Privacy Policy

Controller and contact

Joblume is the controller for the personal data used to provide this job-search workspace. Privacy questions and data requests can be sent to privacy@joblume.app.

What Joblume processes

Joblume processes account identity, email address, resume text, job-search preferences, saved opportunities, application notes, generated documents, feedback, support messages, and technical security records. Uploaded PDF, DOCX, PNG, and JPG files are processed temporarily for text extraction and are not retained as original files.

Why we process data

We process workspace data to provide the service you request, including resume import, job matching, application preparation, follow-up reminders, and account sync. We process limited technical records for security, abuse prevention, reliability, and debugging. Optional emails are processed according to your notification preferences. Billing data is processed only when paid plans are enabled.

Legal bases

Depending on the feature, Joblume relies on contract necessity to provide the workspace, legitimate interests to secure and improve the service, consent or user preferences for optional notifications, and legal obligation where billing, tax, or compliance records are required.

AI providers

When you import a resume or request generation, scoring, tailoring, humanizing, cover letters, interview preparation, or help answers, the relevant extracted text may be sent to configured AI providers such as Google Gemini, KIE, and OpenRouter fallback models. The original uploaded file is not sent as a stored attachment. Do not submit passwords, identity documents, secrets, or information you do not want processed by these providers.

Processors and transfers

Joblume may use infrastructure, authentication, email, payment, database, backup, and AI providers such as Hostinger, Google, Resend, Stripe, Google Gemini, KIE, and OpenRouter. These providers may process data in countries outside your own. We use them only as needed to operate requested features, secure the service, deliver emails, process payments, or generate AI outputs.

Storage and isolation

Signed-in data is stored in Joblume's private database and scoped to the signed-in account. Guest work stays in the browser unless Device sync is enabled. Device sync is protected by a secret recovery code; anyone with that code can access its synced copy, and it is separate from signed-in account deletion.

Retention and deletion

Account workspace data is retained until you delete it or ask us to delete it. Settings provides JSON export and permanent account deletion. Temporary upload files are removed after processing.

Unless a longer period is required by law or needed to resolve a security incident or legal claim, current maximum operational retention periods are: login-code records 14 days; request-limit records 2 days; operational and support records 90 days; AI usage counters 120 days; email delivery records 180 days; and job activity records 365 days. Expired authentication sessions and verification tokens are removed, expired company-identity cache entries are removed within 7 days, and rolling server backups are kept for 7 days.

Deleting a signed-in account removes its active account workspace, resumes, jobs, profile, authentication accounts and sessions, login-code and verification-token records, associated usage records, email delivery records, and identifiable operational records. A deleted record may remain in encrypted rolling backups until those backups expire. Guest Device sync copies are separate and must be deleted with the recovery code from Device sync.

Your rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal data. You can export and delete account data in Settings. For anything not available in the product, contact privacy@joblume.app. You may also have the right to complain to your local data protection authority.

Security

Joblume uses HTTPS, account authentication, access controls, private database networking, request limits, body-size limits, and backups where configured. No internet service can promise absolute security.