Privacy Policy

1. Who We Are #

Jobiko (“Jobiko,” the “Service”) is an AI-powered job-application assistant operated by Groupe Omnua inc. (“Groupe Omnua inc.,” “we,” “us,” or “our”), a corporation (société par actions) constituted under the Quebec Business Corporations Act (RLRQ, c. S-31.1), registered in Quebec, Canada.

• Operator: Groupe Omnua inc., a corporation (société par actions) constituted under the Quebec Business Corporations Act (RLRQ, c. S-31.1)
• Quebec enterprise number (NEQ): 1182426842
• Contact: support@jobiko.org (a postal address is available on request)
• Home jurisdiction: Province of Quebec, Canada

This Privacy Policy explains what personal information we collect through Jobiko (including our website, web application, mobile apps for iOS and Android, and browser extension), why we collect it, how we use and share it, how long we keep it, and the rights you have depending on where you live.

By creating an account or using Jobiko, you acknowledge the practices described in this Policy. If you do not agree, please do not use the Service.

2. Scope #

This Policy covers:

• The Jobiko web application and website;
• The Jobiko mobile apps for iOS and Android;
• The Jobiko browser extension (job capture and application form autofill); and
• Related communications (transactional and, where you consent, marketing email).

Geographic scope of this version. This Policy is written for users in Canada, the United States, and Latin America (including Brazil and Mexico). We do not currently target or market the Service to individuals in the European Union or the United Kingdom, and this Policy does not make EU/UK General Data Protection Regulation (GDPR/UK GDPR) compliance claims. We do not yet offer the Service in the EU or the UK; before we do, we will put in place the additional regulatory measures that requires (lawful-basis mapping, data-transfer mechanisms such as Standard Contractual Clauses, a Data Processing Agreement, and breach-notification procedures). See Section 14.

3. Personal Information We Collect #

We collect only the information needed to operate the Service. Categories:

3.1 Account and identity information #

• Name (first, optional middle, and last name)
• Age confirmation (on the web, a checkbox at sign-up confirming you are 18 or older; in the mobile app, the date of birth you enter at sign-up is checked against that minimum and is not stored: we keep only the result; see Section 13)
• Email address
• Phone number
• Mailing / applicant address
• Account credentials (password is stored only as a salted hash; we never store it in plaintext)
• Authentication identifiers if you sign in with a third-party provider (Google, Apple, or LinkedIn OAuth)

3.2 Professional profile information #

• Education history
• Work history / roles
• Skills and competencies
• Languages
• Professional summary
• Availability and work preferences
• Preferred locations
• Salary range (this field is encrypted at rest)
• Optional application details that some employers’ forms ask for, if you add them: date of birth, work authorization, and background-check answers (encrypted at rest, and used only to fill those forms)

3.3 Application and activity data #

• Tracked and captured job applications, including status, priority, notes, follow-ups, deadlines, and next actions
• Match scores and recommendation interactions (dismiss/archive/convert)
• AI run records (metadata about content-generation requests)
• Generated and tailored documents (resumes, cover letters)
• Auto-apply snapshots (records of what was submitted on a best-effort basis)
• Resume-scan results (extracted skills, ATS keyword matches, 0–100 score, suggestions)
• Interview-practice sessions. When a live mock interview ends, we keep the session: the role, date and length, your scores and feedback (including per-answer notes), and a transcript of what was said, which is stored encrypted. We never store the audio. You can delete a session at any time in Interview Prep; otherwise it is kept until you delete your account, and it is included in your data export. Written mock interviews keep their scores and feedback the same way — see Section 5.

3.4 Job data captured by the browser extension #

When you use the Jobiko browser extension, it captures job postings and job descriptions from supported job boards and applicant tracking systems (ATS) — the current list is published at jobiko.org/supported-sites — so we can match jobs to your profile, track applications, and pre-fill application forms. The extension:

• Reads job-posting content on pages you visit on supported sites (operating under allowlisted host permissions — no wildcard access to all websites);
• Stores limited session and status data via the browser’s extension storage; and
• Auto-fills application form fields with your profile data on a best-effort basis (success is not guaranteed and varies by ATS).

Chrome Web Store Limited Use. The use of information received from the Jobiko browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use the data the extension handles only to provide its features: saving the jobs you choose, matching and tracking them, and filling application forms. We do not sell it, use or transfer it for advertising, or use it to determine creditworthiness or for lending, and no person reads it unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it.

3.5 Payment information #

Web purchases are handled by our payment provider, which acts as merchant of record (see Section 6). We do not receive or store your full card number; card data is collected and tokenized by the payment provider. The only billing records we retain are limited, non-card details — plan, subscription status, invoice and payment events, and promo-code usage — needed for accounting, tax, and support. The tax-grade copies are retained by our merchant of record for up to 7 years as required for tax and accounting; our in-house copy is deleted with your account (see Section 9).

3.6 Technical, cookie, and diagnostic data #

• A session cookie that keeps you signed in and cannot be read by scripts on the page
• Local storage values for your theme/appearance, interface language, and cookie-consent flag
• Error, crash and performance reports (error monitoring) to detect and fix bugs, including an anonymous session signal each time the app loads (see Section 5 of our Cookie Policy)
• Product analytics (usage statistics, heatmaps and masked session replays), on jobiko.org and in the app, only if you accept analytics in our cookie banner; once you sign in, they are linked to your internal Jobiko user id, and our servers record a few product events (such as a document tailored or a subscription started) under that id while your answer is Accept (see Section 8 and our Cookie Policy)
• Basic campaign / referral attribution data, when you arrive through a link carrying campaign or promo-code parameters

We do not use third-party advertising trackers. See Section 7 and our Cookie Policy.

3.7 Connected mailbox (Job Inbox) — optional #

If you choose to connect a Gmail or Outlook mailbox to the Job Inbox, we request read-only access (gmail.readonly for Google, Mail.Read for Microsoft). We never request permission to send, modify, or delete mail.

We scan incoming messages to identify job-application correspondence, and we store metadata only:

• the subject line;
• the sender’s name, email address, and domain;
• the date received;
• a short preview snippet supplied by your mail provider (maximum 512 characters);
• the classification we derive (for example, interview invitation or rejection) and the application it was matched to.

We never store the body of your messages. Your access and refresh tokens are encrypted at rest. You can disconnect a mailbox at any time in Settings, which deletes the stored connection and the message metadata associated with it.

How messages are sorted. To recognize job-application replies and match them to your applications, the subject line and preview snippet of incoming messages are sent to our AI service providers, which return a short label (for example, interview invitation or rejection). They do not receive the sender or the body of the message, and they process this text only to return the label (Section 8). Message metadata is kept until you disconnect the mailbox or delete your account. Before you connect a mailbox, the app shows you this and asks you to confirm.

Google API Services User Data Policy (Limited Use). Jobiko’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Gmail data only to provide the Job Inbox features you see in the app. We do not sell it, use or transfer it for advertising, use it to determine creditworthiness or for lending, or use it to develop, improve or train generalized AI or machine-learning models, and no person reads it unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it. What our AI service providers receive is used only to sort your messages for you.

This feature is entirely optional and off unless you connect a mailbox yourself; the rest of the Service works without it. See Section 8 for the providers involved.

3.8 People named in job postings #

Job postings sometimes name a person: a recruiter or hiring manager, sometimes with a job title or business contact details. We do not seek out this information; it comes with the posting.

• Source: the job postings employers publish on their careers sites and applicant tracking systems, public employment services and job boards, and postings you save with the browser extension.
• Purpose: showing the posting so that job seekers can read it, apply and track their applications. We do not use these names for marketing, profiling or any other purpose.
• Minimization: for several public employment-service feeds we remove e-mail addresses and phone numbers from the posting text, or do not read the contact fields at all.
• Retention: a posting stays in our job catalogue while it is published at its source; once it is no longer published there, it is hidden and deleted from the catalogue about 30 days later (sooner where a source’s terms require it). A copy a user saved to their own tracker stays in that user’s account until they delete it.
• Your rights: if you are named in a posting shown on Jobiko, you can ask us to access, correct or remove that information, or object to its use, by writing to support@jobiko.org (see Section 12). You can also ask the employer that published the posting to change it at the source.

4. How and Why We Use Your Information #

We use your personal information to:

1. Provide the core Service — build and maintain your profile, track applications, generate and tailor resumes and cover letters, score resumes, recommend jobs, and (on eligible plans) attempt auto-apply.
2. Operate the browser extension — capture job postings you choose to save and auto-fill application forms with your profile data.
3. Generate AI content (with disclosure below). We send your profile personal information and the relevant job description to third-party AI model providers to generate tailored content. See Section 5 for the exact fields we send and a full description of this processing.
4. Process payments and manage subscriptions through our payment provider.
5. Communicate with you. We distinguish two categories of email:
   • Transactional / service messages (account, security, billing, application and auto-apply status). These are necessary to operate the Service and are sent regardless of marketing preferences; you cannot opt out of them while you hold an account.
   • Marketing messages (product news, tips, promotions). We send these only if you have given separate, explicit opt-in consent — for example, by checking a clearly labelled marketing-consent box that is not pre-ticked and is separate from account creation. Every marketing message includes a one-click unsubscribe link, and you can withdraw consent at any time without affecting transactional messages. See Section 12.1 (CASL).
6. Operate auto-apply (Basic and Pro plans). Where you direct it, we use your profile data to attempt submission of applications on third-party ATS sites on a best-effort basis, and we retain auto-apply snapshots recording what was submitted (see Section 5 and the disclosure below).
7. Secure, maintain, and improve the Service — diagnostics, fraud and abuse prevention, debugging, and quality.
8. Comply with legal obligations and enforce our Terms of Service.

Auto-apply and third-party employers / ATS. When you use auto-apply or the extension’s form-fill, your profile data (such as name, contact details, work history, and uploaded documents) is entered into application forms hosted by employers and the applicant tracking systems (ATS) they use. By submitting an application through the Service, you are sending that data to the relevant employer/ATS, who then handles it under their own privacy practices, which we do not control. We retain a snapshot of each submission attempt for your records and support; success is not guaranteed and varies by ATS.

5. AI Provider Processing of Your Personal Information (Important) #

To generate tailored resumes, cover letters, motivation answers, interview-prep content, resume scans, and similar outputs, Jobiko sends content to third-party AI service providers: companies that run AI models, and the cloud and routing services through which we reach those models (see Section 8).

To produce content tailored to you and a specific role, we send the AI provider the relevant job description together with the following fields from your profile:

• Name;
• Contact details (email, phone, mailing / applicant address);
• Education history;
• Work history / roles;
• Skills and competencies;
• Languages;
• Professional summary; and
• Availability, work preferences, and preferred locations, where relevant to the requested output.

In other words, your profile personal information is included in the prompt sent to the AI provider. We do not send a reduced or “minimum” subset; the fields above travel with the request so the output reflects your actual background.

• Salary range. Your salary range is encrypted at rest in our systems. It is not included in the content sent to AI providers and is not used as AI context.
• Account credentials (passwords) and payment card data are never sent to AI providers.
• We rely on our agreements with these providers to limit their use of your data to providing the service to us, and we select providers that offer commitments against using customer inputs to train their general models.
• Where a request passes through a routing service that can send it to several model hosts, we configure that service to exclude hosts that train on submitted data and to use only an approved list of hosts, rather than letting it choose freely.
• We describe these as controls we apply, not as guarantees of what a third party does. A provider may keep data for limited periods for its own abuse detection, security, billing or legal compliance, under its own terms. We tell you what we configure and what we require by contract; we cannot audit their systems.
• If you do not want your information processed by AI providers, do not use the AI-generation features. Some features cannot function without this processing.
• In the mobile app, we ask first. Before the first feature that sends your personal data to AI service providers (document tailoring, resume import, interview practice), the iOS and Android app asks for your explicit permission, and records your answer. You can withdraw it at any time in Profile → Privacy; the app then asks again before the next such feature.

Live voice interviews. If you run a live voice mock interview, your microphone audio is streamed in real time — through our voice gateway — to an AI service provider for speech-to-speech processing. If you turn on live captions in another language, each transcript sentence is translated by an AI model. In the turn-based voice mode, your recorded answer is sent to an AI service provider for speech-to-text, and the interviewer’s questions are spoken by a text-to-speech model, which receives the question text, never your audio. The audio is used only to run the session as it happens: it is processed in transit and is not stored by us as an audio recording. The transcript is shown to you during the session and is sent to the AI provider to generate your interview debrief; when the session ends we keep it, with its scores, feedback and an encrypted copy of the transcript, until you delete it or your account (see Section 3.3); the raw audio is never kept. Written mock interviews send only your typed answers.

6. Payments #

All transactions for purchases made directly from us (on the web) are handled by our payment provider, Creem, which acts as merchant of record: it is the seller of the subscription to you (Terms of Service, Section 8.2).

• We do not store your full payment card details. Card data is collected and tokenized by the payment provider.
• Cancellation and refunds. You can cancel your subscription at any time; cancellation stops future renewals, and your paid features stay active until the end of the period you already paid for. Refunds and chargebacks for web purchases are handled by Creem under its Buyer Terms, as described in Section 8.3 of our Terms of Service, which is our complete refund policy.
• We retain only limited, non-card billing records — plan, subscription events, invoices, and payment status — as needed for accounting, tax, and support. The tax-grade copies are retained by our merchant of record for up to 7 years as required by applicable accounting and tax law; our in-house copy is deleted with your account (see Section 9).

As merchant of record, Creem processes your payment information under its own privacy policy: https://www.creem.io/privacy.

Purchases through mobile app stores. If you subscribe through the Jobiko iOS or Android app, your purchase is processed by Apple (the App Store) or Google (Google Play) under their own terms and privacy policies. We never receive your card data from Apple or Google. To keep your paid features in sync, we use a subscription-management service and receive only limited purchase and entitlement metadata — such as the product identifier, store transaction identifiers, and subscription state (active, expired, or in a billing-issue/grace period) — with no card data. See Section 8, and Section 8.7 of our Terms of Service for how store-billed subscriptions, cancellations, and refunds are handled.

Our in-app subscription provider processes that purchase and entitlement metadata on our behalf, to verify purchases with Apple and Google and keep your plan in sync; it does not receive your profile, documents or card data.

7. Cookies and Similar Technologies #

Jobiko uses a small set of cookies and local-storage values:

• Session cookie — keeps you signed in; not readable by scripts on the page.
• Theme/appearance and interface-language preferences.
• Cookie-consent flag — remembers your consent choice.
• Analytics cookies (product analytics) — on jobiko.org and in the app, set only if you accept optional analytics; declining removes them and stops analytics. A browser “Do Not Track” or “Global Privacy Control” signal counts as a decline.

We do not use third-party advertising or cross-site ad trackers. For a full description of each cookie, its purpose, retention, and how to manage your choices, see our Cookie Policy.

8. Data Sharing and Service Providers #

We do not sell your personal information. We share it only with service providers (“sub-processors”) that help us operate the Service, and only as needed for the purposes in this Policy. We describe them by the kind of service they provide, why we use it, and the data it receives:

Where they process data. Our application and main database are hosted in Canada. Our service providers may process data in Canada, the United States and other countries where they operate, under contractual safeguards (see Section 11).

List of providers. A list of our current service providers is available on request: write to support@jobiko.org (see Section 16). We update this Policy when we start using a new kind of service provider or use your information in a new way. Replacing a provider with another of the same kind, for the same purposes and the same data, does not change what this Policy describes.

Data processing terms. We require data processing terms from the service providers that handle personal information on our behalf — a data processing agreement, or the provider’s data-protection terms that form part of its service agreement — restricting their use of the data to providing services to us, requiring appropriate security measures, and prohibiting the use of your data for their own purposes (including, for the AI service providers, training their general models on your inputs).

Our payment provider is an exception, and deliberately so. Because it acts as the merchant of record for web purchases (Terms of Service, Section 8.2), it is the seller of the subscription to you — not a provider acting only on our instructions. It therefore acts as an independent controller of the payment data it collects, and uses that data for its own legal purposes, including issuing your invoice, calculating and remitting tax, retaining transaction records, and preventing fraud. Its handling of that data is governed by its own privacy policy (Section 6), not by this Policy or by a data processing agreement with us.

We may also disclose personal information:

• To comply with law, legal process, or enforceable governmental requests;
• To protect the rights, safety, and property of Groupe Omnua inc., our users, or the public; and
• In connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy or notify you of any material change.

Employers and ATS. When you submit applications through auto-apply or the extension’s form-fill, your data is transmitted to the relevant employer and the ATS they operate. These employers/ATS are independent recipients, not our sub-processors, and they handle your data under their own privacy practices. See Section 4.

Company logos. Job and application screens, on the web and in the mobile app, display company logos. Some are fetched by our own servers from a public favicon service, through a proxy open only to signed-in users: that service receives the employer’s web address and nothing about you — not your IP address, cookies or account. Others, from a public logo service or the logo address supplied with a job listing, are loaded directly by your browser or app, so that service receives your IP address, basic device information and the address of the logo requested, which names the employer. We send these services no account data, no cookies, and no job or application details. They are not acting as our sub-processors for this, which is why they are described here rather than in the table above.

Address suggestions (Google Maps). When you type your address into the address field of your profile, the field offers suggestions from Google Maps. Only then does your browser load Google’s service and send it the characters you type, your IP address and basic browser information. Your use of these suggestions is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy. The field is optional: you can type your address without choosing a suggestion.

9. Data Retention #

We keep personal information only as long as needed for the purposes described in this Policy, then delete or anonymize it.

Account deletion. When you delete your account, we remove your personal data from our systems within 30 days, except for limited records we are legally required to retain (e.g., certain billing/tax records) or that are anonymized. We also request deletion from the service providers that hold data about you in their own systems, such as product analytics and our in-app subscription provider; they delete it under their own procedures and timelines, and copies may persist for a limited time in their backups.

10. Security #

We use technical and organizational measures designed to protect your information, including:

• Encryption in transit (HTTPS/TLS);
• Encryption at rest for sensitive fields (including your salary range);
• Salted password hashing (we never store plaintext passwords);
• Access controls and least-privilege practices for internal access;
• Allowlisted host permissions for the browser extension (no wildcard site access).

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or data is at risk, contact us at support@jobiko.org (subject: “Security”).

Note: Resetting your password automatically signs out every existing session on all your devices. When you change your password while signed in, other devices are signed out by default. If you are concerned about unauthorized access, reset your password and contact us.

10.1 Breach Notification #

If we become aware of a confidentiality incident (a security breach involving your personal information) that creates a risk of serious harm, we will:

• Take reasonable steps to contain and assess the incident;
• Notify affected individuals and the relevant regulator without undue delay once the incident is confirmed, targeting notification within 72 hours of confirming a notifiable breach (and sooner where a shorter period is required by applicable law);
• In Quebec, record the incident in a register and notify the Commission d’accès à l’information du Québec (CAI) and affected individuals as required under Law 25;
• In Canada (PIPEDA), report breaches of security safeguards posing a real risk of significant harm to the Office of the Privacy Commissioner of Canada and affected individuals, and keep records of all breaches; and
• In the United States, notify affected residents (and any state authorities or credit-reporting agencies) within the timelines set by the applicable state breach-notification laws.

Notifications will describe, to the extent known, the nature of the incident, the information involved, the measures taken, and steps you can take to protect yourself.

11. International Storage and Transfers #

Our application and main database are hosted in Canada. Some of our service providers (Section 8) process data in the United States and in other countries where they operate. Because Jobiko serves users in Canada, the United States, and Latin America, your information may be communicated, stored, and processed outside the Province of Quebec and outside your country of residence by us and by those service providers. Before communicating personal information outside Quebec, we assess (as Quebec Law 25 requires) whether the information would receive adequate protection in the destination jurisdiction, taking into account the sensitivity of the information and the contractual protections in place. These jurisdictions may have data-protection laws that differ from those in your home country. We take steps to ensure your information remains protected consistent with this Policy, including contractual data-protection terms with our service providers (Section 8). If we later extend the Service to the EU/UK, we will add the formal transfer mechanisms described in Section 14 (such as Standard Contractual Clauses).

12. Your Privacy Rights by Region #

The rights available to you depend on where you live. To exercise any right, contact support@jobiko.org or our Privacy Officer (Section 16). We will verify your identity before acting and respond within the time required by applicable law.

Export or delete your data yourself. Signed in on the web, open Settings → Account & billing (app.jobiko.org): Export data downloads your profile, documents and application tracker, and Delete account removes your account (see Section 9 for timing). In the mobile app, go to Profile → Danger zone → Delete account. If you cannot sign in, follow the steps on our support page or write to support@jobiko.org.

12.1 Canada (PIPEDA and Quebec Law 25) #

If you are in Canada, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Withdraw consent to certain processing (which may limit or end your ability to use parts of the Service);
• Receive an explanation of how your information is used and to whom it is disclosed;
• Be informed when automated processing is used to make a decision about you and, under Quebec Law 25, to request information about that processing; and
• Request portability of certain computerized personal information (where Law 25 requires).

We have designated a Privacy Officer responsible for our compliance with applicable Canadian privacy law and for handling access and correction requests (see Section 16). If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information du Québec (CAI).

Marketing email (CASL). We send commercial electronic messages only after you give express opt-in consent through a separate, clearly labelled, non-pre-ticked consent control — distinct from account sign-up. Every marketing message includes our identity, contact information, and a working unsubscribe mechanism that takes effect promptly (within 10 business days, as CASL requires). You can withdraw marketing consent at any time. Transactional and account messages (which are not commercial electronic messages requiring consent) may still be sent as needed to operate the Service.

12.2 United States (California CCPA / CPRA and other state privacy laws) #

If you are a U.S. resident, your rights depend on your state. California’s Consumer Privacy Act (as amended by the CPRA) applies to California residents, and a growing family of comparable state privacy laws — including those of Virginia, Colorado, Connecticut, Texas, Oregon, and other states that have enacted consumer-privacy statutes — provides similar rights to residents of those states. Depending on your state, you may have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we hold about you, subject to legal exceptions;
• Correct inaccurate personal information;
• Obtain a portable copy of certain personal information you provided to us, in a usable format, where your state law grants this right;
• Opt out of the “sale” or “sharing” of personal information, and of targeted or cross-context behavioral advertising; and
• Not be discriminated against for exercising your rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We therefore do not offer a “Do Not Sell or Share” link, because no such sale or sharing occurs. You may still exercise your other rights above.

How to submit a request; authorized agents. To submit a request, contact support@jobiko.org. We will verify your identity before acting and respond within the period your state law requires. You may use an authorized agent to submit a request where the law permits; we may require the agent to provide proof of your written authorization and may still ask you to verify your own identity or confirm that you authorized the request.

Appeals. If we decline your request, we will tell you why. Where your state law provides a right to appeal a refusal (as, for example, Virginia, Colorado, Connecticut, Texas, and Oregon law do), you may appeal by emailing support@jobiko.org with the subject line “Privacy Request Appeal.” We will review your appeal and respond, with a written explanation of our decision, within the period your state’s law requires. If we deny your appeal, we will, where the law requires, tell you how to contact your state attorney general or other regulator to submit a complaint.

Global Privacy Control (GPC). Some browsers and extensions can send an opt-out preference signal, such as the Global Privacy Control (GPC), on your behalf. Because we do not sell personal information and do not share it for cross-context behavioral or targeted advertising, a GPC signal does not change how we process your personal information — there is no sale or sharing for it to stop. Nevertheless, where a GPC or similar signal is legally recognized as a valid opt-out request in your state, we treat it as a valid opt-out to the extent the law gives it that effect.

12.3 Latin America (Brazil LGPD, Mexico LFPDPPP, and similar laws) #

If you are in Brazil (Lei Geral de Proteção de Dados, LGPD) or Mexico (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), or another Latin American country with comparable law, you may have the right to:

• Access your personal data and confirm whether we process it;
• Rectify / correct incomplete, inaccurate, or outdated data;
• Cancel / delete your data (subject to legal retention requirements);
• Oppose / object to certain processing;
• Withdraw consent where processing is based on consent; and
• Obtain information about the entities with which we share your data.

In Brazil, you may also contact the Autoridade Nacional de Proteção de Dados (ANPD). In Mexico, you may contact the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI). To exercise these rights (in LFPDPPP terms, your ARCO rights — Access, Rectification, Cancellation, Opposition), contact support@jobiko.org.

12.4 Sensitive Information #

Several U.S. state privacy laws define a category of “sensitive” personal information (for example, Social Security or other government identification numbers; precise geolocation; racial or ethnic origin; religious beliefs; health, genetic, or biometric data; and information about sexual orientation).

We do not request or collect these sensitive categories, beyond what your profile inherently contains for the purpose of preparing job applications. Specifically:

• We do not ask for your date of birth on the web: you confirm you are 18 or older with a checkbox. The mobile app checks the date of birth you enter at sign-up against that minimum and keeps only the result (see Section 13). If you add a date of birth to your profile because an employer’s form asks for it, it is encrypted at rest and used only to fill such forms; we do not use it to infer any sensitive characteristic.
• Your salary range is treated as confidential: it is encrypted at rest and is excluded from the content we send to AI providers (see Sections 3.2 and 5).
• We do not collect Social Security or other government identification numbers, health, genetic, or biometric data, or information about your race, ethnicity, religion, or sexual orientation. Our browser extension is designed to avoid autofilling such sensitive fields.
• We do not collect precise geolocation (device- or GPS-level location). We do process your IP address for security, fraud-prevention, and legal-acceptance record-keeping (see Sections 3.6 and 10); an IP address gives only a coarse, approximate location and is not “precise geolocation” as those laws define it.

If a job application you prepare or submit through the Service happens to contain sensitive information (for example, because an employer’s form asks for it), that information is provided at your direction and is handled by the relevant employer/ATS under their own practices (see Section 4).

12.5 De-identified Data #

Where we derive de-identified or aggregated data — information that cannot reasonably be used to identify you (for example, aggregate usage statistics, or diagnostic logs aggregated into non-identifying form) — we maintain and use that data only in de-identified form. We take reasonable measures to ensure it cannot be associated with you, publicly commit to maintaining and using it without attempting to re-identify it, and do not attempt to re-identify it, except where re-identification is strictly necessary to test that our de-identification is effective and is otherwise permitted by law.

12.6 Automated Decision-Making #

Jobiko’s AI features generate content and scores — such as tailored resumes and cover letters, resume scans, keyword matches, 0–100 resume scores, and job-match recommendations — at your request and for your use. These are tools that inform your own decisions; they are described in Section 5 and in our Terms of Service (AI Output Disclaimer).

We do not use automated processing to make decisions that produce legal or similarly significant effects about you without human involvement. In particular, auto-apply acts only on your explicit instruction: it prepares and, where you direct it, submits an application for a specific job you have selected. It does not autonomously decide, on its own initiative, which jobs to apply to on your behalf. Where required by applicable law (including Quebec Law 25), you may ask us for information about automated processing that we use and, where the law provides, request that a person review it, by contacting our Privacy Officer (see Section 16).

13. Children’s Privacy and Age #

Jobiko is intended for adults seeking employment and is not directed to minors. You must be at least 18 years of age to create an account or use the Service. At sign-up you confirm that you meet this minimum age (a checkbox on the web; in the mobile app, a date-of-birth check whose result is all we keep), and we refuse account creation without that confirmation or when the date of birth entered indicates you are under 18. We do not knowingly collect personal information from anyone under 18 years of age. If you believe someone under 18 has provided us personal information, contact support@jobiko.org and we will delete it.

14. Where the Service Is Offered #

Jobiko is offered to individuals in Canada, the United States, and Latin America. It is not offered in the European Union or the United Kingdom, and this Policy does not describe rights or safeguards specific to those regions. If we extend the Service there, this Policy will be updated first.

15. Changes to This Policy #

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in-app or by email. Your continued use of the Service after an update means you acknowledge the revised Policy.

16. Contact Us and Privacy Officer #

For privacy questions or to exercise your rights:

• Email: support@jobiko.org (subject: “Privacy” for a data request, “Security” to report a security issue)

Person in charge of the protection of personal information (Privacy Officer). As required under Quebec Law 25, we have designated a Privacy Officer responsible for our compliance with applicable privacy law and for handling access, correction, and complaint requests:

• Name / title: Abdoul Raouf Wendyam Issoufou Sawadogo, Privacy Officer (responsable de la protection des renseignements personnels)
• Operator: Groupe Omnua inc., a corporation (société par actions) constituted under the Quebec Business Corporations Act (RLRQ, c. S-31.1)
• Quebec enterprise number (NEQ): 1182426842
• Email: support@jobiko.org (subject: “Privacy”; a postal address is available on request)

We will respond to verified requests within the timeframe required by applicable law in your region.

17. Languages and Translations #

This Policy is published in English, French, and Spanish. Brazilian users may rely on the English or Spanish version. If there is any conflict between translations, the English version governs, except where local law requires the local-language version to prevail (for example, for Quebec residents, the French version prevails where Quebec law so requires).