How we handle your data.

Data we collect

• Account data: name, email address, hashed password, plan, and consent timestamps.
• Billing data: handled by our payment processor (Stripe); we never store full card numbers.
• Configuration: search profiles, AI instructions, notification preferences, and encrypted third-party API tokens (e.g. your Upwork OAuth tokens), stored encrypted at rest.
• Marketplace data: job postings and related information fetched from Upwork on your instruction. This may include client information sourced from Upwork.
• Telegram (optional): if you connect Telegram for job alerts, the chat ID of your private chat with our bot (@JobHunterWorksBot). The alerts we send there contain the job title, budget, match score and a link to the job in Job Hunter. If you send us a message with the bot's /feedback command, we store its text and your Telegram name. You can disconnect at any time in Account Settings or by sending /stop to the bot.
• Usage and diagnostic data: logs needed to operate, secure, and debug the service.

How we use your data

We process your data to provide the service (job scoring, cover-letter drafting, notifications), to bill you, to secure the platform, and to comply with legal obligations. AI scoring and generation are performed via our AI sub-processors. We do not sell your personal data.

Legal bases

We rely on performance of a contract (providing the service you signed up for), legitimate interests (security, fraud prevention, service improvement), consent (marketing emails, which you may withdraw at any time), and legal obligation (tax and accounting records).

Retention

Account and configuration data are kept while your account is active. Marketplace data sourced from Upwork is automatically deleted within 24 hours in line with Upwork's API Terms of Service; it is either re-fetched on demand or purged. Operational logs are retained for a limited period and then deleted. When you delete your account we erase your full data graph (see section 7).

Sub-processors

We share data with the third-party processors listed on our Sub-processors page, each bound by appropriate data-protection terms and, where applicable, EU Standard Contractual Clauses for transfers outside the EEA.

International transfers

Some sub-processors are located outside the EEA. Where that is the case, transfers are safeguarded by Standard Contractual Clauses or an equivalent adequacy mechanism.

Telegram alerts are delivered through Telegram (Telegram Messenger Inc., outside the EEA) only when you connect Telegram yourself; that transfer is necessary to deliver the alerts you asked for (Art. 49(1)(b) GDPR). Our community group on Telegram is optional and governed by Telegram's privacy policy; we do not post Upwork job data there.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to certain processing. You can exercise the right to data portability (a full machine-readable export, free of charge) and the right to erasure directly from your account's Privacy settings. You may also lodge a complaint with your local supervisory authority.

Website analytics

On our public pages we may use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure which pages visitors find useful. It is loaded only after you click Accept in the consent banner (Art. 6(1)(a) GDPR, § 25(1) TTDSG). Before that, and after Decline, no Google script runs and no analytics cookie is set.

With your consent Google processes your shortened IP address, device and browser details, and the pages you visit, and sets cookies named _ga for up to 24 months. Google may transfer data to the USA; transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses. Your choice is stored in the jh_analytics_consent cookie for one year. You can withdraw consent at any time via Cookie settings in the footer. Logged-in areas of the app do not use Google Analytics.

Security

We encrypt secrets at rest, restrict access on a need-to-know basis, and monitor for errors and abuse. To report a vulnerability, see our security policy.

Contact

For privacy questions or to exercise your rights, contact our Data Protection Officer at hennadii.shvedko@shvedko.dev.