Privacy policy
Last updated 9 November 2026.
Who is responsible
gojob.now is run by Krystyna Zarudna, a sole trader registered in Poland (CEIDG; NIP 8993047576, REGON 543803052), ul. Ślężna 116D/19, 53-110 Wrocław, Poland (the "controller" under the EU General Data Protection Regulation, GDPR). For anything about your data, write to [email protected].
What we store about you
- Your account: the email address, name and profile picture your Google, LinkedIn or Microsoft account shares when you sign in, which of them you sign in with, when you joined, when you last signed in and last used the app (to the hour), and when you accepted the terms and which version of them (recorded as you create the account). We keep a small copy of the picture on our own server and show you that, so your browser does not contact Google, LinkedIn or Microsoft while you use the app; it goes when you delete your account. From LinkedIn sign-in we receive only these basic details (name, email, picture); it gives us no access to your LinkedIn profile, connections or messages. Microsoft sign-in likewise shares only your name and email, and gives no access to your mailbox: that needs connecting Outlook separately. If you sign up with your email address instead, we store that address, the name you type and your password as a one-way hash (never the password itself). To check the address and to reset a forgotten password we email you a link; we keep only a hash of each link, the time and a hashed form of your IP address, for a day, to stop repeated requests. Wrong password attempts (the address typed, a hashed IP address and the time) are kept for a day to slow down guessing. Your account has a role (user, Pro, admin or partner), with a log of each change to it: when, from what to what, and which admin made it. It goes when you delete your account. If you have not used the app for 30 days, we stop checking how well new jobs fit you and email you once to say so; signing in starts the checks again. We send no marketing email. Accepting the terms is not consent to it: if we ever want to send any, we will ask separately, and saying no changes nothing about your account.
- What you give us to work with: your master CV, your profile and job preferences, your job matching rules, the list of clients from your CV that drafts must not name, and earlier versions of these so you can undo an edit; also your CV tailoring options (where each role or project of your master CV goes on a tailored CV, for one job or a type of role). If you upload a CV (PDF or Word) to fill these in, the file is sent to Anthropic to be read; we keep only the text and fields you confirm, not the file (it waits on our server only until it is read, a day at most). The same goes for your LinkedIn "Save to PDF" file or data export ZIP (from the ZIP we read only the profile, positions, education, skills, certifications and languages files). If you give your own LinkedIn profile address and confirm it is yours (offered only while we use Crustdata), we look that one profile up once through Crustdata and send what it returns to Anthropic to write your CV; we never look up anyone else's profile this way. If you choose Import from LinkedIn, LinkedIn asks you on its own page whether to share your profile with us (possible for profiles located in the EU/EEA, under the EU's data portability rules); we then read once your profile, positions, education, skills, certifications and languages, send them to Anthropic to write your CV, and delete LinkedIn's access as soon as the CV is built (at most a day later if you stop halfway). You can withdraw the consent in your LinkedIn settings.
- Your job search: the status, notes, pay notes and fit scores of the jobs in your list, your "interested / not interested" feedback, companies you hid, starred as favourites, watch for new jobs or marked as followed on LinkedIn (only your own note: we never act on LinkedIn for you), CVs made for a job (as PDF files), and outreach drafts. If you add a company's missing website, the website is shared with everyone; that you added it is kept for 7 days, so you can correct it. Interview rounds you add: who took part, when, your notes, and any call transcript you attach, as text (the file itself is not kept). A transcript is sent to Anthropic only when you ask for its summary, or for a follow-up email to someone from that round when the round has no summary yet. Follow-up emails you write after a round are kept with your outreach drafts. Before attaching a transcript, make sure the others on the call agreed to it being recorded or transcribed. Interview practice quizzes you make: the questions, your answers and scores, and the preparation details you type. The latest "About me" answer and the latest cover letter written for each job. For your contacts, when you press Fill information (offered while we use Crustdata): their professional LinkedIn profile (headline, roles, education, skills) from Crustdata, kept with the contact until you delete it; never personal emails or phone numbers. LinkedIn messages: if you upload your own LinkedIn data export, only your messages with contacts you saved here are kept (the rest of the file is read once and discarded); you can also log messages by hand. We never connect to your LinkedIn account.
- Your plan: whether your account has Pro, and for each period of it: when it starts and ends, where it came from (a subscription you bought, or the free month for accounts that existed before Pro), a reference (the subscription's number, or which gift it was), and when it ended early (after a refund, for example). Periods that are over stay on the list, so we can answer a question about them. We also keep that we sent you the email about the change to Pro and when, so it is sent only once. All of it goes when you delete your account.
- Your carrots, from before Pro: the log of paid actions (when, which action, how many carrots, and the job it was for), of monthly renewals and of changes an admin made to your plan or carrots, with the reason given. And a record of your carrot balance on the day Pro replaced carrots: your monthly and top-up carrots and how much of them you had paid for, kept as a record of the change, so we can answer a question or a complaint about it. It goes when you delete your account.
- Your payments, only if you buy Pro: Paddle's ids for you as a customer, your subscription (plan, status, next payment date, a cancellation you scheduled) and each payment (date, what you bought, amount), plus the notices Paddle sends us about them, and when a payment gave your account Pro or a cancellation or refund took it away, with that payment's reference. Before each order we keep what you confirmed (agreeing to the terms, which version, and asking for Pro to start at once, with the time), as proof under consumer law, and we email you the order's confirmation. Your card details, billing address and invoices stay with Paddle and never reach us. It goes when you delete your account (your subscription is cancelled first), except a line per payment or refund with only its amount, VAT, currency and date, no longer linked to you, which our accounts keep as tax law requires (and which pays a referring partner's share); Paddle keeps its own records as the law requires of a seller.
- Career strategy session, only if you book one: when you asked, the note you added and the phone number you left, if any. We email them, with your name and account email, to our own inbox so we can get in touch with you, and our admins see your name and email in a notification in the app (kept 90 days). It goes when you delete your account.
- Help requests, only if you send one: the message you write in "Need help or report an issue?", when you sent it and which page of the app you were on. We email it, with your name and account email, to our own inbox so we can answer you, and our admins see your name, email and the start of the message in a notification in the app (kept 90 days). It goes when you delete your account.
- Error reports from your browser: if something breaks on a page while you use gojob.now, the page sends us the error message, the script and line it came from, which page you were on (never what you typed, a job or your CV), your browser's name and version and, if you are signed in, your account id, so we can fix it. Our admins see them in the app and by email. Kept 90 days; they go when you delete your account.
- Job alerts: your alert settings (in the app, by email, the score you chose, how often) and a list of the jobs whose fit score reached it, until they have been announced. They tell you in the app and, only if you turn it on in Account, Notifications (or when setting up your account), by email to your account address: the job titles, companies and scores, and links to them. Once a day the digest also lists, under Still to do, jobs you marked Interested and have not made a tailored CV for (title, company and a link); to name each job at most three times, a few days apart, we keep how often and when we last named it. Each email has a link that turns the emails off with one click. These are service emails, not marketing. They go when you delete your account.
- Telegram, only if you connect it: the number of your private chat with our bot and your Telegram username if you have one (kept so we can message you), and a short-lived link token (30 minutes, only its hash is stored). With Telegram turned on in Account, Notifications, the bot messages you the titles, companies, pay, scores and links of your good-fit jobs. Send /stop to the bot, or press Disconnect, and the chat is deleted. These are service messages, never marketing. They go when you delete your account.
- Background work and notifications: a record of work you started that runs in the background (for example a tailored CV: which job, when, and whether it worked), and the notifications that tell you it finished or that a job scan found new jobs for you. Notifications are kept for 90 days, or until you dismiss them.
- Your mailbox, only if you connect Outlook: your mailbox address and access tokens (stored encrypted), so the app can save drafts, send an email when you press Send and confirm, and show your email history with a contact. Only you can use your connected mailbox; disconnecting it on the Account page deletes the tokens.
- Claude access, only if you connect it: the apps you allow on our approval page, such as claude.ai or Claude Desktop (the app's name and where it returns to, when you allowed it and when it last read, and its current access and refresh tokens, of which only hashes are stored), and the tokens you create in Account, Connect Claude (a name you choose, when it was made and last used; only a hash of the token itself is stored). To identify an app we read the short public description it publishes at its own address, or keep the name and return address it registers. With either, an AI assistant you set up can read your own job list, fit scores, companies, contacts, notes, job preferences, master CV and Areas to grow, and nothing of anyone else's. It cannot change anything, apply or send a message. What it reads goes to that assistant's provider under your own agreement with them, not as our processor. A connected app works until you disconnect it or it goes unused for 30 days, and a token until you revoke it; both stop when you delete your account. Each use is logged with your account and the tool's name, without what it read.
- Apply with gojob.now, only if you use the Chrome extension: a token for each browser you connect (a name, when it was made and last used; only a hash of the token is stored), and for each application you start: the job, the CV it uploaded, each step (the page's address, what was filled in and pressed, what the agent asked you and your answers), the summary you saw before sending, and whether you sent it. Answers you tick "Save to my profile" for are kept with your documents (Account, Answers for applications), where you can change or delete them, and are used for your later applications. To fill in a form, the extension reads the application page in your browser (its fields, buttons, links and some of its text) and we send that, with your CV, profile and job preferences, to Anthropic for the next step. The extension acts only in the tab of the application you started, never types passwords or solves captchas, and never sends an application: only your click on Send application does. What you send goes to the employer (and its recruitment system) as any application you send yourself. To find out why an application did not go through and improve the extension, we keep a record of each step for 30 days: what the page showed the agent, what it answered and did, what you chose, and any error; then it is deleted. You can download the record of your own application from the extension's panel; our admins can read it to fix problems, and get a daily summary of which applications went through (without what was filled in). Disconnecting is removing the extension; everything stops when you delete your account.
- Referral by a partner: if you open a partner's referral link (gojob.now/r/...) before you sign up, a cookie keeps the partner's link code and the time you opened it, for 30 days at most, and nothing else about you. If you create an account in that time, we store which partner referred you, so we can pay them their agreed share of a paid plan. The partner sees only numbers (clicks on their link, sign-ups, paying subscribers, and what they earned from those payments, less refunds), never who you are. Each click counts only towards a daily total per partner, without your IP address or browser. The record goes when you delete your account and is in your data download.
- Technical data: a session cookie that keeps you signed in, a cookie that remembers only which way you signed in last (Google, LinkedIn, Microsoft or email), so the sign-in page can mark it "Last used" (kept for a year, cleared when you delete your account), a cookie that remembers which shared job link you opened, so the job opens once you sign in (kept a day at most), and server logs (the IP address, time, page asked for and browser of each request) kept by our web server and by Cloudflare, which every request passes through, for security and troubleshooting. Your cookie choice (below) is kept in your browser only.
People in your job search (recruiters and hiring managers)
To help you reach the right person, gojob.now stores work contact details about people at hiring companies: their name, job title, company, work location, LinkedIn profile address and work email address. They come from the job ad itself, from what you type in, or from professional data providers (Crustdata for people at a company, Hunter for work email addresses). When Hunter finds no address and you press Try another way, it may build a likely work address from the format of the work addresses you already hold at that company (first.last@ and the like), marked as a guess. That address is then checked with Hunter, which only says whether it exists; nothing is sent to the person. When you mark a job Interested, it asks Hunter once for the people it knows in HR and recruiting at that company, with their work email addresses and the company's email format; they become your own contacts, and others there get a likely address in that format, marked as a guess, which you can have Hunter check. While we use Crustdata, at the same moment it asks Crustdata once for people in recruiting and HR at that company (name, job title, location, LinkedIn profile address). Crustdata's answer is kept for up to 7 days, so that the same question about that company is not paid for again; the contacts made from it are still each user's own. With those people, and when you press Fill information on a contact, Crustdata may give the address of the person's profile photo: our server fetches that photo once and keeps a small copy with the contact, so your browser never loads it from anywhere else; the copy goes when the contact or your account is deleted. On request in a job ("On the web"), Claude searches public web pages through Anthropic's web search and reads a few of them, looking for people at that company who matter for the opening (name, job title, why, and the address of the page that names them; a work email only when that page prints it, marked as not verified). It is sent only the company's name and website and the job's title, location and ad text, nothing about you. That answer is kept for up to 30 days and shown to anyone who asks about the same kind of role at that company, so that the same search is not paid for twice; the people you choose to save become your own contacts. While we use Crustdata, on request in a job, it also looks up people who held that role at the company before, with their dates in the role and current job, so you can learn what the job is like, and people who work there now and could refer you, with what they have in common with you (a past employer, school or city, read from your own CV), and the people you would likely work with there (a likely manager, peers and close collaborators, by job title). For the career map, when you press Get data on a company, it looks up to 100 people who work or worked there in roles like yours, with their job titles and dates at each employer, to show how people move between roles. We only keep work-related details (and the contact photo above), and a saved search or career map stays with the user who ran it.
These contacts are private to the user who found or added them: no other user sees them. If you are one of these people and want your details removed, or want to know what is stored about you, write to [email protected] and we will act on it within a month. Once your details are removed, we keep only a one-way fingerprint (a hash) of your work email address and LinkedIn profile address, so that no later search or user adds you again.
Why, and on what legal basis
- To provide the service you signed up for (finding and matching jobs, fit scores, tailored CVs, drafts, your pipeline): performance of our agreement with you, GDPR Art. 6(1)(b).
- Contact details of people at hiring companies: our and our users' legitimate interest in professional networking about a specific job, GDPR Art. 6(1)(f). We limit this to work details and honour objections.
- Security, preventing abuse, and keeping the service running: legitimate interest, Art. 6(1)(f).
- Which partner referred you: our legitimate interest in paying our partners what we agreed with them, Art. 6(1)(f).
- Google quick sign-in on the homepage: your consent, Art. 6(1)(a), given with "Yes" when the homepage asks. Your answer is kept only in your browser. On the sign-in page it loads without asking, because you came there to sign in (Art. 6(1)(b)).
We do not sell your data or show ads in gojob.now.
Cookies, analytics and ad measurement
The cookies that keep you signed in and remember your choices are necessary and always on. Anything else runs only if you say yes in the cookie banner, which asks on your first visit. Saying no changes nothing in how the site works.
- Analytics (your consent, Art. 6(1)(a)): which pages are visited, how people find us, and where sign-up gets stuck. We use Google Analytics, and Contentsquare for heatmaps and recordings of how pages are used. Contentsquare never records what you type into a form, and in onboarding and in the app it masks every text you see or type, so your CV, jobs, contacts and notes are never recorded. In the app, Mixpanel (Mixpanel, Inc., with its data kept in the EU) counts which features are used, so we know what to improve: only the names of the steps (such as "job opened", "status changed from new to applied", "CV tailored", "email sent"), short codes about them (a job status, which CV, the plan or pack bought, a number of questions), the area of the site, whether you are on a free or paid plan, and a random-looking number made from your account number that only we can link back to you. Never your name, email address, CV, the jobs, companies or contacts, pay, notes or anything you type.
- Marketing (your consent, Art. 6(1)(a)): whether our ads brought you here and led to a sign-up or purchase, so we pay only for ads that work. Google Ads, Meta (Facebook, Instagram), LinkedIn, Microsoft Advertising, Reddit and TikTok may set their cookies and learn that your browser visited after seeing their ad.
Both are loaded through Google Tag Manager, which itself loads only after a yes. What they receive: the pages you open, your browser and device, an approximate location from your IP address, the cookie identifiers they set, and these steps: signing up or in (with which method), finishing onboarding, opening the checkout and buying (the plan or pack, the amount and the order number), and in the app Mixpanel's steps listed above. Never your name, email address, CV, jobs, contacts or notes. Each of these companies also handles the data under its own privacy policy, and some are in the United States (see below).
Your choice is kept in your browser for 12 months, then we ask again. You can change it any time; taking a yes back deletes those cookies on gojob.now.
Separately, Cloudflare Web Analytics counts page views without cookies and without identifying you (our legitimate interest in knowing how much the site is used, Art. 6(1)(f)).
To find out why something in your account does not work as it should (for example which jobs reach your list, or why), one of our admins can open the app as you see it, for up to an hour at a time (legitimate interest in keeping the service working, Art. 6(1)(f)). This view is read only: nothing in your account can be changed from it and your data download cannot be taken. Every time an admin opens or leaves it, we log it.
To see which roles are in demand, our admins see totals over all accounts: how many people target each role in their job preferences, and how many jobs were marked interested, applied to or not interested, by kind of role. These are counts only and never show one person's list (legitimate interest in improving the service, Art. 6(1)(f)).
Services that process data for us
| Service | What for | What it receives |
|---|---|---|
| Anthropic (Claude) | Fit scores, tailored CVs, cover letters, outreach drafts, interview summaries and follow-ups, practice quizzes, "About me" answers, filling in application forms with the Chrome extension, the "On the web" search for people at a company, company research, and a company's basic facts that its job ads and homepage do not give (for these, Claude searches and reads public pages through Anthropic's web tools) | Your CV, profile and feedback, the job ad, the contact's name and title for a draft, an interview transcript when you ask for its summary, for a follow-up email the round's heading, date, your notes, its summary (or transcript) and the recipient's name and title, for a quiz the round's heading, interviewers' names and titles, notes and summary, plus the preparation details you type; for the web search only the company's name and website and the job's title, location and ad text; for an application form the page's fields, buttons, links and text, your answers to the agent's questions and the job ad; for company research and a company's basic facts only what we know of the company (name, website, LinkedIn page, industry, size) and the places its jobs are in, nothing about you |
| Langfuse (EU region) | Checking the quality of our AI features: we read what Claude was sent and what it answered to find and fix wrong fit scores, CVs and drafts (while we use it; it can be switched off, and then receives nothing) | A copy of each request to Anthropic and its answer, as listed for Anthropic above (an uploaded CV file only as its type and size, not its contents), with the time, the model and the tokens used. You appear under a number (user-123), not your name or email |
| Crustdata | While we use it (it can be switched off, and then receives nothing): company facts, people at a company, and job listings while we use its job search | Search terms (job titles, country, company names and domains); your own LinkedIn profile address, only if you ask us to build your CV from it; a contact's name, company and LinkedIn address when you press Fill information on them |
| QuizAPI (only if set up) | Ready-made tech questions for practice quizzes | Only topic names from the job ad, such as "docker"; nothing about you |
| Hunter | Finding a contact's work email, a company's known HR and recruiting contacts, and checking a guessed address | The contact's name and company domain, the company domain, or the guessed address |
| Signing in | Your sign-in with your Google account. Google's quick sign-in, which offers the Google account you are signed in to in your browser, loads on the sign-in page, and on the homepage only after you say yes to it: Google then learns that your browser visited the page, under Google's own privacy policy, even if you do not sign in | |
| Google (favicon service) | Showing company logos in your job list and on company pages, when there is no better logo | Only the company's web address, asked by our server: nothing about you, and your browser does not contact Google. The icons are kept on our server |
| Signing in, and Import from LinkedIn for your CV (each only if you choose it) | Your sign-in with your LinkedIn account; for the import, your consent on LinkedIn's page (LinkedIn then shares your own profile with us) | |
| Microsoft | Signing in (only if you choose it); Outlook drafts, sending and history (only if you connect it) | Your sign-in with your Microsoft account; the drafts and CVs you choose to put in Outlook |
| Paddle | Selling Pro as the merchant of record: payment, VAT, invoices, refunds (only if you buy) | Your account email and a reference to your account; what you enter in Paddle's checkout (card, billing address) goes to Paddle directly, not through us |
| Sentry (Functional Software, EU region) | Finding errors and slow pages in gojob.now: when something breaks on our server or in your browser, or a page is slow, we see where in our code it happened | The error and where it happened in our code, the page's address without its query, the browser's name and version, how long the request and each database query took (without the values in them), and your account number when you are signed in; our own log lines of what the app did (with email and IP addresses removed) and counts such as sign-ups by sign-in method or AI requests by feature; how fast a page loaded and answered your clicks in your browser (page speed numbers, which kind of page and which part of it, phone or computer, the connection type), sent through our server. Not your name, email, IP address, cookies or anything you typed |
| Mailtrap | Sending our sign-up and password emails, the job alert emails you turned on (with their Still to do list), your career strategy session request and your help requests to us | Your email address and the email's text (with its one-time link, the titles, companies and scores of your good-fit jobs, your name, note and phone number on a guided search request, or your name and message on a help request) |
| Telegram | Messaging you your good-fit job alerts (only if you connect the bot) | Your chat with the bot and the message text (titles, companies, pay, scores and links of your good-fit jobs, and the titles and companies of Interested jobs still to do). Telegram handles it under its own privacy policy |
| Cloudflare | Delivering the website over HTTPS and protecting it from attacks; checking that a person, not a bot, sends the email forms of the sign-in page (sign up, log in and forgot password: Turnstile, no cookies, while we have it switched on); counting page views (Web Analytics, no cookies); storing our nightly backups (R2) | Every request to gojob.now as it passes through, including your IP address; on the sign-in page's email forms, Turnstile's check runs in your browser and reads signals about the browser and device (not what you type in the form), and our server sends Cloudflare the check's result and your IP address to confirm it; the backups hold everything stored in gojob.now, encrypted before they leave our server with a key Cloudflare does not have |
| Google (Tag Manager, Analytics, Ads) | Loading the analytics and ad tags; site analytics; measuring Google ads (only if you allow analytics or marketing cookies) | The pages you open, browser and device, IP address (Analytics does not store it), cookie identifiers, and the steps listed under Cookies |
| Contentsquare (France) | Heatmaps and page recordings (only if you allow analytics cookies) | The pages you open, browser and device, IP address, its cookie identifiers, and how the page is used (clicks, scrolling, mouse movement), with text masked in onboarding and the app and never what you type into a form |
| Mixpanel, Inc. (EU data residency) | Counting which features of the app are used (only if you allow analytics cookies) | The names of the steps you take in the app and short codes about them (a job status, which CV, the plan or pack bought, a number), the area of the site, free or paid plan, a pseudonymous number made from your account number with a secret key (never your email), its cookie identifier, browser and device, and an approximate location from your IP address (the address itself is not stored). Not the page addresses, and never your name, email, CV, jobs, companies, contacts, pay or notes |
| Microsoft (Advertising) | Measuring Microsoft ads (only if you allow marketing cookies) | As for Google |
| Meta, LinkedIn, Reddit, TikTok | Measuring their ads (only if you allow marketing cookies) | The pages you open, browser and device, IP address, their cookie identifiers, and the steps listed under Cookies |
| Scaleway SAS (France) | Renting us the dedicated server in Paris, France (EU) that runs the website, the database and the stored files; we run the server ourselves | Everything stored in gojob.now, on that server's disks |
What gojob.now stores (the database, CV files and our server logs) is kept on our server in France, in the EU. The nightly backups of it are stored with Cloudflare (R2), encrypted on our server first with a key Cloudflare does not have. The other providers above receive only what the table lists for them. Some of them, Cloudflare included, are based in the United States, and that data can leave the European Economic Area. For those we rely on the safeguards the provider offers, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
Job boards (justjoin.it, Rocketjobs, No Fluff Jobs, Czy Jest Eldorado?, Remotive, We Work Remotely, Himalayas, Arbeitnow, Jobicy, Workable, Remote OK, Working Nomads, Jobylon, the job feeds of the UN Secretariat (careers.un.org), EU Careers (eu-careers.europa.eu) and Poland's civil service (nabory.kprm.gov.pl), Hacker News (through its Algolia search API), public Telegram job channels (the posts on their public web page t.me/s/..., read without an account; people named in a post are not saved as contacts), DevITjobs, GermanTechJobs, SwissDevJobs, Berlin Startup Jobs, Free-Work, Platsbanken (Arbetsförmedlingen's JobTech API), SOLID.Jobs (its public offers API), Manfred, Germany's Federal Employment Agency (Bundesagentur für Arbeit, its Jobsuche API), Adzuna, Jooble, Indeed, Djinni, DOU, Robota.ua, Jobico, Lobby X, Happy Monday) and the public careers pages of companies we find (Greenhouse, Lever, Ashby, Workable, Recruitee, SmartRecruiters, Workday, Traffit, Teamtailor, Personio, Oracle Cloud, iCIMS, SuccessFactors, Eightfold, BambooHR, Rippling, Pinpoint, Breezy, Paylocity, ADP, Jobvite, Avature, Taleo, Cornerstone, JazzHR, JOIN, Homerun, softgarden, Zoho Recruit, Dover, Gem, Deel, UKG Pro, Comeet, PageUp, BeeSite, Eploy) are only read: we never send them your data. To learn a company's basic facts (its website, LinkedIn page, size, what it does) we read its job ads and, once, its homepage. To find a careers page we also read the company's own website, try the company's name on those platforms and, if that finds nothing (and while we use Crustdata), search the company's job listings on Crustdata by its name and domain.
Discover companies, on the Companies page, counts the job ads we already hold for your role titles and country. It sends nothing to any provider and keeps nothing.
How long we keep it
- Account data, until you delete your account (Account page, "Your data"). Deleting removes it from the live database straight away.
- Contacts and drafts, until you delete them or your account, or until the person asks us to remove them.
- The results of a people search on a job (past holders of the role, people who could refer you, your likely team) and a company's career map data, about six months after the search; you can run it again after that. People you saved as your own contacts stay, as above.
- Notifications, 90 days (or until you dismiss them or delete your account).
- Error reports from your browser, 90 days (or until you delete your account).
- Sign-up and password reset links, and wrong password attempts, one day.
- How many "Have that?" previews you asked for today (there is a daily limit), until the next day.
- That you added a company's website, 7 days (the website itself stays).
- Job ads are public postings and we keep them: ads nobody has done anything with (no status, note, contact, CV or other action) leave every job list 10 days after they were posted (an ad from a company's careers page once that page no longer lists it; an ad you added yourself never) and stay in an archive, which the market charts on Insights count. The text of an archived ad, which can name the employer's recruiter, is removed a year later (an ad from a careers page that matched nobody's search, when it is archived); its title, company, place, pay and dates stay. What you did with an ad (status, notes, CVs and the rest) stays while your account does.
- Results of background work (such as a CV being made) and the details of job scans, 90 days.
- Copies of AI requests and answers at Langfuse, 30 days.
- Error reports, performance traces, log lines and counts at Sentry, 90 days.
- Our own logs of calls to paid services (for an email lookup, the contact's name and the address found) and of the emails the app sends (with the recipient's address), 12 months.
- Our log of requests that reached the app signed out when they should not have (with the IP address, to find sign-in faults), and our error logs (server errors and the copy of browser error reports), about 90 days.
- Company logos (from the job boards, the company's own homepage, the company facts from Crustdata or Google's favicon service) are fetched once and kept on our server (no personal data); a company with no logo is not asked about again for a week.
- The small copy of a contact's photo, as long as the contact (it goes with the contact or your account).
- Backups: the database and CV files are copied every night, encrypted, and each copy is deleted after 30 days. Data you delete leaves the live database at once and the backups within 30 days; if we ever restore one, we delete again any account removed since it was made.
- Our web server's request logs (IP address, time, page asked for, browser) are kept on our server up to a fixed size: each part of the server keeps its newest 100 MB of log lines and older lines are deleted as new ones come in. Cloudflare keeps its own logs of the requests that pass through it under its own policy.
- Your cookie choice, 12 months in your browser. Analytics data in Google Analytics, 14 months, and in Contentsquare, 13 months; the ad platforms keep theirs under their own policies. Mixpanel's feature counts, while we use Mixpanel; after you delete your account they stay there only under the number, with nothing left in gojob.now that names you, and if you write to us we delete them at Mixpanel too.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to how it is used, and take it with you in a machine-readable form. Most of this you can do yourself on the Account page: Download my data gives you everything in one file, and Delete my account removes it. For anything else, write to [email protected].
You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, uodo.gov.pl), or to the authority where you live.
Automated scoring
Fit scores are written by an AI model from your profile and the job ad. They are suggestions for you only: nothing is decided or sent automatically, and no employer sees them.
Changes
If this policy changes in a way that matters, we will say so on this page and, for signed-in users, in the app.