Target regimes: GDPR (EU/UK), CCPA/CPRA (California), NDPA (Nigeria 2023). Status tags: [built] · [partial] · [planned]. Beta is invite-only.
| Data | Sensitivity | Purpose |
|---|---|---|
| Master CV / résumé | High (PII) | Tailoring + scoring |
| Search profile (persona, goals, locations) | Medium | Discovery + ranking |
| Contacts (name, company, LinkedIn URL, notes) | High (3rd-party PII) | Networking graph |
| Private LinkedIn messages | Very high | Reconnect surfaces |
| Jobs / applications / answers | Medium | Pipeline |
| Account (email, password hash) | High | Authentication |
At rest: SQLite on Azure-encrypted disk (host-level). App-level field encryption for the highest-sensitivity data is [planned].
| Right | State | How |
|---|---|---|
| Access / portability | [built] | Settings → “Export my data” (full JSON download) |
| Erasure | [built] | Delete account → your tenant database file is destroyed, account + sessions removed |
| Rectification | [built] | Edit your profile/CV in onboarding + Settings |
| Consent capture / withdrawal | [planned] | Consent UI at signup |
| Restriction / objection | [planned] | Account disable on request today |
Lawful basis: performance of your own task (you enter your own data) plus legitimate interest for job discovery. Minimization: we store only what discovery, scoring, and networking need; discovery results are your own. Retention: data persists until you delete your account (self-service erasure is live); an automated retention schedule is [planned].
| Processor | Data shared | Notes |
|---|---|---|
| OpenAI / Azure OpenAI | CV excerpts, job/opportunity text | Parse / score / tailor. Signed DPA + dedicated key [in progress]. |
| RapidAPI (job sources) | Search terms (titles, locations) | Job discovery. No PII beyond search-profile terms. |
| Microsoft Azure | All hosted data | App Service + storage, encrypted at rest. Microsoft DPA. |
The optional “Job & Network Hub Autofill” extension stores only your Hub URL and a
per-user access token locally (chrome.storage) so it can fill applications with
your saved data. It runs only when you click Autofill on a job page, sends data only to your
own Hub account, and performs no analytics, tracking, or data sale.
Users may be in the EU/UK/US/NG; processing (OpenAI/Azure) is primarily US-based. SCCs / a transfer assessment are [planned] before EU general availability. A documented breach-response runbook with 72-hour GDPR/NDPA notification is [planned] before public launch.