Privacy Policy

1. Introduction

JobWeave ("we," "us," or "our") operates the jobweave.ai website and the JobWeave application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided via OAuth)
• Profile picture (if provided via OAuth)
• Authentication provider identifiers (Google, LinkedIn)

2.2 Gmail Data

If you connect your Gmail account, we request read-only access (gmail.readonly scope) to scan your inbox for job-related emails. To identify, classify, and display those messages we collect and store:

• Email metadata (sender, subject, date) from job-related messages
• The message body of job-related emails (stored in truncated form) so we can classify them, extract structured details, and show them to you in your inbox
• Extracted information such as company names, job titles, recruiter contacts, and application statuses

We scan for job-related mail only and do not retain the content of messages we classify as unrelated to your job search. We do not delete your emails. The only inbox change we make is to sync a message’s read/unread state when you mark it read or unread inside JobWeave.

Sending (optional). Sending is off by default. Only if you explicitly grant the additional send permission (gmail.send scope) can JobWeave send recruiter replies on your behalf — and only messages you compose or approve. You can decline this permission and still use every read-only feature, and you can revoke it at any time.

2.3 Job Search Data

Information you provide or that is generated through your use of the Service:

• Resumes and resume versions
• Job descriptions and postings
• Application tracking data (status, notes, dates)
• Contact information for recruiters and hiring managers

2.4 Usage Data

We automatically collect standard usage information including browser type, device information, IP address, pages visited, and interaction patterns to improve the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Scan your email for job-related messages and extract structured data
• Generate AI-tailored resumes based on your profile and target job descriptions
• Track and organize your job applications
• Send you service-related communications (account verification, security alerts, feature updates)
• Analyze usage patterns to improve the product experience
• Detect and prevent fraud or abuse

We do not sell your personal data to third parties. We do not use your Gmail data for advertising purposes.

4. Third-Party Services

We use the following third-party services to operate JobWeave:

4.1 Supabase

We use Supabase for authentication and database hosting. Your account data and application data are stored in Supabase-managed PostgreSQL databases. Supabase is SOC 2 Type II compliant. Supabase Privacy Policy.

4.2 Google (Gmail API & OAuth)

We use Google OAuth for sign-in and the Gmail API for email scanning and optional sending. JobWeave’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing job-tracking features described in this policy.
• We do not transfer Google user data to third parties except as necessary to provide those features, for security, or to comply with applicable law.
• We do not use Google user data for advertising.
• We do not allow humans to read your Gmail data except with your explicit consent for specific messages, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized.

4.3 LinkedIn (OAuth / OIDC)

We use LinkedIn OIDC for sign-in authentication. We receive your name, email address, and profile picture from LinkedIn during the sign-in process. LinkedIn Privacy Policy.

4.4 Vercel

Our application is hosted on Vercel. Vercel may process request metadata (IP addresses, headers) as part of serving the application. Vercel Privacy Policy.

4.5 AI Providers

We use third-party AI models (Anthropic Claude, OpenAI) to power resume tailoring and data extraction features. Resume content and job descriptions may be sent to these providers for processing. These providers process data according to their respective API data usage policies and do not use API inputs for model training.

4.6 Stripe (Payments)

Paid subscriptions are processed by Stripe, Inc. When you subscribe, your payment details (card number, billing address) are collected and processed by Stripe under its own privacy policy — we never receive or store your full card number. Stripe Privacy Policy.

5. Data Storage and Security

Your data is stored in Supabase-managed infrastructure. We implement industry-standard security measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security policies ensuring users can only access their own data
• Secure OAuth token handling with no long-term storage of third-party access tokens on our servers
• Regular security reviews and dependency updates

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Cookies and Tracking

We use essential cookies required for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled.

We may use analytics cookies to understand how the Service is used. You can opt out of non-essential cookies through your browser settings.

We do not use advertising cookies or tracking pixels.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

For emails we classify as job-related, we retain the extracted structured details and a truncated copy of the message body while your account is active, so we can display and re-classify them in your inbox (see Section 2.2). Emails we classify as not job-related are not retained. When you delete your account, this data is deleted within 30 days except where the law requires us to keep it.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data
• Export: Request a machine-readable copy of your data (XLSX/CSV export is available in the application)
• Revoke Gmail Access: You can disconnect your Gmail account at any time from your account settings or directly from your Google account permissions
• Opt-out: You can opt out of non-essential communications at any time

To exercise any of these rights, contact us at privacy@jobweave.ai. We will not discriminate against you for exercising them.

8.1 GDPR (EEA / UK)

Where GDPR applies, our legal bases for processing are: performance of our contract with you (to provide the core Service), your consent (for connecting Gmail and its scopes, which you may withdraw at any time), and our legitimate interests (security, fraud prevention, and improving the Service). You have the right to lodge a complaint with your local data-protection supervisory authority.

8.2 CCPA (California)

We do not sell or share your personal information as those terms are defined by the CCPA, and we have not done so in the preceding 12 months. California residents may exercise their access, deletion, and correction rights via privacy@jobweave.ai; we may verify your request before acting on it.

9. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Our infrastructure and processing providers (Supabase, Vercel, Stripe, Google, and our AI providers) primarily operate in the United States. Where such transfers are subject to GDPR, they are protected by appropriate safeguards such as the Standard Contractual Clauses entered into by these providers, or their certification under the EU-U.S. Data Privacy Framework.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@jobweave.ai
• Website: jobweave.ai