Privacy policy

This policy explains what personal data Grab Your Job collects, why, who it is shared with, how long it is kept and your rights. We are the data controller under the UK GDPR and the Data Protection Act 2018.

What we collect

• Account: your name, email address and profile picture from Google when you sign in, and when you signed up.
• Applications: the roles you save or mark as applied, their status, dates and your notes, and roles you add by hand.
• CV text: when you use CV match or CV review, the text of your CV or cover letter. Email addresses, phone numbers, street addresses, postcodes, links and ID numbers are removed automatically before it is processed. We never keep the uploaded file. We keep the text only if you tick “Save this CV”; it is then stored encrypted until you delete it.
• Match and review records: which roles a match listed and their fit scores, the filters you chose, and how many matches and reviews you ran (for daily limits). Review results are not stored.
• Premium: your Stripe customer ID, subscription status and paid-until date. Card details are handled by Stripe; we never see or store them.
• Messages: support requests (your email, topic and message) and feedback ratings you send.
• Visits: the pages viewed, the day, the referring site and whether the device is a phone, with a visitor code made from your IP address and browser and a key that changes every day. We do not store your IP address, and the code cannot be linked across days. Browsers that send Do Not Track or Global Privacy Control are not counted.

Why we use it (lawful bases)

• To provide the service you asked for (contract): your account, applications, CV match and review, Premium and support.
• With your consent: keeping a saved CV. You can withdraw it at any time by deleting the saved CV.
• Our legitimate interests: keeping the service secure, preventing abuse of free limits, counting visits to improve the site, and answering feedback.
• Legal obligations: keeping payment and tax records.

Who we share it with

We do not sell personal data or use it for advertising. We use these providers (processors) to run the service:

• Railway (hosting and database). Our servers are in the United States.
• Google (sign-in).
• Stripe (payments and the billing portal).
• OpenRouter and the AI model providers it routes to, including TypeSafe (Jev) and free models such as Qwen, NVIDIA Nemotron and Google Gemma. They receive the redacted CV text and the job details to produce matches and reviews. Some free models may keep prompts to improve their models; only redacted text is sent, never your name from your account, email or file.

Some of these providers are outside the UK, mainly in the United States. Transfers rely on the UK–US data bridge where the provider is certified, or on the UK International Data Transfer Addendum to the EU standard contractual clauses.

Job listings and employer sponsor-licence data come from employers’ public career sites, job boards and the gov.uk register of licensed sponsors; they are not personal data about you.

How long we keep it

• Account and applications: until you ask us to delete your account.
• Saved CV: until you delete it (on CV match, CV review or Premium) or your account is deleted.
• Match records: until your account is deleted; you can clear saved match results at any time.
• Visit records: 400 days.
• Support requests and feedback: up to 2 years.
• Payment records: 6 years, as UK tax law requires.

Cookies

We use only cookies that the site needs to work: a sign-in session cookie and a cookie that remembers your language. We do not use advertising or tracking cookies, so we do not ask for cookie consent. Stripe sets its own cookies on its payment pages.

Your rights

You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent. Email [email protected] or use the support form; we reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Age

The service is for people aged 16 or over.

Security

Traffic is encrypted (HTTPS), saved CVs are encrypted at rest, contact details are removed from CV text before processing, and admin tools are limited to named accounts.

Changes

We will post changes here and change the date above. For significant changes we will tell signed-in users on the site.