Privacy Policy

1. Introduction & Who We Are

This Privacy Policy explains how Jobaron ("Jobaron", "we", "us", "our") collects, uses, and protects your personal data when you use our Telegram bot (@Jobaronbot) and our website (jobaron.com) (together, the "Service").

Jobaron is a service that aggregates job vacancies directly from companies' applicant tracking systems (ATS) and helps you find roles that match your profile, including AI-assisted features such as resume-based matching, role detection, and job–resume fit checks.

Data Controller:
Vitalii Timchenko
P.IVA 04374321208
Pianoro (BO), Italy, European Union
Contact: support@jobaron.com

We are the "data controller" for the personal data described in this Policy, meaning we decide why and how it is processed. This Policy is written to comply with the EU General Data Protection Regulation (GDPR) and applicable Italian data protection law.

2. Scope

This Policy applies to all personal data we process through:

• the Jobaron Telegram bot (@Jobaronbot);
• the Jobaron website (jobaron.com), including the contact form;
• any related communications between you and us.

It does not cover third-party services we link to or rely on, which have their own privacy policies (see Section 6 and Appendix A).

3. What Data We Collect

We collect the following categories of personal data:

From Telegram (when you use the bot):

• your Telegram user ID;
• your name and/or username as provided by Telegram.

Information you provide to use the Service:

• your resume/CV, which you upload as a PDF, DOCX, or plain text;
• voice messages you send, which are transcribed into text;
• your job search preferences;
• vacancies you save.

Your email address (optional):

• if you choose to have a vacancy sent to your email, we collect the email address you provide for that purpose. This is voluntary and only used to perform the action you requested.

From the website contact form:

• your name, email address, and the content of your message.

Contact form submissions may be processed through third-party automation tools used to deliver your message to us and manage support requests. These tools act solely as service providers and process data only for the purpose of transmitting and handling your enquiry.

Subscription status:

• whether you are on the free or a paid plan, and the status of your subscription. We do not collect or store your card or payment details — these are handled directly by our payment provider (see Section 11).

4. How We Use Your Data & Legal Bases

Under the GDPR, we must have a valid legal basis for each use of your data. The table below summarises our purposes and bases:

You can withdraw consent at any time (see Section 10). Withdrawing consent does not affect processing carried out before withdrawal.

5. AI Processing

Some Jobaron features rely on automated processing and third-party AI providers. We want to be transparent about what this involves:

• Voice transcription: voice messages you send are converted to text by an AI provider so the bot can read your input.
• Resume analysis & role detection: the text of your CV is analysed to identify your skills and likely roles.
• Matching & fit checks: your CV and preferences are converted into numerical representations (embeddings) and compared against vacancies to score relevance.
• Fallback processing: if our primary AI provider is unavailable, an alternative provider may process the same data to keep the Service working.

To enable these features, the text of your CV and your voice messages are sent to AI providers located outside the EU (see Section 7). These features are optional and run only when you actively use them. We do not use this data to train third-party AI models, and our providers are bound by agreements restricting their use of your data to providing the service to us.

This processing does not produce legal or similarly significant effects about you without your involvement; it produces suggestions and scores that assist your own job search.

6. Third Parties / Sub-Processors

To run the Service, we share data with carefully selected third parties ("sub-processors") who process it on our behalf, by category:

• Messaging platform — to operate the bot and deliver messages to you.
• Payment provider — to manage subscriptions and process payments.
• AI providers — for transcription, resume analysis, embeddings, matching, and fallback processing.
• Hosting provider — to host and run our application and store data.

Each sub-processor is bound by a data processing agreement and may only use your data to provide services to us. A current, named list is in Appendix A, which we update as our providers change.

7. International Data Transfers

Some of our sub-processors — in particular our AI providers used for CV analysis, voice transcription, and embeddings — are located in the United States. This means that when you use these features, your CV text and voice messages are transferred outside the European Economic Area (EEA).

Where we transfer personal data outside the EEA, we rely on appropriate safeguards as required by the GDPR, such as the European Commission's Standard Contractual Clauses (SCCs) and/or transfers to providers covered by an adequacy mechanism (e.g. the EU–U.S. Data Privacy Framework), depending on the provider. You can request more information about the safeguards in place by contacting us at support@jobaron.com.

8. Cookies & Analytics

Our website uses Google Analytics to understand how visitors use the site and to improve it. Google Analytics sets cookies that collect information such as your approximate location, device, and browsing behaviour on our site.

We load analytics cookies only after you give consent via our cookie banner. You can accept or reject non-essential cookies, and change your choice at any time through the banner or your browser settings. Essential cookies needed for the site to function are always active.

Google Analytics may involve a transfer of data to the United States; the same safeguards described in Section 7 apply.

9. Data Retention

We keep your personal data only as long as necessary for the purposes described:

• CV, voice messages, preferences, and saved vacancies: retained while your account is active. You may request deletion of this data at any time by contacting us at support@jobaron.com. We aim to delete or anonymise account data after approximately 12 months of inactivity, unless a longer retention period is required for legal or operational reasons.
• Telegram identifiers: retained while you use the bot.
• Contact-form messages: retained as long as needed to handle your enquiry and for a reasonable period afterwards.
• Subscription and billing records: retained as required by Italian tax and accounting law (generally up to 10 years).

When data is no longer needed, we delete or anonymise it.

10. Your GDPR Rights

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict or object to certain processing;
• data portability — receive your data in a structured, machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).

To exercise any of these rights, contact us at support@jobaron.com. We may request reasonable information to verify your identity before processing your request. We respond within the timeframes required by the GDPR (generally one month).

11. Payment Data

Paid subscriptions are processed by our third-party payment provider, Stripe. When you subscribe, your card and payment details are collected and stored directly by Stripe under their own privacy policy. We never receive or store your full card details — we only receive your subscription status and limited transaction information needed to manage your account.

12. Data Security

We take reasonable technical and organisational measures to protect your data, including access controls, encryption in transit, and limiting data access to what is necessary. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children

The Service is not intended for individuals under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the bot or website. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

15. Contact

For any questions about this Policy or your data, contact:

Vitalii Timchenko
Email: support@jobaron.com

---

Appendix A — Sub-Processors

This appendix lists the third-party providers we currently use to deliver the Service. We update it as our providers change.