Privacy Notice
This Privacy Notice explains what personal data Jobsucher collects, why, on what legal basis, who receives it, how long we keep it and what rights you have. It is the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR). It is written for people who use Jobsucher and for people whose details a user has entered.
1. Who is responsible
The controller of your personal data is SIA "CUNSKIS", Latvia, Riga, Ģertrudes street 99 k-2 42 ("we", "Jobsucher").
Contact for everything about your data, including exercising your rights: info@jobsucher.app. We have not appointed a Data Protection Officer because the law does not require one; the address above reaches the person responsible for privacy.
The supervisory authority is Datu valsts inspekcija (Data State Inspectorate of Latvia), www.dvi.gov.lv. You may complain to it, or to the authority in the EU country where you live or work, at any time.
2. How to read this notice
Jobsucher is a product that keeps developing. So this notice describes data by category and by purpose rather than by database column, and it lists the companies that help us as categories of recipients, with the current named list in a public register: jobsucher.app/legal/recipients.
When we add a named provider inside an existing category, or a new data item that serves a purpose already described here, we update the register or this notice and, where it matters to you, tell you by email or in the application. You do not need to agree again.
When we want to use your data for a new purpose, we tell you before we start, and if the law requires your consent we ask for it and do not start without it.
Earlier versions of this notice stay readable at the same address.
3. What data we process, why, and on what legal basis
| Purpose | Data (categories) | Legal basis |
|---|---|---|
| Creating and running your account: signing up, signing in, keeping you signed in, password recovery, plan limits. | Email address, login name, password (stored only as a one-way hash), your name, roles and plan, sign-in sessions, API tokens. | Contract (Art. 6(1)(b)). |
| Your professional profile and CVs: the tools you use to describe yourself and to build CVs. | Contact details printed on a CV (phone, LinkedIn and GitHub links); languages and levels; education; certificates, including any document you upload; work experience, work cases and their free-text descriptions; skills and skill categories; CV templates and instructions; the CVs and their history that we generate for you. | Contract (Art. 6(1)(b)). |
| Vacancy and job-search management: collecting vacancies, matching them to your profile, tracking companies, contacts, conversations and offers. | Vacancies you paste, type or import (including the recruiter or poster details they contain); skills extracted from them and how they match your profile; companies; favourites; contacts, notes, messages and offer records you enter, including their amounts. | Contract (Art. 6(1)(b)). For details of other people, see section 9. |
| AI processing: reading vacancies and drafting CV content. | The vacancy text and the profile items used for a CV, and everything you wrote in them; the prompts and the AI responses; technical metrics (size, duration, token counts). Your name, email and phone are not sent to AI providers. | Contract (Art. 6(1)(b)); your explicit consent for transfers outside the EEA (Art. 49(1)(a)) and for any sensitive data you choose to include (Art. 9(2)(a)). See section 5. |
| Payments and billing: purchases, renewals, retrying failed payments, receipts, disputes, tax and accounting records. | Email, account identifier, plan, price, currency, dates, status and failure reasons; a payment-method token, card brand, last four digits and expiry (we never see or store the full card number); dispute records. | Contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c)). |
| Service email: renewal and billing notices, password reset, notices about your account and about changes to our agreements. | Email address, the content of the message. | Contract (Art. 6(1)(b)); legal obligation where the law requires the notice. |
| Marketing email: product news, tips and offers, only if you tick the separate box. | Email address, the fact and record of your consent. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. See the separate marketing consent text. |
| Security, abuse prevention and reliability: protecting accounts, enforcing limits, finding and fixing errors. | IP address and browser information in server and security logs and in session data, error records and job queues, usage counters. | Legitimate interest (Art. 6(1)(f)): keeping the service secure and working. |
| Understanding and improving the product, and onboarding: showing you what to do next, unlocking onboarding steps, measuring which features are used. | A journal of which screens and features you opened or used and when (for example "opened billing", "generated a CV"), onboarding progress, a profile-completeness and "profile power" figure. We do not use advertising or cross-site tracking. | Legitimate interest (Art. 6(1)(f)). You can object at any time (section 8). |
| Proof of what you agreed to: accountability under GDPR. | Which agreement and version you accepted or withdrew, when, from where in the application, and your IP address and browser identifier at that moment. | Legal obligation to demonstrate consent (Art. 6(1)(c), Art. 7(1)) and legitimate interest (Art. 6(1)(f)). |
| Legal claims and legal duties: establishing, exercising or defending claims; answering authorities. | Any of the data above, to the extent needed. | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)). |
Where the data comes from: mostly from you. Some is created by us (skills extracted from vacancies, match indicators, generated CV text, usage counters). Some comes from third parties: the vacancy pages you ask us to read, and payment providers (payment confirmation, card brand and last four digits).
Providing the data marked "contract" is necessary to use Jobsucher; without it we cannot provide the service. Everything else is optional.
4. What we deliberately do not do
We do not sell your personal data.
We do not use your data for advertising, and we do not run advertising or analytics trackers of third parties.
We do not use the content you enter to train our own or third-party AI models, and we do not share your profile with employers or recruiters. A CV leaves Jobsucher only when you download it and send it yourself.
5. Artificial intelligence, profiling and automated decisions
Jobsucher uses AI models provided by third parties to extract skills from vacancies and to write the text of CVs. For that we send them the vacancy and the parts of your profile that a CV needs. The current provider and the transfer safeguards are in the recipients register. Each request asks the provider not to store the response object; providers may nevertheless keep technical copies for a limited period for abuse monitoring under their own terms. We keep the prompts and answers ourselves for a short time to diagnose problems (see section 7).
Some of what Jobsucher does is automated and affects only your own use of the service: matching vacancies against your skills; scoring which experiences to include in a CV; a quality check that can hold back or flag a generated CV; a minimum profile-completeness needed to generate CVs; a "profile power" figure that adjusts plan limits; automatic renewal and retry of payments, and switching paid features off when a payment fails. None of these produces a decision with legal or similarly significant effect on you in the sense of Article 22 GDPR, and nobody is rejected, ranked or evaluated for an employer. You can always ask us to have a person review the result (section 8).
Anything you write in a free-text field, and any file you upload, is stored as you wrote it. Please do not include sensitive data (health, religion, political opinions, trade-union membership, ethnic origin, sexual orientation, biometric or genetic data, criminal convictions) unless you really want it in your profile. If you do include it, we treat it as data you have chosen to give us; it may be sent to the AI provider as part of a CV request, and you can delete it at any time. Your explicit consent to this is collected separately in the AI Processing consent.
6. Who receives your data
We use service providers ("processors") who process data on our instructions under contracts that protect it, and a few recipients who act for their own purposes. By category:
providers of artificial-intelligence and language-model services (drafting CV text, analysing vacancies);
payment service providers (payment providers are independent controllers for the card and identity checks they perform);
email delivery providers;
hosting, server, storage and network infrastructure providers;
certificate authorities and other providers of security infrastructure (host names only);
public web sources you ask us to read, such as a public vacancy page (a source of data, not a recipient);
professional advisers, auditors and insurers, where necessary and bound by confidentiality;
courts, authorities and other bodies where the law requires or allows disclosure;
a successor, if the service is transferred to another operator (you will be told first and the same protections apply).
The named providers we use today, what each gets and where it is located are listed in the recipients register. Our own staff and contractors can access data only as needed to run, support and secure the service; administrators can see account data, vacancies and generated CVs in order to fix problems, and that access is limited to those who need it.
Your browser may contact third parties directly in two cases: a company logo you enter as a web address is loaded from the site you named; and until we replace the default, the account menu may request a generated avatar image, which reveals your initials and IP address to the avatar service. We are removing the second.
7. Where data is processed, and how long we keep it
International transfers. Some providers are located in, or may access data from, countries outside the European Economic Area, notably the United States. Where there is no adequacy decision covering the recipient, we rely on standard contractual clauses or another safeguard from GDPR Chapter V, or, for the AI provider, on your explicit consent, which you may withdraw (withdrawing it means CV generation stops working). The register states the mechanism for each provider. You can ask us for a copy of the safeguards.
Retention. We keep data only as long as needed for its purpose:
| Data | How long |
|---|---|
| Account, profile, vacancies, CRM records, CVs and their history, usage journal, uploaded documents | While your account exists. Erased when you ask us to close the account or we close it (see below). |
| AI prompts and responses kept for diagnostics | Up to 30 days; failed or fallback calls up to 90 days. Generated CV results stay with your CV. |
| Sign-in sessions | Two hours of inactivity; longer only if you tick "remember me". |
| Server and security logs | Short, rotating retention (days to weeks). |
| Payment, invoice and accounting records | As long as accounting and tax law require. |
| Consent records (version, time, IP address, browser) | As long as your account exists and afterwards for as long as needed to establish, exercise or defend legal claims. |
| Marketing consent and unsubscribe status | Until you withdraw; we then keep only the fact of the withdrawal so that we do not email you again. |
Closing your account. Ask us at info@jobsucher.app from the address of your account. We verify it is you, erase your account and its content and remove the payment token, normally within one month, and confirm to you. We may keep what the law requires (for example accounting records) or what we need to defend legal claims, and we tell you what we kept and why. Where a payment provider holds its own records, it keeps them under its own rules.
8. Your rights
You have the right to: access your data and get a copy; have inaccurate data corrected (most of it you can edit yourself in the application); have data erased; restrict processing; receive the data you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller (portability); object to processing based on legitimate interest, on grounds relating to your situation; ask that a person reviews an automated result; and withdraw consent at any time, as easily as you gave it, without affecting what was lawful before. You can review and withdraw your consents at any time in the application under Privacy & consents.
To use a right that is not available as a button in the application, write to info@jobsucher.app. We reply within one month (extendable by two months for complex requests, and we will tell you). It is free unless a request is manifestly unfounded or excessive. We may ask for information to confirm your identity. You may also complain to the supervisory authority named in section 1.
9. Other people's data (recruiters, contacts, people named in vacancies)
Users may enter details of people they deal with in a job search: a recruiter's name, position, email, LinkedIn link, phone, and the content of messages. Vacancies also often name a recruiter or a hiring manager. If you are such a person, we did not collect your data from you; the user did, or it was in a public vacancy. We hold it for that user only, to help them manage their own job search, on the basis of legitimate interest (Art. 6(1)(f)). We do not use it for any other purpose, we do not contact you, and we do not share it with other users.
The data is the categories above (name, position, contact details, communication records). It is kept while the user's account exists or until they delete it. To ask what we hold about you, to have it corrected or erased, or to object, write to info@jobsucher.app. This is also the information we owe you under Article 14 GDPR.
10. Cookies and similar technologies
Jobsucher uses only what is needed for it to work: a session cookie that keeps you signed in, a security (CSRF) cookie, an optional "remember me" cookie if you tick it, and browser storage that remembers your display preferences (for example light or dark mode and which menu groups are open). These do not require consent. We do not use advertising or analytics cookies. If we ever add anything that is not strictly necessary, we will ask for your consent first.
11. Security
We protect data with measures suited to the risk: encrypted connections (HTTPS), hashed passwords, access limited to those who need it, separate credentials for services, separation of accounts inside the application. No system is perfectly secure. If a breach is likely to put your rights at risk, we notify you and the authority as the law requires.
12. Age
Jobsucher is for people who are at least 16 years old. If you believe a younger person has given us their data, write to us and we will erase it.
13. Changes to this notice
We update this notice when we change what we do or when the law changes. The current version is always at jobsucher.app/legal/privacy and the recipients register at jobsucher.app/legal/recipients. Changes that affect your rights or add a new purpose are announced to you, by email or in the application, before they apply.