Privacy Policy

Last updated: July 27, 2026

1. Who We Are

Jobiko ("Jobiko," the "Service") is an AI-powered job-application assistant operated by WTech ("WTech," "we," "us," or "our"), a sole proprietorship (entreprise individuelle) of Abdoul Raouf Wendyam Issoufou Sawadogo, registered in Québec, Canada.

• Operator: WTech, a sole proprietorship (entreprise individuelle) of Abdoul Raouf Wendyam Issoufou Sawadogo
• Quebec enterprise number (NEQ): 2282211947
• Business address: 2255 Rue de l'Université, Québec (Québec) G1V 0A7, Canada
• Contact: legal@jobiko.org
• Home jurisdiction: Province of Quebec, Canada

This Privacy Policy explains what personal information we collect through Jobiko (including our website, web application, and browser extension), why we collect it, how we use and share it, how long we keep it, and the rights you have depending on where you live.

By creating an account or using Jobiko, you acknowledge the practices described in this Policy. If you do not agree, please do not use the Service.

2. Scope

This Policy covers:

• The Jobiko web application and website;
• The Jobiko browser extension (job capture and application form autofill); and
• Related communications (transactional and, where you consent, marketing email).

Geographic scope of this version. This Policy is written for users in Canada, the United States, and Latin America (including Brazil and Mexico). We do not currently target or market the Service to individuals in the European Union or the United Kingdom, and this Policy does not make EU/UK General Data Protection Regulation (GDPR/UK GDPR) compliance claims. EU/UK coverage is future work and will require additional regulatory measures (lawful-basis mapping, data-transfer mechanisms such as Standard Contractual Clauses, a Data Processing Agreement, and breach-notification procedures) before we offer the Service there. See Section 14.

3. Personal Information We Collect

We collect only the information needed to operate the Service. Categories:

3.1 Account and identity information

• Name (first, optional middle, and last name)
• Date of birth (collected at sign-up solely to verify you meet our minimum age requirement of 18; see Section 13)
• Email address
• Phone number
• Mailing / applicant address
• Account credentials (password is stored only as a salted hash; we never store it in plaintext)
• Authentication identifiers if you sign in with a third-party provider (Google, Apple, or LinkedIn OAuth)

3.2 Professional profile information

• Education history
• Work history / roles
• Skills and competencies
• Languages
• Professional summary
• Availability and work preferences
• Preferred locations
• Salary range (this field is encrypted at rest)

3.3 Application and activity data

• Tracked and captured job applications, including status, priority, notes, follow-ups, deadlines, and next actions
• Match scores and recommendation interactions (dismiss/archive/convert)
• AI run records (metadata about content-generation requests)
• Generated and tailored documents (resumes, cover letters)
• Auto-apply snapshots (records of what was submitted on a best-effort basis)
• Resume-scan results (extracted skills, ATS keyword matches, 0–100 score, suggestions)
• Interview-practice results (scores, feedback, and per-answer notes generated from written or spoken mock-interview sessions). For live voice sessions we do not store your audio recording; the spoken exchange is transcribed in real time, the transcript is shown to you during the session and used to produce the debrief, and only the resulting AI run record (the scores and feedback) is retained — see Section 5.

3.4 Job data captured by the browser extension

When you use the Jobiko browser extension, it captures job postings and job descriptions from supported job boards and applicant tracking systems (ATS) — currently 40+ sites — so we can match jobs to your profile, track applications, and pre-fill application forms. The extension:

• Reads job-posting content on pages you visit on supported sites (operating under allowlisted host permissions — no wildcard access to all websites);
• Stores limited session and status data via the browser's extension storage; and
• Auto-fills application form fields with your profile data on a best-effort basis (success is not guaranteed and varies by ATS).

3.5 Payment information

We use Stripe to process payments. We do not receive or store your full card number; card data is collected and tokenized by Stripe. The only billing records we retain are limited, non-card details — plan, subscription status, invoice and payment events, and promo-code usage — needed for accounting, tax, and support. We keep these records for the period set out in Section 9 (7 years, or as required by applicable accounting and tax law). See Section 6.

3.6 Technical, cookie, and diagnostic data

• Session cookies (HttpOnly) used to keep you signed in
• Local storage values for your theme/appearance, interface language, and cookie-consent flag
• Error and diagnostic reports (via Sentry) to detect and fix bugs
• Basic campaign / referral attribution data

We do not use third-party advertising trackers. See Section 7 and our Cookie Policy.

3.7 Connected mailbox (Job Inbox) — optional

If you choose to connect a Gmail or Outlook mailbox to the Job Inbox, we request read-only access (gmail.readonly for Google, Mail.Read for Microsoft). We never request permission to send, modify, or delete mail.

We scan incoming messages to identify job-application correspondence, and we store metadata only:

• the subject line;
• the sender's name, email address, and domain;
• the date received;
• a short preview snippet supplied by your mail provider (maximum 512 characters);
• the classification we derive (for example, interview invitation or rejection) and the application it was matched to.

We never store the body of your messages. Your access and refresh tokens are encrypted at rest. You can disconnect a mailbox at any time in Settings, which deletes the stored connection and the message metadata associated with it.

This feature is entirely optional and off unless you connect a mailbox yourself; the rest of the Service works without it. See Section 8 for the providers involved.

4. How and Why We Use Your Information

We use your personal information to:

1. Provide the core Service — build and maintain your profile, track applications, generate and tailor resumes and cover letters, score resumes, recommend jobs, and (on eligible plans) attempt auto-apply.
2. Operate the browser extension — capture job postings you choose to save and auto-fill application forms with your profile data.
3. Generate AI content (with disclosure below). We send your profile personal information and the relevant job description to third-party AI model providers to generate tailored content. See Section 5 for the exact fields we send and a full, honest description of this processing.
4. Process payments and manage subscriptions through Stripe.
5. Communicate with you. We distinguish two categories of email:
   • Transactional / service messages (account, security, billing, application and auto-apply status). These are necessary to operate the Service and are sent regardless of marketing preferences; you cannot opt out of them while you hold an account.
   • Marketing messages (product news, tips, promotions). We send these only if you have given separate, explicit opt-in consent — for example, by checking a clearly labelled marketing-consent box that is not pre-ticked and is separate from account creation. Every marketing message includes a one-click unsubscribe link, and you can withdraw consent at any time without affecting transactional messages. See Section 12.1 (CASL).
6. Operate auto-apply (Pro). Where you direct it, we use your profile data to attempt submission of applications on third-party ATS sites on a best-effort basis, and we retain auto-apply snapshots recording what was submitted (see Section 5 and the disclosure below).
7. Secure, maintain, and improve the Service — diagnostics, fraud and abuse prevention, debugging, and quality.
8. Comply with legal obligations and enforce our Terms of Service.

Auto-apply and third-party employers / ATS. When you use auto-apply or the extension's form-fill, your profile data (such as name, contact details, work history, and uploaded documents) is entered into application forms hosted by employers and the applicant tracking systems (ATS) they use. By submitting an application through the Service, you are sending that data to the relevant employer/ATS, who then handles it under their own privacy practices, which we do not control. We retain a snapshot of each submission attempt for your records and support; success is not guaranteed and varies by ATS.

5. AI Provider Processing of Your Personal Information (Important)

To generate tailored resumes, cover letters, motivation answers, interview-prep content, resume scans, and similar outputs, Jobiko sends content to third-party AI model providers — currently Anthropic and OpenAI, accessed directly and/or via AWS Bedrock and OpenRouter (see Section 8).

We want to be clear and honest about this. To produce content tailored to you and a specific role, we send the AI provider the relevant job description together with the following fields from your profile:

• Name;
• Contact details (email, phone, mailing / applicant address);
• Education history;
• Work history / roles;
• Skills and competencies;
• Languages;
• Professional summary; and
• Availability, work preferences, and preferred locations, where relevant to the requested output.

In other words, your profile personal information is included in the prompt sent to the AI provider. We do not send a reduced or "minimum" subset; the fields above travel with the request so the output reflects your actual background.

• Salary range. Your salary range is encrypted at rest in our systems. It is not included in the content sent to AI providers and is not used as AI context.
• Account credentials (passwords) and payment card data are never sent to AI providers.
• We rely on our agreements with these providers to limit their use of your data to providing the service to us, and we select providers that offer commitments against using customer inputs to train their general models. Provider terms can change; you should review the current providers listed in Section 8.
• If you do not want your information processed by AI providers, do not use the AI-generation features. Some features cannot function without this processing.

Live voice interviews. If you run a live voice mock interview, your microphone audio is streamed in real time — through our voice gateway — to Amazon Bedrock (Amazon Nova Sonic) for speech-to-speech processing, and (in the turn-based voice mode) to OpenAI via OpenRouter for speech-to-text. The audio is used only to run the session as it happens: it is processed in transit and is not stored by us as an audio recording. The transcript is shown to you during the session and is sent to the AI provider to generate your interview debrief; we retain the resulting AI run record (scores and feedback), not the raw audio. Written mock interviews send only your typed answers.

6. Payments

Payments for purchases made directly from us (on the web) are handled by Stripe, a third-party payment processor.

• We do not store your full payment card details. Card data is collected and tokenized by Stripe.
• All payments are final. You can cancel your subscription at any time; cancellation stops future renewals and does not generally entitle you to a refund of amounts already paid, except where required by law. Refund and dispute terms are described in Section 8.3 of our Terms of Service, which is our complete refund policy.
• We retain only limited, non-card billing records — plan, subscription events, invoices, and payment status — as needed for accounting, tax, and support. We keep these for the period stated in Section 9 (7 years, or as otherwise required by applicable accounting and tax law).

Stripe processes your payment information under its own privacy policy: https://stripe.com/privacy.

Purchases through mobile app stores. If you subscribe through the Jobiko iOS or Android app, your purchase is processed by Apple (the App Store) or Google (Google Play) under their own terms and privacy policies. We never receive your card data from Apple or Google. To keep your paid features in sync, we use RevenueCat and receive only limited purchase and entitlement metadata — such as the product identifier, store transaction identifiers, and subscription state (active, expired, or in a billing-issue/grace period) — with no card data. See the RevenueCat entry in Section 8, and Section 8.7 of our Terms of Service for how store-billed subscriptions, cancellations, and refunds are handled.

7. Cookies and Similar Technologies

Jobiko uses a small set of cookies and local-storage values:

• Session cookie (HttpOnly) — keeps you signed in.
• Theme/appearance and interface-language preferences.
• Cookie-consent flag — remembers your consent choice.

We do not use third-party advertising or cross-site ad trackers. For a full description of each cookie, its purpose, retention, and how to manage your choices, see our Cookie Policy.

8. Data Sharing and Sub-processors

We do not sell your personal information. We share it only with service providers ("sub-processors") that help us operate the Service, and only as needed for the purposes in this Policy. Our current sub-processors are:

Data Processing Agreement (DPA). Each sub-processor handles personal information on our behalf under contractual data-protection terms — a signed data processing agreement or the provider's standard data-protection terms incorporated in its service agreement — that restrict its use of the data to providing services to us, require appropriate security measures, and prohibit using your data for its own purposes (including, for the AI providers, training their general models on your inputs). Provider terms can change, so review the current list above.

We may also disclose personal information:

• To comply with law, legal process, or enforceable governmental requests;
• To protect the rights, safety, and property of WTech, our users, or the public; and
• In connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy or notify you of any material change.

Employers and ATS. When you submit applications through auto-apply or the extension's form-fill, your data is transmitted to the relevant employer and the ATS they operate. These employers/ATS are independent recipients, not our sub-processors, and they handle your data under their own privacy practices. See Section 4.

The table above is our current, complete list of sub-processors. We update this Policy (and its "Last updated" date) when the list materially changes.

Content loaded directly by your browser. Job and application screens display company logos fetched from Google's public favicon service (www.google.com/s2/favicons). Your browser makes that request directly, so Google receives your IP address and basic browser information. We send Google no account data, no cookies, and no job or application details, and the request happens whether or not you have connected a mailbox. Google is not acting as our sub-processor for this, which is why it appears here rather than in the table above.

9. Data Retention

We keep personal information only as long as needed for the purposes described in this Policy, then delete or anonymize it.

Account deletion. When you delete your account, we remove your personal data within 30 days, except for limited records we are legally required to retain (e.g., certain billing/tax records) or that are anonymized.

10. Security

We use technical and organizational measures designed to protect your information, including:

• Encryption in transit (HTTPS/TLS);
• Encryption at rest for sensitive fields (including your salary range);
• Salted password hashing (we never store plaintext passwords);
• Access controls and least-privilege practices for internal access;
• Allowlisted host permissions for the browser extension (no wildcard site access).

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or data is at risk, contact us at security@jobiko.org.

Note: Resetting your password automatically signs out every existing session on all your devices. When you change your password while signed in, other devices are signed out by default. If you are concerned about unauthorized access, reset your password and contact us.

10.1 Breach Notification

If we become aware of a confidentiality incident (a security breach involving your personal information) that creates a risk of serious harm, we will:

• Take reasonable steps to contain and assess the incident;
• Notify affected individuals and the relevant regulator without undue delay once the incident is confirmed, targeting notification within 72 hours of confirming a notifiable breach (and sooner where a shorter period is required by applicable law);
• In Quebec, record the incident in a register and notify the Commission d'accès à l'information du Québec (CAI) and affected individuals as required under Law 25;
• In Canada (PIPEDA), report breaches of security safeguards posing a real risk of significant harm to the Office of the Privacy Commissioner of Canada and affected individuals, and keep records of all breaches; and
• In the United States, notify affected residents (and any state authorities or credit-reporting agencies) within the timelines set by the applicable state breach-notification laws.

Notifications will describe, to the extent known, the nature of the incident, the information involved, the measures taken, and steps you can take to protect yourself.

11. International Storage and Transfers

We store and process personal information in cloud infrastructure located in North America and the European Union. Because Jobiko serves users in Canada, the United States, and Latin America, your information may be communicated, stored, and processed outside the Province of Quebec and outside your country of residence — including in the United States and the European Union — by us and by the sub-processors listed in Section 8. Before communicating personal information outside Quebec, we assess (as Quebec Law 25 requires) whether the information would receive adequate protection in the destination jurisdiction, taking into account the sensitivity of the information and the contractual protections in place. These jurisdictions may have data-protection laws that differ from those in your home country. We take steps to ensure your information remains protected consistent with this Policy, including contractual data-protection terms with our sub-processors (Section 8). If we later extend the Service to the EU/UK, we will add the formal transfer mechanisms described in Section 14 (such as Standard Contractual Clauses).

12. Your Privacy Rights by Region

The rights available to you depend on where you live. To exercise any right, contact support@jobiko.org or our Privacy Officer (Section 16). We will verify your identity before acting and respond within the time required by applicable law.

12.1 Canada (PIPEDA and Quebec Law 25)

If you are in Canada, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Withdraw consent to certain processing (which may limit or end your ability to use parts of the Service);
• Receive an explanation of how your information is used and to whom it is disclosed;
• Be informed when automated processing is used to make a decision about you and, under Quebec Law 25, to request information about that processing; and
• Request portability of certain computerized personal information (where Law 25 requires).

We have designated a Privacy Officer responsible for our compliance with applicable Canadian privacy law and for handling access and correction requests (see Section 16). If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec (CAI).

Marketing email (CASL). We send commercial electronic messages only after you give express opt-in consent through a separate, clearly labelled, non-pre-ticked consent control — distinct from account sign-up. Every marketing message includes our identity, contact information, and a working unsubscribe mechanism that takes effect promptly (within 10 business days, as CASL requires). You can withdraw marketing consent at any time. Transactional and account messages (which are not commercial electronic messages requiring consent) may still be sent as needed to operate the Service.

12.2 United States (California CCPA / CPRA and other state privacy laws)

If you are a U.S. resident, your rights depend on your state. California's Consumer Privacy Act (as amended by the CPRA) applies to California residents, and a growing family of comparable state privacy laws — including those of Virginia, Colorado, Connecticut, Texas, Oregon, and other states that have enacted consumer-privacy statutes — provides similar rights to residents of those states. Depending on your state, you may have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we hold about you, subject to legal exceptions;
• Correct inaccurate personal information;
• Obtain a portable copy of certain personal information you provided to us, in a usable format, where your state law grants this right;
• Opt out of the "sale" or "sharing" of personal information, and of targeted or cross-context behavioral advertising; and
• Not be discriminated against for exercising your rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We therefore do not offer a "Do Not Sell or Share" sale opt-out, because no such sale or sharing occurs. You may still exercise your other rights above.

How to submit a request; authorized agents. To submit a request, contact support@jobiko.org. We will verify your identity before acting and respond within the period your state law requires. You may use an authorized agent to submit a request where the law permits; we may require the agent to provide proof of your written authorization and may still ask you to verify your own identity or confirm that you authorized the request.

Appeals. If we decline your request, we will tell you why. Where your state law provides a right to appeal a refusal (as, for example, Virginia, Colorado, Connecticut, Texas, and Oregon law do), you may appeal by emailing support@jobiko.org with the subject line "Privacy Request Appeal." We will review your appeal and respond, with a written explanation of our decision, within the period your state's law requires. If we deny your appeal, we will, where the law requires, tell you how to contact your state attorney general or other regulator to submit a complaint.

Global Privacy Control (GPC). Some browsers and extensions can send an opt-out preference signal, such as the Global Privacy Control (GPC), on your behalf. Because we do not sell personal information and do not share it for cross-context behavioral or targeted advertising, a GPC signal does not change how we process your personal information — there is no sale or sharing for it to stop. Nevertheless, where a GPC or similar signal is legally recognized as a valid opt-out request in your state, we treat it as a valid opt-out to the extent the law gives it that effect.

12.3 Latin America (Brazil LGPD, Mexico LFPDPPP, and similar laws)

If you are in Brazil (Lei Geral de Proteção de Dados, LGPD) or Mexico (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), or another Latin American country with comparable law, you may have the right to:

• Access your personal data and confirm whether we process it;
• Rectify / correct incomplete, inaccurate, or outdated data;
• Cancel / delete your data (subject to legal retention requirements);
• Oppose / object to certain processing;
• Withdraw consent where processing is based on consent; and
• Obtain information about the entities with which we share your data.

In Brazil, you may also contact the Autoridade Nacional de Proteção de Dados (ANPD). In Mexico, you may contact the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI). To exercise these rights (in LFPDPPP terms, your ARCO rights — Access, Rectification, Cancellation, Opposition), contact support@jobiko.org.

12.4 Sensitive Information

Several U.S. state privacy laws define a category of "sensitive" personal information (for example, Social Security or other government identification numbers; precise geolocation; racial or ethnic origin; religious beliefs; health, genetic, or biometric data; and information about sexual orientation).

We do not request or collect these sensitive categories, beyond what your profile inherently contains for the purpose of preparing job applications. Specifically:

• We collect your date of birth at sign-up solely to verify that you meet our minimum age requirement of 18 (see Section 13); we do not use it to infer any sensitive characteristic.
• Your salary range is treated as confidential: it is encrypted at rest and is excluded from the content we send to AI providers (see Sections 3.2 and 5).
• We do not collect Social Security or other government identification numbers, health, genetic, or biometric data, or information about your race, ethnicity, religion, or sexual orientation. Our browser extension is designed to avoid autofilling such sensitive fields.
• We do not collect precise geolocation (device- or GPS-level location). We do process your IP address for security, fraud-prevention, and legal-acceptance record-keeping (see Sections 3.6 and 10); an IP address gives only a coarse, approximate location and is not "precise geolocation" as those laws define it.

If a job application you prepare or submit through the Service happens to contain sensitive information (for example, because an employer's form asks for it), that information is provided at your direction and is handled by the relevant employer/ATS under their own practices (see Section 4).

12.5 De-identified Data

Where we derive de-identified or aggregated data — information that cannot reasonably be used to identify you (for example, aggregate usage statistics, or diagnostic logs aggregated into non-identifying form) — we maintain and use that data only in de-identified form. We take reasonable measures to ensure it cannot be associated with you, publicly commit to maintaining and using it without attempting to re-identify it, and do not attempt to re-identify it, except where re-identification is strictly necessary to test that our de-identification is effective and is otherwise permitted by law.

12.6 Automated Decision-Making

Jobiko's AI features generate content and scores — such as tailored resumes and cover letters, resume scans, keyword matches, 0–100 resume scores, and job-match recommendations — at your request and for your use. These are tools that inform your own decisions; they are described in Section 5 and in our Terms of Service (AI Output Disclaimer).

We do not use automated processing to make decisions that produce legal or similarly significant effects about you without human involvement. In particular, auto-apply acts only on your explicit instruction: it prepares and, where you direct it, submits an application for a specific job you have selected. It does not autonomously decide, on its own initiative, which jobs to apply to on your behalf. Where required by applicable law (including Quebec Law 25), you may ask us for information about automated processing that we use and, where the law provides, request human review (see Section 12.1).

13. Children's Privacy and Age

Jobiko is intended for adults seeking employment and is not directed to minors. You must be at least 18 years of age to create an account or use the Service. We collect your date of birth at sign-up to verify that you meet this minimum age requirement, and we reject account creation when the date of birth indicates you are under 18. We do not knowingly collect personal information from anyone under 18 years of age. If you believe someone under 18 has provided us personal information, contact support@jobiko.org and we will delete it.

14. EU / UK (Future Scope)

The European Union and United Kingdom are out of scope for this version of the Service. We do not currently make GDPR or UK GDPR compliance commitments. This is future work that will require additional regulation before we offer the Service there.

Before offering Jobiko to individuals in those regions, we will implement additional measures, including:

• Lawful-basis mapping for each processing activity;
• A Data Processing Agreement with each sub-processor that meets GDPR Article 28 requirements;
• Data-transfer safeguards. Where personal data of EU/UK individuals would be transferred outside the EEA/UK (for example, to our North American hosting or AI providers), we will put in place the European Commission's Standard Contractual Clauses (SCCs) — and, for UK transfers, the UK International Data Transfer Addendum (IDTA) — backed by a transfer impact assessment and any supplementary technical measures (such as encryption in transit and at rest) needed to ensure an adequate level of protection; and
• Breach-notification procedures aligned with the 72-hour GDPR/UK GDPR requirement (consistent with Section 10.1).

We will update this Policy accordingly before any EU/UK launch.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in-app or by email. Your continued use of the Service after an update means you acknowledge the revised Policy.

16. Contact Us and Privacy Officer

For privacy questions or to exercise your rights:

• Privacy / data requests: support@jobiko.org
• Security issues / responsible disclosure: security@jobiko.org

Person in charge of the protection of personal information (Privacy Officer). As required under Quebec Law 25, we have designated a Privacy Officer responsible for our compliance with applicable privacy law and for handling access, correction, and complaint requests:

• Name / title: Abdoul Raouf Wendyam Issoufou Sawadogo, Privacy Officer (responsable de la protection des renseignements personnels)
• Operator: WTech, a sole proprietorship (entreprise individuelle) of Abdoul Raouf Wendyam Issoufou Sawadogo
• Quebec enterprise number (NEQ): 2282211947
• Email: legal@jobiko.org
• Mailing address: 2255 Rue de l'Université, Québec (Québec) G1V 0A7, Canada

We will respond to verified requests within the timeframe required by applicable law in your region.

17. Languages and Translations

This Policy is published in English, French, and Spanish. A Brazilian Portuguese (PT-BR) version is planned and required before a full Brazil launch and is currently in progress; until it is published, Brazilian users should rely on the English or Spanish version. If there is any conflict between translations, the English version governs, except where local law requires the local-language version to prevail (for example, for Quebec residents, the French version prevails where Quebec law so requires).