Privacy Policy | Jobaria

1. Who is responsible for your data?

Jobaria is operated by:

Mohammad Reza Ghazeli

Platanenweg 4, 12437 Berlin, Germany

The operator is the controller responsible for the personal data described in this Privacy Policy. This notice is intended for Jobaria's service in the European Union and European Economic Area (EU/EEA). Jobaria does not currently target the United Kingdom.

2. What Jobaria does

Jobaria provides tools that help individual users create and manage career profiles, upload and prepare resumes and cover letters, import job information, and use AI-assisted career and document features. Jobaria's AI tools provide suggestions and drafts; they do not make employment decisions or submit applications to employers on your behalf.

3. Personal data we process

Depending on how you use Jobaria, we process the following categories of personal data:

Account and authentication data

Name, email address, language or locale, and account settings.
Password hash and authentication or session information.
If you use social login, the provider identifier, associated email address, and authentication tokens needed to maintain the connection.
Account creation, verification, login, security, and deletion timestamps or status.

Profile and career data

Contact details, location, professional summary, skills, languages, work experience, education, certifications, portfolio links, and profile photograph.
Career preferences such as desired roles, locations, employers, salary expectations, work authorization, and sponsorship preferences.
Information contained in resumes, cover letters, portfolios, or other material you upload. These documents may contain additional information you choose to include, such as references or other third-party information.

Please avoid including special-category or other sensitive information unless it is necessary for your use of the Service. Jobaria does not currently offer an active feature for intentionally collecting demographic or equal-opportunity information. Before any such feature is introduced, Jobaria will provide additional information and, where required, obtain explicit consent and introduce appropriate safeguards.

Documents, job information, and generated content

Uploaded files, filenames, file types, document images and previews, extracted text, document structure, parsing results, and technical metadata.
Job posting URLs and job descriptions that you ask Jobaria to import or process.
Resumes, tailored documents, cover letters, drafts, and other content created or edited through the Service.

Public professional-profile imports

When you ask Jobaria to import a public LinkedIn profile, Jobaria sends the profile URL you provide to a public-profile retrieval service. That provider retrieves publicly available professional-profile information and returns it to Jobaria so that it can populate your Jobaria profile. The URL, retrieved profile information, and import result are personal data even when the source profile is publicly accessible.

Jobaria does not use this feature to retrieve a profile without a user request. The source of the imported information is the public LinkedIn profile identified by the URL you submit.

AI assistant and interaction data

Prompts, instructions, job descriptions, resume content, chat messages, and feedback you submit to AI-assisted features.
AI-generated responses and drafts.
Operational metadata such as model identifiers, processing duration, token counts, and error information.

Communications and feedback

Account verification, password-reset, support, privacy-request, and other transactional communications.
Feedback, issue descriptions, and whether you requested follow-up.
Waitlist or onboarding information when you choose to provide it.

Technical and security data

IP address, browser or user-agent information, request path, timestamp, response status, request identifiers, and similar information processed when your device communicates with the Service.
Security, authentication, rate-limiting, diagnostic, crash, and performance information. The exact content depends on the event and is limited where reasonably possible.

4. Why we process personal data and our legal bases

Purpose	Main data involved	Legal basis
Create and operate your account	Account, authentication, profile, and session data	Performance of a contract, Article 6(1)(b) GDPR
Provide resume, document, profile, job-import, and public-profile import features at your request	Profile, career, document, job, and public professional-profile data	Performance of a contract, Article 6(1)(b) GDPR
Provide AI-assisted drafting and career tools	Prompts, chats, resumes, job descriptions, and generated content	Performance of a contract, Article 6(1)(b) GDPR
Send verification, password-reset, security, service, and support communications	Account, contact, security, and communication data	Performance of a contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f) GDPR
Secure, debug, and maintain the Service; prevent misuse and fraud	Technical, authentication, diagnostic, and security data	Legitimate interests, Article 6(1)(f) GDPR
Deliver frontend resources and remember user-requested interface choices	Technical request information and preference data	Legitimate interests, Article 6(1)(f) GDPR, and consent where legally required
Establish, exercise, or defend legal claims and comply with binding legal requirements	Relevant account, transaction, communication, and security records	Legal obligation, Article 6(1)(c), or legitimate interests, Article 6(1)(f) GDPR, as applicable
Use optional technologies or features that legally require consent	The data identified when consent is requested	Consent, Article 6(1)(a) GDPR

Our legitimate interests are protecting users and the Service, maintaining availability and reliability, diagnosing faults, responding to disputes, and preventing fraudulent or abusive use. We balance these interests against your rights and reasonable expectations.

Information marked as required in the Service is needed to create an account or provide the feature you request. If you do not provide required information, we may be unable to provide that account or feature. Other information is optional.

5. AI-assisted processing

Jobaria uses automated tools to parse documents, structure career information, analyze user-provided job descriptions, and produce suggestions or drafts. Depending on the feature, content may be processed by a document-parsing provider or by models hosted through Google Cloud Vertex AI.

AI output may be incomplete or inaccurate. You should review it before using it. You decide whether to accept, edit, export, or otherwise use generated content.

Jobaria does not use these tools to make a solely automated decision that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR. In particular, Jobaria does not decide whether an employer interviews, hires, or rejects you.

6. Recipients and service providers

Jobaria discloses personal data only where needed to provide and secure the Service, comply with law, or protect legal rights. Depending on the feature, recipients include:

Recipient or category	Purpose	Data typically involved
Google Cloud, including Cloud Storage and Vertex AI	Infrastructure, file storage, and AI-assisted processing	Account identifiers, files, prompts, job content, and generated content
Parsona	Resume and document parsing	Uploaded documents and extracted career information
Amazon Web Services, including SES	Transactional email delivery	Name, email address, message content, and delivery metadata
Sentry	Error, crash, and performance monitoring	Technical, diagnostic, account identifier, and event data where relevant
Public-profile retrieval provider	User-requested retrieval of public LinkedIn profile data	Submitted profile URL and publicly available professional-profile information
Google or LinkedIn, when you choose their authentication services	Social login and account connection	Authentication identifiers, email, and authentication tokens
Google Fonts and jsDelivr	Delivery of fonts or other static frontend resources	IP address, request headers, and technical request information
Professional advisers, courts, regulators, or authorities	Legal advice, claims, and compliance with binding requests	Information necessary for the relevant matter

Google and LinkedIn may act as independent controllers for information they process for their own authentication services. Their own privacy notices apply to that processing.

Jobaria does not sell or rent personal data. If Jobaria undergoes a reorganization, financing, acquisition, or sale, relevant data may be disclosed subject to confidentiality and applicable data-protection requirements.

7. International transfers

Some providers or their subprocessors may process personal data outside the EU/EEA. A destination outside the EU/EEA may not provide the same statutory level of protection.

Where Chapter V GDPR requires a transfer safeguard, Jobaria uses an applicable European Commission adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. You may request information about the safeguard applicable to a particular transfer, including how to obtain a copy, by contacting [email protected]. Commercial or security-sensitive provisions may be redacted.

8. Cookies and similar technologies

Jobaria currently uses cookies and browser storage for authentication, security, social-login flows, language selection, and interface preferences. Jobaria does not currently use advertising or audience-measurement analytics.

Technology	Purpose	Typical duration
Authentication and session cookies	Keep you signed in, refresh authentication, and protect account access	Session or up to 7 days
Temporary social-login cookies	Complete and secure a login requested through an external provider	Short-lived or until the login flow ends
Language or locale storage	Remember your selected language	Up to 1 year
Interface-preference storage	Remember user-requested display and editor choices	Session, up to 7 days, or until browser storage is cleared, depending on the setting
Session storage	Maintain temporary state for the current browser tab or feature	Until the tab or session ends

Jobaria may introduce consent-based analytics, such as Google Analytics, in the future. Before doing so, Jobaria will update this notice and its cookie information to identify the provider, purposes, data, duration, international transfers, and withdrawal method. Where consent is required, analytics will not load or set identifiers before you choose to consent, and you will be able to withdraw consent as easily as you gave it.

You can clear cookies and browser storage using your browser controls. Blocking storage that is necessary for authentication or a feature you request may prevent that feature from working.

9. How long we keep personal data

Jobaria keeps personal data only for as long as necessary for the purposes described above. Retention is determined by the type of data, the duration of your account, the feature involved, security needs, provider settings, and applicable legal obligations.

Account and service content: retained while your account is active so that Jobaria can provide the Service.
User-deleted documents: removed from active storage when the deletion operation is completed, subject to temporary residual backup copies.
Account deletion: deleting your account disables account access and revokes active authentication. It does not currently erase every account-linked record and file automatically. To request erasure of personal data, contact [email protected]. Jobaria will assess and act on the request in accordance with Article 17 GDPR and the applicable legal exceptions.
Authentication, security, and diagnostic records: retained for the shortest period reasonably necessary to secure and maintain the Service, investigate incidents, and prevent abuse, then deleted or anonymized.
Provider-held information: retained according to the relevant service configuration and contractual deletion process, subject to Jobaria's instructions where the provider acts on Jobaria's behalf.

Jobaria may retain limited information for longer where a specific law requires it or where the information is demonstrably necessary to establish, exercise, or defend legal claims or to address fraud or security incidents. Such information is isolated from ordinary product use, access is restricted, and it is deleted when the exception no longer applies.

10. Security

Jobaria uses technical and organizational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, or access. These measures include encrypted HTTPS connections, password hashing using Argon2, authentication and authorization controls, restricted infrastructure access, network controls, rate limiting, logging, and error monitoring.

No online service can guarantee absolute security. If you believe your account or personal data may have been compromised, contact [email protected].

Subject to the conditions and exceptions in applicable law, you may have the right to:

Access your personal data and obtain information about its processing.
Rectify inaccurate personal data and complete incomplete data.
Erase personal data in the circumstances provided by Article 17 GDPR.
Restrict processing in the circumstances provided by Article 18 GDPR.
Receive and transmit portable data where processing is automated and based on consent or a contract.
Object to processing based on legitimate interests. If personal data were processed for direct marketing, you could object to that processing at any time.
Withdraw consent at any time where processing relies on consent, without affecting processing that was lawful before withdrawal.
Lodge a complaint with a competent supervisory authority and seek a judicial remedy.

Jobaria does not currently make solely automated decisions covered by Article 22 GDPR.

To exercise a right, email [email protected]. Please describe your request and the account or email address concerned. Jobaria may request information reasonably necessary to verify your identity and protect your account.

Jobaria will respond without undue delay and ordinarily within one month. Where permitted by GDPR, that period may be extended by up to two additional months because of the complexity or number of requests; Jobaria will notify you within the first month if an extension is needed. A request is generally free of charge, although GDPR permits a reasonable fee or refusal for requests that are manifestly unfounded or excessive.

12. Users under 18

Jobaria is not intended for anyone under 18, and people under 18 may not create or use a Jobaria account. If you believe a person under 18 has provided personal data to Jobaria, contact [email protected] so that the matter can be investigated and the data deleted where appropriate.

13. External services and links

Jobaria may link to job boards, employer websites, LinkedIn profiles, or other third-party services. Those third parties determine their own processing practices. Review their privacy information before providing data to them. A link does not mean that Jobaria controls or endorses the third party's privacy practices.

14. Changes to this policy

Jobaria will update this Privacy Policy when its processing changes or when clarification is required. The current version and effective date will be displayed on the Service. If a change materially affects how Jobaria uses personal data, Jobaria will provide an appropriate advance notice through the Service or by email where required.

Consent will be requested separately where a new processing activity requires it. Continued use of the Service will not be treated as consent where GDPR requires affirmative consent.

15. Contact and complaints

For questions, complaints, or requests concerning this Privacy Policy or your personal data, contact: