Privacy Policy
Jobpedia helps you find jobs you fit and tailor your resume to them. That means we handle your career history, which is personal data. This page explains what we do with it, in plain words.
Last updated 4 October 2026 · version 2026-09-29
1. Who is responsible
The data controller is GYPAETUSCODE SRL (CUI RO40407772, Reg. Com. J2019000097013), Sat Șard nr. 332 W, comuna Ighiu, județul Alba, 517363, Romania, operating Jobpedia.AI. We are established in Romania, so the EU General Data Protection Regulation (GDPR) applies to everything we do with your data, wherever you live.
Privacy questions and requests: [email protected].
2. What this covers
- The website at jobpedia.ai (this site).
- The web app at app.jobpedia.ai and its API at api.jobpedia.ai.
- The free fit check at app.jobpedia.ai/fit, which works without an account and has its own, shorter retention rules (section 5).
- The Jobpedia browser extension, where you have installed it.
3. What we process and why
We only process what the product needs. Nothing here is sold, and we do not build advertising profiles of you.
| Activity | Data | Why | Legal basis |
|---|---|---|---|
| Account | Email address, name, password (stored hashed), or the identity we receive if you sign in with Google or LinkedIn | Create and secure your account, send account emails | Contract |
| Career profile | Resume files and text, work history, skills, education, achievements, addresses, contacts, job applications, tasks, notes and preferences you add | The core service: matching you to jobs and tailoring resumes | Contract |
| Jobs | Job postings you paste, save or apply to | Score compatibility and tailor resumes per posting | Contract |
| AI processing | Resume and job text sent to a language model to extract requirements, match evidence and draft tailored wording | Produce the analysis you asked for | Contract |
| Payments | Subscription plan, credits, billing status. Card details go directly to Stripe; we never see or store card numbers | Paid plans | Contract, legal obligation (accounting) |
| Emails | Your email address and the message we send | Account verification, password reset, welcome, saved fit verdict links | Contract |
| Product analytics | Pages viewed, actions taken (for example “started a fit check”), approximate location from your IP, browser type, campaign parameters from the link you arrived on | Understand how the product is used and whether it works | Consent for cookies; legitimate interest for cookieless, aggregate counting (see the Cookie Policy) |
| Advertising measurement | Whether a visit that came from a Google ad led to a fit check or an email save | Know whether our ads are worth the money | Consent |
| Errors and performance | Technical error reports: browser, page, stack trace. Text on the page is masked before it leaves your browser | Find and fix bugs | Legitimate interest |
| Security | IP address (hashed for rate limits), request logs | Prevent abuse, keep the service up | Legitimate interest |
Where we rely on legitimate interest, we have checked that the processing is limited, expected in a product like this and does not override your rights. You can object at any time (section 8).
4. How AI is used
Jobpedia sends the text of your resume and of the job posting to Google’s Gemini models to extract requirements, match your evidence to them and draft tailored wording. The requests go through OpenRouter, which routes them to Google Cloud Vertex AI: in the EU for resume writing and matching, and on Google’s global network for the fit check. We only allow endpoints that keep no copy of the text (zero data retention), and neither OpenRouter nor Google uses it to train models. Skill similarity is computed with OpenAI’s embedding API, which turns short pieces of text into numbers; under OpenAI’s API terms that data is not used to train their models.
AI output is a starting point, not a decision about you. Fit verdicts and tailored resumes are shown to you with the evidence they rest on, and you decide what to do with them. No automated decision with legal or similarly significant effect is made about you.
5. The free fit check
The fit check at app.jobpedia.ai/fit needs no account. We designed it to keep as little as possible:
| Data | Kept for |
|---|---|
| Your resume (file or pasted text) | Only inside the request that produces the verdict. It is not stored. |
| The job posting you paste | Until your resume arrives, at most 30 minutes; deleted when the verdict is produced. The extracted requirements (with quotes from the posting, nothing from you) are cached for 24 hours so the same posting is not re-read. |
| The verdict | 1 hour if you do not save it. 14 days if you save it by email, reachable only through the private link we send you. You can delete it earlier from that link. |
| Your email address (only if you save the verdict) | 14 days, with the saved verdict. If you tick the separate opt-in to hear from us, we keep that opt-in apart from the verdict until you withdraw it. |
| Your answers to the two follow-up questions | With the verdict record, same lifetime. Never sent to analytics. |
| Inputs of failed or reported runs | 72 hours, encrypted, accessible only to the founder, so we can find out why a check failed. Legal basis: legitimate interest in a working product. Nothing reads this store automatically. |
Fit checks are capped per IP address and per email address to bound abuse; those keys are hashed before storage.
6. Who processes data for us
We use a small number of providers, each under a data processing agreement. Transfers outside the EU rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online | Hosting of the app, API and databases | EU (Germany, Finland) |
| Cloudflare | DNS, this website, first-party analytics proxy at t.jobpedia.ai | Global network, EU headquarters in Lisbon |
| Amazon Web Services | File storage for uploaded documents | EU (Frankfurt, eu-central-1) |
| OpenRouter | Routes language-model requests to Google; keeps no prompts or answers | United States |
| Google Cloud (Vertex AI) | Gemini language models for extraction, matching and tailoring, with zero data retention | EU; global network for the fit check |
| OpenAI | Embeddings for skill similarity | United States |
| Stripe | Payments | United States, EU entities |
| Resend | Transactional email | United States |
| PostHog | Product analytics | EU (Frankfurt) |
| Google (Analytics, Ads) | Advertising measurement, only with your consent | United States |
| Sentry | Error reporting | EU (Germany) |
We do not share your data with anyone else, except when the law requires it or to protect the service from abuse.
7. How long we keep account data
- Account and career data: for as long as your account exists. Ask us to delete your account and it is removed within 30 days, except billing records we must keep for accounting law (10 years in Romania).
- Product analytics: 7 years on PostHog’s plan retention; 2 months in Google Analytics.
- Error reports: 90 days.
- Fit check data: see section 5.
- Emails we send you: log entries for 30 days.
8. Your rights
You can, at any time:
- ask for a copy of the data we hold about you (access, portability);
- correct it;
- have it deleted;
- restrict or object to processing based on legitimate interest;
- withdraw consent, without affecting what happened before;
- complain to a supervisory authority. Ours is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP). You may also complain to the authority where you live.
Write to [email protected]. We answer within one month. We may ask you to confirm it is you before acting on a request.
9. Cookies and similar storage
Which cookies we set, when, and how to change your choice is in the Cookie Policy. Before you make a choice, nothing is stored on your device for analytics.
10. Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who operate the service. Passwords are stored hashed. If a breach affects your data, we will tell you and the supervisory authority as the law requires.
11. Children
Jobpedia is for people looking for work and is not directed at children under 16. We do not knowingly process their data. If you think a child has given us data, contact us and we will delete it.
12. Changes to this policy
When we change what we do with your data, we update this page, change the version and date at the top, and ask for your consent again where the change needs it. Older versions are available on request.