Privacy Policy

1. Who we are

Job BFF is operated by Robyn Maya ("we", "us", "the app"). We act as the data controller for the personal data you provide when you use the service. This policy explains what data we handle and why.

2. Data we collect

• Account data: your email address, display name, and (if you sign in with Google) the basic profile information Google returns.
• CV data: the resume text you paste and any CV file you upload.
• Application data: job links, scraped job descriptions, statuses, interview stages, contacts, and your notes.
• Generated content: AI prep insights, gap analyses, resume drafts, and chat messages you exchange with the assistant.

3. How we use your data

We use your data only to operate features you ask for: storing and displaying your applications, generating insights and resume drafts, and pre-filling email drafts you choose to send from your own email account. We do not sell your data, and we do not use it for advertising.

The legal bases we rely on are: contract performance (to provide the service), legitimate interests (security, fraud prevention, and product improvement), and consent where required (for example, optional marketing communications).

4. Who we share data with

• Our cloud hosting and database provider, who processes data solely to host and run the service.
• Our AI provider, who receives only the text needed to generate the insight, gap analysis, or resume draft you request.
• Stripe, our payment processor, for card processing, subscription management, tax calculation, invoicing, and refunds. We never see or store your full card details — Stripe handles them directly.
• Professional advisers or authorities, only where required by law or to protect our rights.

5. Google user data

If you choose to sign in with Google, we request only your basic profile information (name, email address, profile picture) to create and identify your account. We never read or send email from your Google account. Email drafts are opened in your own Gmail or mail app, where you review and send them yourself. You can revoke access at any time from your Google Account permissions page. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Google Calendar (optional)

If you explicitly click "Connect Google Calendar", we request access to your own primary Google Calendar only, for two purposes: (1) reading your upcoming events (the next 60 days) so Job BFF can show your busy times and warn you about conflicts when you pick or offer interview times — event titles are visible only to you; and (2) creating and updating interview events that you book through Job BFF, so they appear in your calendar and stay in sync if they are moved or cancelled. We do not access any other calendars, past events beyond the sync window, or any other Google service, and we do not use calendar data for advertising or analytics. Your Google connection token is stored encrypted, and you can disconnect at any time from the app, which deletes the stored token and stops all calendar access.

7. Messages and email delivery

When you message someone inside Job BFF (for example, a hiring team member messaging a candidate), Job BFF delivers the message by email from our own sending address (noreply@jobbff.co) — never from your personal email account. Conversational emails carry a hidden reply address, so if the recipient replies directly from their own email app, the reply is routed back into the same conversation in Job BFF. We read those incoming replies only to place them in the correct conversation with the correct participants; editing the subject or body cannot redirect a reply into a different conversation. We do not connect to or read your personal email account.

8. AI processing

Job descriptions, CV text, and your prompts are sent to our AI provider to produce insights, gap analyses, and resume drafts. Only the text needed for the request is sent. Hidden or suspicious instructions found inside job postings are treated as data and are never executed.

9. Storage, security, retention

Data is stored in our managed cloud database with row-level access rules so that each account can only read its own records. Uploaded CV files live in a private storage bucket. Connected-account credentials are encrypted at rest. We keep your data until you delete it or ask us to delete your account.

10. Your choices

You can edit or delete applications, CV text, and generated documents at any time, or request deletion of your entire account and its data by contacting us.

11. Contact

Questions about this policy or a deletion request? Reach the app owner through the contact address published on the app's landing page or your account email thread with us.