rectification (Article 16) — Correct personal data that is inaccurate or incomplete.
Erasure / right to be forgotten (Article 17) — Have your personal data deleted, subject to limited statutory exceptions (tax records, legal holds, fraud prevention).
Restriction of processing (Article 18) — Pause processing while a dispute about accuracy or legitimate interest is resolved.
Data portability (Article 20) — Receive your data in a structured, machine-readable format and transmit it to another controller, where the processing is based on consent or contract.
Object (Article 21) — Object to processing based on legitimate interests (Article 6(1)(f)). We will stop unless we demonstrate compelling legitimate grounds that override your interests.
Withdraw consent (Article 7(3)) — Where we process your data on the basis of consent (e.g. marketing emails, analytics cookies), withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Not be subject to automated decision-making (Article 22) — As stated in Section 5.2, JobEmber does not make automated decisions about you that produce legal or similarly significant effects.
Lodge a complaint with a supervisory authority (Article 77) — See Section 16.

9.2 How to exercise your rights

Most rights have a self-service path inside the product:

Access / Portability. Use the "Export my data" function in your account settings to download your data in JSON.
Rectification. Update your account data, preferences, voice profile, documents, tracker entries, and Outputs directly in the product.
Erasure. Use the account-and-data deletion page at jobember.ai/account/delete to delete your account and all associated data (subject to the statutory exceptions in Section 8).
Refund (within 14 days). Use the self-service refund button in Account → Billing, or write to [email protected] (Terms § 7).
Withdraw consent. Marketing emails: unsubscribe link or account settings. Cookies: cookie-preferences widget.

For anything that the self-service flows do not cover — including formal Article 15 access requests, complaints about how we have handled a self-service request, or any other exercise of rights — write to [email protected] with subject line Privacy request — [type] and a brief description.

9.3 Identity verification

To protect your data we may need to verify your identity before fulfilling certain requests (in particular access, erasure, and portability). We will ask for the minimum information needed to confirm you are the account holder.

9.4 Response time

We respond to formal data-protection requests within one month of receipt, in line with Article 12(3) GDPR. Where the request is complex or where we receive a high volume of requests, we may extend this period by a further two months and will tell you why. There is no charge for legitimate requests; manifestly unfounded or excessive requests may incur a reasonable fee or be refused, with reasons.

10. Cookies and similar technologies

The marketing site (jobember.ai) and the web application (app.jobember.ai) use cookies and equivalent technologies (local storage, session storage). Categories:

Strictly necessary cookies — required to deliver the Service (session authentication, CSRF tokens, load-balancer affinity). Cannot be turned off without breaking the Service. No consent required (Article 5(3) ePrivacy Directive — strict-necessity exemption).
Functional cookies — remember your preferences (language, time zone, UI choices). Set when you change a preference.
Analytics cookies — help us understand aggregate site usage (which features are used, which docs are read). Set only with your consent via the cookie banner.
Marketing cookies — set only if and when we run advertising; only with your consent. We do not currently use cross-context behavioral advertising and have no plans to.

You can manage cookie consent via the cookie-preferences widget on the marketing site at any time. Withdrawing consent does not affect cookies already set; those will be cleared on next visit and stop being read after withdrawal.

A live cookie inventory (cookie name, purpose, retention) will be published at jobember.ai/privacy/cookies before paid-tier launch.

11. Security

We protect your personal data with technical and organizational measures appropriate to the risk, including:

TLS encryption in transit for all client–server traffic and inter-service traffic crossing public networks;
Encryption at rest for primary databases and document stores;
Tenant isolation between user accounts at the application level;
Role-based access control for staff, with audit logging of access to personal data;
Hashed and salted passwords (passwords themselves are never stored);
Identity PII redaction before any LLM call (Section 5.5) — name, email, phone, address, and preferred cities are replaced with placeholders before any prompt leaves JobEmber, and re-inserted only at the moment you download a PDF / DOCX. An outbound-content scan flags any redaction leak as a security incident;
No API credentials in LLM prompts — per-run session tokens travel on a separate wire field to our agent runtime and are substituted server-side, never embedded in upstream AI payloads (Section 5.5);
Regular dependency-vulnerability scanning, code review of changes, and incident-response procedures;
Backups encrypted at rest and purged on the rotation in Section 8.

No system is impenetrable. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Romanian Data Protection Authority (ANSPDCP) within 72 hours of becoming aware (Article 33 GDPR) and notify affected users without undue delay where required by Article 34 GDPR. Suspected vulnerabilities can be reported responsibly to [email protected].

12. Children

The Service is intended for adults entering, returning to, or moving within the workforce. It is not directed to anyone under 16 years of age, and we do not knowingly collect personal data from anyone under 16. If you believe that a person under 16 has provided personal data to us, write to [email protected] and we will delete the data and close the account.

13. Marketing communications

You will receive transactional emails (account confirmations, security alerts, billing receipts, refund confirmations, material policy updates, response to feedback submissions) regardless of marketing preference — these are necessary to operate the Service.

You will receive product news and educational emails only if you opt in. The opt-in checkbox is unchecked by default and is presented separately from any other consent (we do not bundle marketing consent with onboarding consent — see Terms § 1 and the consent gate in your onboarding flow). You may withdraw consent at any time from the unsubscribe link or your account settings.

14. Browser extension specifics

The "JobEmber" Chrome extension declares the minimum permissions it needs to function. The current declared permissions and the data each enables are listed below.

Permission	Why it is needed
`activeTab`	Read the page content of the tab where you click the extension icon, only when you click it
`storage`	Cache your authentication session locally so you don't have to log in every time you click the icon
`host_permissions` for job-platform domains (LinkedIn, Indeed, Glassdoor, etc.)	Read job-posting data on the platforms you use the extension on
`scripting`	Inject the extension UI into the active tab when invoked

The extension does not run a content script that scrapes pages in the background, does not exfiltrate page content from sites unrelated to job platforms, and does not transmit any data to JobEmber unless you have actively invoked an extension feature. The extension respects your sign-out from JobEmber: when you sign out of app.jobember.ai, the cached extension session is invalidated and the extension stops sending data to our backend until you sign back in.

The extension's full source will be published as a public read-only repository before paid-tier launch, and the data flow from the extension to the backend is documented at jobember.ai/privacy/extension.

15. Changes to this Privacy Policy

We may amend this Privacy Policy. Changes fall into two categories:

Material changes — for example, adding a new sub-processor that introduces a new transfer to a non-EEA country, expanding the categories of personal data we collect, materially changing a retention period, or adding a new processing purpose. Material changes are announced by email to all account holders at least 30 days before they take effect, and the consent gate at next login may require you to re-acknowledge the updated Policy if the changes affect your contractual relationship with us. You can object before the change takes effect by closing your account and obtaining any refund you are entitled to under Terms § 7.
Non-material changes — typo fixes, formatting, contact-detail updates, sub-processor changes within the same role and country, and similar — take effect on publication and are noted in the document control table below.

The version history of this Privacy Policy is preserved so that you can see what changed and when.

16. Supervisory authority and how to complain

If you believe we have processed your personal data unlawfully, or if you are not satisfied with how we have handled a request you have made under Section 9, you have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or place of the alleged infringement — without prejudice to any other administrative or judicial remedy (Article 77 GDPR).

Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, Romania
Web: www.dataprotection.ro
Email: [email protected]
Phone: +40.318.059.211

If you are in another EEA country, you can also complain to your national DPA — a list is at edpb.europa.eu/about-edpb/about-edpb/members.

If you are in the United Kingdom, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you are in California, you can contact the California Privacy Protection Agency at cppa.ca.gov.

We encourage you to contact us first at [email protected] so we can try to resolve the matter directly — but this is your choice, not a precondition.

17. Romanian and EU specific notes

Lead supervisory authority — ANSPDCP (Section 16 above).
Romanian implementing legislation — Law no. 190/2018 on measures implementing the GDPR; Law no. 506/2004 on personal data processing in the electronic communications sector (the Romanian implementation of the ePrivacy Directive).
Operating language — Romanian and English. A Romanian-language version of this Privacy Policy is available at jobember.ai/privacy?lang=ro. Where the two versions differ, the English version governs unless mandatory Romanian consumer law requires otherwise.

18. Contact

Privacy / data protection: [email protected]
Data Protection Officer (if appointed): [email protected]
Security incidents and vulnerability disclosure: [email protected]
Support (account, billing, refunds): [email protected]
Legal: [email protected]
Operating entity / data controller: DGLabs S.R.L., Romania
Registered office: Str. Decebal nr. 31, ap. 8 și 9, Cluj-Napoca, județul Cluj, România
Commercial registry (J / CUI / EUID): J12/2135/2023 / CUI RO48162325 / EUID ROONRC.J12/2135/2023
VAT ID: RO48162325

Document control

Version	Date	Change
0.1 (DRAFT)	2026-05-07	Initial draft authored alongside Terms and Conditions v0.1; commits to retention behaviors stated in Terms §§ 4.3.1, 4.6, 4.7.
0.2 (DRAFT)	2026-05-17	Added Section 5.5 — identity PII redaction before LLM calls (placeholder substitution for name / email / phone / address / preferred cities; server-side location-match; no API credentials in LLM prompts; outbound-content leak detection). Notes added to §§ 3.4, 3.5 (exception note), 3.6, 3.7. At-a-glance row added. Legal-bases row added in § 4. Two security bullets added in § 11. Reflects merged feature in commits `4bd6257`, `a950ae7`, `caf045f`, `6dc80e8`. Launch posture: redaction default-on with per-account escape hatch (see founder note 8 below).
1.0	2026-07-22	Launch version, reviewed and cleared for publication. AI-provider disclosure in §§ 5.3 / 6.1 updated to the live set (Anthropic; DeepSeek; Google/Gemini; local Ollama), including the DeepSeek/China transfer basis; Romanian version confirmed available at `/privacy?lang=ro`; effective date set.