Privacy Policy

1. Who is responsible for your data

Striped Hare Ltd (company number SC869047, registered in Scotland, see Legal & Company Info for the full details)

is the data controller for the personal data described here. Contact: contact@myjobby.co.uk. ICO registration reference: [[ICO REGISTRATION NUMBER, insert once registered at ico.org.uk]].

2. What we collect

• Onboarding answers, your stated job preferences, discipline, career stage, location, right-to-work status, and similar information you provide when signing up.
• CV (optional), see Section 4 below for exactly how this is handled and how long it's kept: in short, much less than you might expect.
• AI-generated profile summary, a short summary of your CV/background, and a structured profile derived from your CV and/or answers, retained on an ongoing basis to match you against new vacancies.
• Telegram account ID, used to send you alerts and identify your account. We do not collect your phone number or Telegram contacts.
• Payment information, processed by Stripe, our payment provider. We do not store your full card details ourselves; Stripe shares back only what's needed to identify a repeat card and manage your subscription (see Section 4).
• Feedback, if you rate a job match (👍/👎) or reply to correct something, we store that rating/correction against your account to improve future matches.

3. Why we process your data, and our legal basis

You can withdraw consent at any time by contacting us or deleting your account (/delete_me, see Section 8); this won't affect processing already carried out.

4. How AI is used, and what we actually do with your CV

We use Google's Gemini models (gemini-2.5-flash and gemini-2.5-flash-lite, via Google's API) to:

• Summarise your CV (if uploaded) and your stated answers into a structured profile;
• Compare new job vacancies against your profile to generate your personalised shortlist, daily.

We do not currently use Anthropic/Claude or any other AI provider to process your personal data, an earlier version of the matching pipeline did, but it was retired and replaced with Gemini for every stage. If that changes, this page will be updated first.

Your raw CV text is not stored in our database at all. If you upload a CV, it is used transiently, for the few seconds it takes to generate your structured profile summary, and is then discarded; only the short AI-generated summary (education, experience, key skills) is kept, so you and our support team can see what's on file without us retaining the source document. As a safety net against a future bug reintroducing storage, an automated job also permanently deletes any raw CV text that is, for any reason, still present in our database after 90 days.

Your CV/answers are sent to Google as part of this processing. Google acts as our data processor for this purpose under their standard API/business terms.

We use the paid tier of the Gemini API (our API key is tied to a Cloud Project with an active billing account, not the free tier). Under Google's Gemini API Additional Terms of Service (effective 23 March 2026): for Paid Services, Google does not use your prompts or responses to improve its products, and processes them under its Data Processing Addendum for Products Where Google Is a Data Processor. Prompts and responses are logged for a limited period solely to detect and prevent Prohibited Use Policy violations, this is abuse monitoring, separate from and not constituting model training.

We do not sell or share your personal data with employers, recruiters, or any other third-party business. Your data is used only to generate matches for you.

5. Who else processes your data

6. International data transfers

Our hosting infrastructure (Microsoft Azure) runs in the Sweden Central region, within the European Economic Area. Azure Database for PostgreSQL and the underlying managed disks are encrypted at rest. Because we also use AI providers (Google) whose infrastructure may process data outside the UK/EEA, your data may be transferred internationally for that specific processing. Where this happens, we rely on Google's Data Processing Addendum, which provides for Standard Contractual Clauses (Controller-to-Processor and Processor-to-Processor variants) to apply to restricted transfers where Google has not already adopted an alternative recognised transfer mechanism.

[[MOSTLY RESOLVED, one loose end: the excerpt of Google's DPA first checked (Appendix 3 Part A §7.1) only showed the EU SCC language, which read like a gap. Broader research found Google does maintain a proper "United Kingdom International Data Transfer Addendum to the European Commission Standard Contractual Clauses" as part of its standard Cloud DPA family, and since 16 September 2024 has additionally adopted an Alternative Transfer Solution (the UK Extension to the EU-U.S. Data Privacy Framework) that takes precedence over SCCs/IDTA for UK-to-US transfers where it applies, a stronger, adequacy-based mechanism, not just a contractual one. What's still not independently confirmed: whether this exact UK IDTA clause sits inside the specific "Data Processing Addendum for Products Where Google Is a Data Processor" that governs the Gemini API (a narrower document than the general Google Cloud DPA these findings came from), the full text of that DPA's own Appendix 3 wasn't accessible to confirm word-for-word. Risk is now low, not the open question it looked like initially, but worth a quick confirmation rather than treating as fully closed.]]

7. How long we keep your data

• Raw CV text: not stored, see Section 4.
• Profile summary, answers, and match history: retained while your account is active, and deleted immediately and permanently if you use /delete_me (see Section 8).
• Payment/billing records: retained as required for tax and accounting purposes (typically up to 6 years under UK law), even after account deletion, where we're legally required to keep them.
• System logs and fault records: kept for a limited operational period to diagnose problems, and are not used for any other purpose.

8. Your rights, including the right to erasure

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion ("right to be forgotten"), message /delete_me to the bot for immediate, self-service deletion (two-step confirmation, so nothing is deleted by accident). This permanently removes your profile, CV summary, wishes, keywords, match history, feedback ratings, and personal report link from our systems straight away. It does not automatically cancel an active Stripe subscription, cancel that separately via /manage if you don't want to keep being charged. You can also email us to request deletion instead;
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time;
• Complain to the ICO (ico.org.uk) if you believe we've mishandled your data.

To exercise any of these (other than /delete_me, which is instant), contact contact@myjobby.co.uk. We'll respond within one month.

9. Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, restricted access controls, and key-based (not password) server access, to protect your data. No system is 100% secure, but we take reasonable steps to minimise risk, including limiting how much raw personal data (like CVs) we retain in the first place.

10. Cookies and analytics

This website uses Google Analytics 4 to count visits and understand which pages people find useful. It is not used for advertising, and we do not sell or share the data.

Analytics cookies are not set unless you click "Accept" on the banner shown on your first visit. Until you choose, and if you choose "Decline", no analytics cookies are stored and no analytics data is sent. Your choice is remembered in your browser's local storage (jobby_consent_v1) and you can change it at any time by clearing your browser storage for this site, which makes the banner appear again.

Legal basis: consent (UK GDPR Art. 6(1)(a), and regulation 6 of the Privacy and Electronic Communications Regulations 2003). Google acts as our processor for this data; see Section 6 on international transfers, which applies here too.

We deliberately strip sensitive URL parameters, including Stripe payment identifiers and any email address, before any page address is sent to Google, so checkout details are never transmitted to analytics.

11. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy from time to time; material changes will be notified via Telegram or email. The "last updated" date at the top reflects the current version.

13. Contact us

contact@myjobby.co.uk, for any questions about this policy or how your data is handled.