Privacy Policy

1. Who we are

JBZY is run by [COMPANY NAME AND ADDRESS TO BE ADDED], registration code [COMPANY REGISTRATION CODE TO BE ADDED]. We decide how your personal data on JBZY is used. Write to privacy@jbzy.io about anything in this policy.

2. What we collect

• Account — your email address, your password (stored hashed by our sign-in system, never in plain text), and whether you are a job seeker or a recruiter. If you sign up with Google, Google gives us your email address and the name on your Google account; we use the name only to fill in the name box, which you can change before saving.
• Date of birth — asked once, to check you are 18 or over. It is never shown on your profile, never visible to recruiters, and never sent to our AI features.
• Your agreement to these terms — when you sign up we keep a record that you agreed to the Terms and this Privacy Policy: your account ID, which version of each you agreed to, and when. This record is deleted together with your account.
• Profile — your name, an optional display name, photo, location, about text, job title, skills, experience, education, languages, licences and certificates, the job level and job types you want, availability, pay expectations, links you add (website, LinkedIn, Facebook, Instagram, GitHub), whether your profile is visible to recruiters, and the countries where you say you can work. Students may add university, field of study and graduation year. Recruiters add their company details. Work experience you choose to add: employer or organisation names, roles, the kind of place, towns or cities, start and end months, a short description and skills, and whether you show it in talent search (on unless you turn it off).
• Countries where you can work — this is your own statement. JBZY does not check anyone’s right to work.
• CV — if you upload one. It is stored privately (see section 4).
• What you do on JBZY — applications, saved jobs and candidates, saved searches and job alerts, Quick Jobs, messages you exchange with other users, and conversations with the AI assistant.
• Waitlist — while JBZY is invite only, you can join our waitlist without an account. We keep your email address, your choice (looking for a job, or hiring and asking for an invite code), the city you give if you give one, the language of the page you used, and when you joined. If you joined an earlier waitlist, we hold the email address and the role you gave then.
• Invite codes — if you created your account with an invite code, we keep which code it was, linked to your account, and when you used it.
• Payment information — none. JBZY does not process payments, so we do not collect card details.

3. How we use it

• Running JBZY — your account, your profile, applications, Quick Jobs, messages, saved searches and talent search all depend on the data above.
• Matching — for job seekers, we use your profile to find and rank jobs. Unless you choose to see all countries, we show and match you only with jobs in the countries you chose. For recruiters, our AI ranks visible job seekers for a job using their job title, skills, years of experience and availability, not their name. A recruiter sees everyone it ranks, in order, without a score. On each open job’s page, we also rank visible job seekers for that job without AI, by how their skills, job title, the job types they want, availability, the countries they can work in and years of experience compare with the job. There is no score: the recruiter sees the order and a short reason, and can still see every visible job seeker who has not applied.
• A recruiter’s last suggestions — we store the last list of suggested candidates for each recruiter, so it can be shown if a new ranking fails. For each candidate it holds only their account ID, job title, skills, years of experience, availability, a short reason and whether their stated experience is below what the job asks, never a score or a name, together with the job the list was made for. It is deleted when the recruiter’s account is deleted, and when the account of anyone on the list is deleted.
• Reading your CV — When you upload a CV, we send it to Anthropic, our AI provider, to read it. We do not use it to train models. This happens when you upload a CV during setup, or when you press “Draft from my CV”. A CV uploaded on your profile page is only stored. The details we read are shown to you first, and nothing is saved to your profile until you confirm.
• Other AI features — the AI assistant (it sees your profile, including your name, and the conversation), help writing your about text, cover letter drafts (from your job title, skills, years of experience and about text, and the job advert), company descriptions written from a recruiter’s notes, and short summaries of job adverts.
• Email — account emails (confirming your address at sign-up, resetting your password), a welcome email, updates on your applications and Quick Jobs, company verification codes, and job alerts. All of them, including the sign-up confirmation, password-reset and job alert emails, are sent through Resend (see section 5). Job alerts are sent only if you turn them on for a saved search, at most three a day, and every alert has a link that stops it without signing in. We do not send marketing email.
• Waitlist — we use your waitlist details to email you once, when JBZY opens, with a link that takes you off the list without signing in. On our home page we show how many people and how many jobs are waiting: totals only, never anyone’s details, and no number below 10.
• Safety — preventing fraud, fake profiles, abuse and attempts to manipulate our AI features.

The legal basis for each of these uses: [LEGAL BASIS FOR EACH USE TO BE CONFIRMED].

4. Who can see your data on JBZY

• Job seekers with a visible profile — signed-in recruiters can find you in talent search, their AI suggestions and the suggested candidates on their jobs’ pages, and see your profile: your display name (or, if you have not set one, your full name), photo, job title, location, about text, skills, experience, education, languages, licences, job level, the countries you say you can work in, and your links, and your work experience unless you turn off showing it in talent search.
• Hidden profiles — if you switch off “visible to recruiters”, you do not appear in talent search, AI suggestions or suggested candidates.
• When you apply — that recruiter can see your full name, photo, links, your application and your profile details (job title, skills, experience, education, availability, languages and similar profile fields), your work experience, and can open your CV, even if your profile is hidden or you use a display name. Withdrawing the application ends this access.
• When you take a Quick Job — the person who posted it can see your full name, photo, links and your profile details (the same fields as above, including your work experience), even if your profile is hidden. They cannot open your CV.
• Your work experience — the places you add to “Work experience” (employer or organisation, role, kind of place, town or city, dates, your description and the skills you list) can be seen by you, by a recruiter you have applied to (until you withdraw the application), by the person who posted a Quick Job you have taken, and by JBZY staff with administrator access when they need to run and protect the service. While your profile is visible, any signed-in recruiter can also see it: “Show my work experience in Talent Search” is on unless you turn it off, and you can turn it off at any time. While your profile is hidden, only the people named above can see it.
• Messages — the person you message sees what you send. If your profile is hidden, a recruiter you have not applied to sees your display name or “Anonymous”, never your full name.
• Never shown to other users — your date of birth, email address, pay expectations and grades. Job seekers cannot see each other’s profiles.
• Your CV — stored privately. It opens only through short-lived private links: for you, and for a recruiter you have applied to, as long as that application is not withdrawn, whether or not your profile is visible. Nobody else can open it.
• Photos are served from public web addresses.
• JBZY staff with administrator access can see account data when they need to run and protect the service.

5. Service providers

These companies process personal data for us, on our instructions, to run JBZY. Each has its own privacy policy.

• Supabase — our database, sign-in system and file storage, hosted on Amazon Web Services in the United States. Your account, profile, messages, CV and photo are stored here. The text used for job matching is also turned into search data here, without leaving Supabase.
• Vercel — hosts and serves the site and runs our scheduled jobs (such as job alerts); it processes request logs in doing so.
• Anthropic — our AI provider. It reads CVs you ask us to read, ranks jobs and candidates, powers the AI assistant, and drafts text you ask for. Only the data each feature needs is sent, when the feature runs. CVs, job data and the other text our AI features use are processed by Anthropic through its commercial API. Anthropic states: “Anthropic does not use data from commercial products (such as Claude for Work, the Anthropic API, Claude Gov, and Team/Enterprise plans) to train its generative models by default.” Under its standard terms for API customers, Anthropic deletes what we send and what it returns within 30 days. It keeps them longer only where they are flagged under its Usage Policy (up to 2 years), where the law requires it, or where agreed otherwise.
• Resend — delivers every email JBZY sends: the sign-up confirmation, password resets, job alerts and the other emails in section 3.
• Sentry — error reports (EU region; see section 6).
• PostHog — product analytics, only with your consent (EU region; see section 6).

If you choose “Continue with Google”, Google handles that sign-in under its own privacy policy. Job adverts marked “Jobs by Adzuna” open on Adzuna’s site, where Adzuna’s policy applies.

Some of these providers are in the United States, so your data may be transferred outside the European Economic Area. [TRANSFER SAFEGUARDS TO BE CONFIRMED].

6. Cookies and analytics

Strictly necessary — the sign-in cookies that keep you logged in, and a short-lived cookie that remembers a job someone shared with you, so you return to it after signing up. Your browser’s local storage also keeps a few choices on this device: your cookie choice, setup questions you skipped, and, between ticking the box at signup and your first page in JBZY, that you agreed to the Terms and any invite code you entered. These are needed for the site to work. There are no advertising cookies and no tracking pixels.

Product analytics — PostHog, only with your consent. We ask before it loads. If you decline, PostHog is never initialised and stores nothing. If you accept, it saves a cookie and a local storage entry on your device so return visits are recognised. Events are limited to identifiers and fixed labels — never names, email addresses, message content, CVs or cover letters. You are identified by account ID only. You can change your decision at any time using Cookies in the site footer, or Analytics & cookies in your profile settings. Declining also deletes what PostHog previously stored.

Error monitoring — Sentry, on the basis of legitimate interest. Sentry reports crashes so we can keep the service working. It stores nothing on your device: no cookie, no local storage. For that reason it runs before the consent prompt is answered — if it did not, a fault in the prompt itself could never be reported to us. Reports exclude names, email addresses, message content, cookies, request bodies and URL query strings. Your account ID is attached only if you accept analytics; before that, reports are anonymous. Sentry necessarily receives your IP address as part of the network connection to its servers, as any website you contact does; our configuration does not send your IP address as part of the report itself. You can object to processing based on legitimate interest by contacting us.

If your browser sends a Do Not Track signal we treat it as a refusal: neither PostHog nor Sentry is loaded, and you are not shown the prompt.

7. How long we keep it

When you delete your account, your profile leaves search and AI suggestions at once, and after a grace period the account is anonymised rather than erased, because other people’s jobs, applications and messages refer to it. The record of your agreement to these terms is deleted together with your account. Your work experience is deleted together with your account. So is the record of the invite code you used. Waitlist details are kept until three months after we send the email saying JBZY has opened, then deleted; if you leave the list earlier, we stop emailing you at once. What we send to Anthropic for our AI features is kept by Anthropic for up to 30 days, longer only in the cases in section 5. [RETENTION PERIODS TO BE ADDED]

8. Your rights

• See and download your data — “Download my data” in your profile settings gives you a copy of what we hold about you. Your download includes your work experience.
• Correct it — edit your profile at any time.
• Delete it — delete your account from your profile settings.
• Hide your profile — switch off “visible to recruiters”.
• Object, restrict, or withdraw consent — email privacy@jbzy.io. Withdrawing consent to analytics takes one click in the site footer.
• Complain — you can complain to a data protection authority: [SUPERVISORY AUTHORITY TO BE ADDED].

9. Changes

When this policy changes we update the date at the top. The version you agreed to at signup is kept with your account.

10. Contact

Questions about privacy or a data request go to privacy@jbzy.io, or by post to [COMPANY NAME AND ADDRESS TO BE ADDED].