Privacy Policy
Last updated: 27 September 2026
Who we are
Job360 (“we”, “us”) operates the job-search service at job360.uk. We are the data controller for the personal data described here. To contact us about anything in this policy, email privacy@job360.uk.
What we collect
- Account data — your email address and a password. Passwords are stored only as an argon2id hash; we cannot read them. If you sign in by magic link, no password is stored at all.
- Profile data you upload — the text of your CV (PDF/DOCX), an optional LinkedIn profile PDF, an optional GitHub username, your job preferences, and your timezone.
- Job and application data — every job you (or your connected AI assistant) bring in by pasting the ad or a link, plus your applications: a timeline of events, every version of your tailored CV and cover letter, any fit notes you or your assistant recorded, contacts you add for a role (name, role, email, notes), and receipts of what you submitted.
- Technical data — request logs, error traces, and (only if you accept the analytics banner) product-usage analytics.
- Screen recordings — to investigate errors, Sentry records your screen (session replay) while you use Job360. Recordings include what is on screen, including your CV and profile text. About 1 in 10 sessions are recorded, plus every session where an error happens. This is not controlled by the analytics banner. Recordings are stored by Sentry in Germany (EU) and kept for as long as Sentry’s retention setting for our account.
Why we process it (lawful basis)
- Contract — storing the jobs and applications you bring, storing and rendering the tailored documents you or your connected AI assistant write, serving your own connected AI assistant’s requests, and operating your account.
- Consent — product analytics (PostHog) only run after you accept the cookie banner; declining or not answering means no analytics event is ever sent.
- Legitimate interest — keeping the service secure and fixing errors (Sentry).
We do not sell your data. We do not show ads. We do not use your data to train AI models.
AI access — read this part
Job360 runs no AI of its own, and it sends your data to no AI provider. Your CV, profile, and every document you or your assistant write stay on Job360’s servers. If you choose to connect your own AI assistant (for example Claude or ChatGPT), that assistant reads and writes your Job360 data only through the connection you authorised — nothing more, and only while that connection exists. What your assistant does with your data once it has read it is governed by that assistant’s own terms and privacy policy, not this one. You can revoke a connection at any time in Settings → Connect, which immediately stops that assistant’s access.
Who we share data with (subprocessors)
We share data only with the service providers below, only for the purposes stated, and never for their own marketing.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Railway | Application hosting and database | All service data (encrypted in transit and at rest) | Global (servers currently in the USA) |
| Resend | Transactional email (login links, email verification, password reset) | Your email address and message content | USA |
| Cloudflare R2 | Nightly encrypted database backups (kept as the newest 30) | Ciphertext only — backups are encrypted (AES-256) before upload; Cloudflare never sees readable data | Global (Cloudflare network) |
| PostHog (EU) | Product analytics (which features are used) | Usage events and pseudonymous identifiers | EU |
| Sentry | Error monitoring | Error traces and request metadata (request bodies are scrubbed), plus screen recordings (session replay) that include on-screen text such as your CV and profile. Recordings cover about 1 in 10 sessions and every session where an error happens, whether or not you accept analytics | EU (Germany) |
| GitHub | Fetching your public repositories, if you link a GitHub username | The GitHub username you provide | USA |
Where a provider is outside the UK, transfers rely on that provider’s standard contractual clauses / UK addendum. We will update this list before adding any new subprocessor.
How long we keep it
- Your account, jobs, and application data are kept until you delete your account — Job360 has no automatic deletion of your content.
- Security tokens expire automatically and are not renewable: magic sign-in links after 15 minutes, an AI assistant’s OAuth access token after 1 hour (its refresh token after 30 days).
- Encrypted database backups run nightly and only the newest 30 are kept; older ones are deleted automatically. A deleted account ages out of backups within that same window.
How we protect it
All traffic is encrypted in transit (HTTPS/HSTS). Passwords are argon2id-hashed — we cannot read them. Your AI assistant’s connection tokens (personal API tokens and OAuth tokens) are stored only as a hash, never in plain text, so we cannot recover or read them either. Database backups are encrypted (AES-256) before they leave our infrastructure, so the backup-storage provider only ever holds ciphertext.
Your rights
Under UK GDPR you can access, correct, export, or delete your personal data, object to processing, and withdraw consent. Deleting your account (Settings → Account → Delete) erases your per-user data immediately — this is our built-in Article 17 (“right to erasure”) mechanism. For anything else, email privacy@job360.uk and we will respond within one month. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).
Changes to this policy
If we make material changes, we post them here and update the date at the top — this page is the single source of truth for what changed and when.