1. Who this covers
This policy applies to everyone who visits jobflit.com, creates an account, or whose information reaches us because of an application we submit (for example, an employer who writes back). Jobflit is the controller of the personal data described here. Contact: hello@jobflit.com.
2. What we collect
Information you give us
- Account: name, email address, password (stored only as a one-way hash), and whether your email is verified.
- Profile: location and timezone, phone number, LinkedIn and portfolio links, work authorisation and visa type and expiry, relocation preferences, salary expectations, availability, and how you like to work (remote, hybrid, on site).
- Roles: the job titles you want, experience level, skills you rated, companies you excluded, and how far along a draft role is.
- Resume and documents: the resume file you upload, the text we extract from it, and the enhanced versions, cover letters and answers Vivy writes with you.
- Support and feedback: messages you send through Support, bug reports, complaints, written testimonies and video testimonials, including the video file itself.
- Referrals: your referral code and the accounts that signed up through your link.
Information created while you use Jobflit
- Jobs: every job Vivy matched to you, the eligibility verdict and reason, the fit score, strengths and gaps, and the full AI assessment of your resume.
- Applications: the status of each application, the exact data submitted, proof of submission (screenshot, confirmation page or application ID), failure reasons, and the employer's platform.
- Email: mail sent and received through your Jobflit application address, including employer replies, interview invitations and rejections.
- Credits and payments: your balance, every credit transaction, purchases, the plan bought, the amount, currency and gateway, and the payment provider's reference. We never hold full card numbers.
- Sessions and security: sign-in times, the device and browser (user agent), IP address, whether a session was revoked, and a log of security events (sign-ins, failed attempts, password changes, sign-outs). You can see and end sessions from Settings, and we use the log to email you when a new device signs in and to detect abuse.
- Emails we send you: a record of each message (receipts, replies, approvals, reminders) with its subject and status.
Information from other places
- Public job listings from job boards and employer sites, which we match against your profile.
- Employer replies to the applications we submit.
- Payment confirmations from Stripe or Paystack.
- If you sign in with Google (when available): your name, email and profile picture from Google.
3. Why we use it
- To run the service for you: find eligible jobs, assess and enhance your resume, prepare and submit applications, receive employer replies, and show you proof and history. (Performance of our contract with you.)
- To process payments, manage credits, pay referral and testimonial rewards and prevent fraud. (Contract and legitimate interests.)
- To send you service emails: verification, receipts, application outcomes, employer replies, support replies, reward decisions and important notices. These are part of the service and you cannot opt out while your account is open, except employer-reply forwarding, which you control in Settings.
- To answer your support requests. (Contract.)
- To keep Jobflit secure, detect abuse, enforce our terms and comply with the law. (Legitimate interests and legal obligation.)
- To understand how Jobflit is used in aggregate (for example, how many people sign up each month or how many applications succeed) so we can improve it. We look at counts and trends, not at your resume. (Legitimate interests.)
- To show your approved video or written testimonial publicly, only with your permission. (Consent, which you can withdraw.)
We do not sell your personal data, and we do not show you advertising.
4. How AI is involved
Vivy uses large language models from third-party AI providers (currently OpenAI, Google Gemini and Anthropic) to read job descriptions, judge eligibility and fit, assess your resume, and draft enhanced resumes, cover letters and application answers. To do this we send the relevant parts of your profile and resume and the job description to the provider, over an encrypted connection, under contracts that stop the provider from using your data to train their models. Resume assessments are cached so the same resume is not sent again.
AI output is a draft for you to review. Decisions that matter to you, such as whether an application is actually submitted, are made by the rules you set (approve each job, or auto-apply within the limits you chose), not by an AI acting alone. You can always see what was sent.
6. Where your data lives
Our servers and database are hosted on Railway and our files on Cloudflare, in data centres in the United States and Europe. AI and email providers are in the United States. If you are in the UK, EU, Canada, Nigeria or elsewhere, your data is transferred to those places. We rely on the providers' standard contractual clauses and equivalent safeguards and encrypt data in transit and at rest.
7. How long we keep it
- Account, profile, roles, resume and application history: for as long as your account is open, so you keep your history and proof.
- Hibernated accounts: everything is kept, untouched, until you reactivate. Hibernation stops all processing, emails and applications.
- Closed accounts: profile, resume files, extracted resume text, AI assessments, roles, applications, employer mail, notifications, videos and your application email address are deleted within 30 days of closing (our system runs this clean-up daily). We keep a minimal record (your email, the dates you joined and closed, and your credit and payment history) so the account cannot be reopened and to stop repeat sign-up bonuses. That record is deleted 24 months after closing, or after 7 years if you ever bought credits, because tax and accounting law requires it.
- Accounts nobody has opened: if you have not signed in for 23 months we email you, and if you still have not signed in a month later (24 months in all) we close the account as above. Signing in at any point cancels this.
- Employer mail: kept with your application history; deleted with the account.
- Payments and credit transactions: 7 years, as tax and accounting law requires, tied to your email only. After the account is closed they sit in the minimal record described above.
- Sessions and security logs (including sign-in events): deleted 90 days after they end or occur.
- Resume conversations in progress: while you talk to Vivy about a resume, we save the conversation so you can pick it up if you leave the page. It is deleted as soon as the resume is built, after 30 days with no activity, or with your account.
- Support tickets: deleted 24 months after they are resolved or closed. If your account is closed first, any written testimony in a ticket is taken off public display at once.
- Video and written testimonials: until you withdraw permission or close your account. On request we delete the video file and take the testimony off display; closing your account deletes your videos within the 30 days above. Credits already earned stay.
- Backups: database backups are kept for 30 days and then overwritten; deleted data may remain in a backup until then.
8. How we protect it
Passwords are stored only as salted hashes. Sessions use random tokens that are stored hashed, can be revoked, expire after inactivity and after a fixed maximum, and are renewed whenever you sign in or change your password. Staff sessions expire much sooner. All traffic is encrypted with HTTPS, and files are encrypted at rest. Resume and video files are served through short-lived signed links, not public URLs. Access to production data is limited to named staff, and admin actions on an account are recorded. No system is perfectly secure; if we discover a breach that affects you, we will tell you and the relevant authority without undue delay.
10. Your rights and controls
Inside the app you can edit your profile and resume, change your email forwarding, see and end your sessions, hibernate or close your account, and see every application, email, credit transaction and support ticket on your account. Depending on where you live you also have the legal right to:
- Access a copy of the personal data we hold about you.
- Correct anything that is wrong.
- Delete your data (close your account), subject to the records we must keep in section 7.
- Receive your data in a portable format.
- Object to, or restrict, certain processing, and withdraw consent (for example, to a testimonial) at any time.
- Complain to your data protection authority: the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office, your EU supervisory authority, or the Nigeria Data Protection Commission.
To use any of these rights, email hello@jobflit.com from the address on your account. We answer within 30 days and never charge for a first request.
11. Children
Jobflit is for adults looking for work. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will delete it.
12. If you are an employer or recruiter
If you received an application through Jobflit, the applicant chose to send it to you. Mail you send to the applicant's Jobflit address is delivered to them and stored with their application history. We hold your name, email and message for that purpose only. Write to hello@jobflit.com if you have a question about it.
13. Changes to this policy
When we change how we handle your data we update this page and the date at the top. For changes that matter to you we email the address on your account before they take effect. Older versions are available on request.
14. Contact
Privacy questions and requests: hello@jobflit.com. Please write from the email address on your account so we can verify it is you.