Privacy Policy
Last updated: 24 July 2026
Who we are
Job360 (“we”, “us”) operates the job-search service at job360.uk. We are the data controller for the personal data described here. To contact us about anything in this policy, email privacy@job360.uk.
What we collect
- Account data — your email address and a password. Passwords are stored only as an argon2id hash; we cannot read them. If you sign in by magic link, no password is stored at all.
- Profile data you upload — the text of your CV (PDF/DOCX), an optional LinkedIn profile PDF, an optional GitHub username, your job preferences, and your timezone.
- Activity data — jobs you save or dismiss, applications you track, notification settings, and documents you generate.
- Technical data — request logs, error traces, and product-usage analytics.
Job listings themselves are aggregated from public third-party sources and are not personal data about you.
Why we process it (lawful basis)
- Contract — matching and scoring jobs against your profile, generating tailored documents you request, and operating your account.
- Consent — sending notifications to channels you connect (email, Slack, Discord, Telegram). You can disconnect a channel at any time.
- Legitimate interest — keeping the service secure, fixing errors, and understanding which features are used.
We do not sell your data. We do not show ads. We do not use your data to train AI models.
AI processing — read this part
When you upload a CV or LinkedIn PDF, or generate a tailored CV or cover letter, the text is sent to the AI providers listed below to be parsed or drafted. This is core to how Job360 works — without it, we cannot build your profile or score jobs. We use these providers’ business APIs, which contractually do not use your content to train their models. Your original files and the extracted profile stay on our servers; the AI providers process text transiently.
Who we share data with (subprocessors)
We share data only with the service providers below, only for the purposes stated, and never for their own marketing.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| OpenAI | CV parsing and tailored-document generation (primary AI provider) | Text extracted from your CV / LinkedIn PDF; job descriptions | USA |
| Google (Gemini), Groq, Cerebras | CV parsing (fallback AI providers, used only if the primary fails) | Text extracted from your CV / LinkedIn PDF | USA |
| Railway | Application hosting and database | All service data (encrypted in transit and at rest) | EU/USA |
| Resend | Transactional email (login links, verification, notifications) | Your email address and message content | USA |
| Cloudflare R2 | Encrypted database backups | Ciphertext only — backups are encrypted before upload; Cloudflare never sees readable data | EU |
| PostHog (EU) | Product analytics (which features are used) | Usage events and pseudonymous identifiers | EU |
| Sentry | Error monitoring | Error traces and request metadata (request bodies are scrubbed) | EU/USA |
| GitHub | Fetching your public repositories, if you link a GitHub username | The GitHub username you provide | USA |
Where a provider is outside the UK, transfers rely on that provider’s standard contractual clauses / UK addendum. We will update this list before adding any new subprocessor.
How long we keep it
- Aggregated job listings are deleted after 30 days automatically.
- Your account and profile data are kept until you delete your account.
- Encrypted backups are retained on a rolling basis and expire automatically; deleted accounts age out of backups with that cycle.
How we protect it
All traffic is encrypted in transit (HTTPS/HSTS). Passwords are argon2id-hashed. Notification-channel credentials (webhooks, bot tokens) are encrypted at rest. Database backups are encrypted before they leave our infrastructure, so the backup-storage provider only ever holds ciphertext.
Your rights
Under UK GDPR you can access, correct, export, or delete your personal data, object to processing, and withdraw consent. Deleting your account (Settings → Account → Delete) erases your per-user data immediately — this is our built-in Article 17 (“right to erasure”) mechanism. For anything else, email privacy@job360.uk and we will respond within one month. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).
Changes to this policy
If we make material changes, we will update the date at the top and notify registered users by email before the changes take effect.