Privacy Policy & Cookie Disclosure

1. Introduction & Scope

At Jobmio (operated by Vinnogro, "Company", "we", "us", or "our"), we respect your privacy and are committed to protecting the personal data of our users ("you" or "candidate"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use the Jobmio web application (https://app.jobmio.app), marketing website (https://jobmio.app), "Save to Jobmio" browser extensions, and associated services (collectively, the "Service").

We adhere to the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth), the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act, and the California Consumer Privacy Act (CCPA/CPRA).

2. Information We Collect

We collect information that identifies, relates to, describes, or is reasonably capable of being associated with you:

2.1 Account & Identity Data

• User Identifiers: Email address, name, avatar image, and Firebase Authentication User ID (uid).
• Authentication Tokens: Secure session tokens and credentials managed via Google Identity and Firebase Authentication.

2.2 Candidate Profile & Career Data

• Contact Information: Phone number, personal website, LinkedIn URL, GitHub profile, and geographic location (city, state, country).
• Work Experience: Company names, role titles, employment dates, responsibilities, and quantified achievements.
• Education & Credentials: Institutions, degrees, graduation years, academic accomplishments, and professional certifications.
• Skills & Goals: Technical competencies, target roles, salary expectations, preferred job types, and industries.
• Uploaded Documents: Historical resumes and cover letters uploaded in Microsoft Word (.docx) or Adobe PDF (.pdf) format.

2.3 Job Tracking & Browser Extension Data

• Job Advertisement Records: Role titles, hiring organizations, compensation bands, locations, job URLs, and complete job advertisement descriptions captured via our web application or the "Save to Jobmio" browser extensions.
• Screening Questions & Answers: Application questions and user-tailored responses.

2.4 Payment & Billing Data

Stripe Payment Records: Customer identifiers, subscription status, billing intervals, and transaction receipts. Full credit card numbers are collected and processed directly by Stripe, Inc. under PCI-DSS Level 1 certification and are never stored on Jobmio servers.

2.5 Technical & Usage Logs

Telemetry Data: IP address, browser type, operating system, timestamped access logs, and error diagnostic logs used strictly for security monitoring and platform reliability.

3. How We Use Your Information & Legal Bases for Processing

Under the EU GDPR and UK GDPR, we process your data exclusively for lawful purposes under the following legal bases:

3.1 Performance of a Contract (GDPR Art. 6(1)(b))

• Core Service Operation: Managing your account, storing and synchronizing your career history, and maintaining your application pipeline.
• AI-Assisted Document Tailoring: Generating tailored resumes, cover letters, and STAR responses based on your explicit request.
• Public Recruiter Portfolios: Rendering your shareable web portfolio (/portfolio/[token]) and availability calendar at your direction.
• Subscription Management: Managing plan upgrades, billing intervals, and customer account access.

3.2 Legitimate Interests (GDPR Art. 6(1)(f))

• Platform Security & Abuse Prevention: Enforcing our Fair Use Policy (500 AI calls/mo, 200 active applications), detecting bot scraping, blocking unauthorized intrusions, and safeguarding multi-tenant data integrity.
• Product Optimization: Reviewing aggregate, anonymized technical telemetry to improve application stability and latency.

3.3 Compliance with Legal Obligations (GDPR Art. 6(1)(c))

• Taxation & Financial Recordkeeping: Retaining billing receipts and transaction records as mandated by Australian and international taxation laws.

3.4 Consent (GDPR Art. 6(1)(a))

• Optional Features & Permissions: Where you voluntarily grant browser tab access or elect to generate a public recruiter token. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

4. AI Processing & LLM Data Protection

4.1 Zero Public Model Training Guarantee

We NEVER sell, license, or use your personal resume data, work history, or application prompts to train public AI foundation models. Your career data is not fed into public LLM training datasets.

4.2 Ephemeral Third-Party API Processing

When you initiate an AI action (such as tailoring a resume or drafting a STAR response), your relevant profile bullet points and the targeted job ad are transmitted via encrypted API endpoints to our enterprise AI model partners:

• Google Gemini API (Google Cloud Platform)
• OpenAI API (OpenAI, LLC)
• OpenRouter API (OpenRouter)

These enterprise API endpoints operate under contractual terms prohibiting third-party LLMs from retaining or training on customer data submitted through the API.

4.3 Automated Decision-Making (GDPR Art. 22 Notice)

Jobmio is a candidate-side career preparation tool. Jobmio does NOT make automated decisions that produce legal or similarly significant effects regarding employment. All hiring decisions are made independently by prospective employers.

5. "Save to Jobmio" Browser Extension Privacy

Our browser extensions (Chrome, Safari, Edge, Firefox) comply with strict data minimization standards:

• User-Initiated Scraping: The extension parses DOM content only when you explicitly activate the extension button on an active job posting tab.
• No Background Web Snooping: The extension does not record your browsing history, monitor keystrokes, or intercept network traffic on unrelated websites.
• Session Verification: Tab permissions are used strictly to identify active authentication cookies on app.jobmio.app so you can save jobs without re-entering API credentials.

6. Cookies & Local Storage Disclosure

Jobmio uses essential cookies and browser storage technologies strictly necessary for platform functionality:

7. Data Sharing & Third-Party Sub-Processors

We do not sell, rent, or trade your personal information. We disclose data only to trusted sub-processors who adhere to rigorous data protection standards and data processing agreements:

• Google Cloud Firestore & Firebase: Cloud database, user authentication, and serverless hosting infrastructure (US / Australia regions).
• Stripe, Inc.: Payment processing, subscription billing, and tax calculation (PCI-DSS Level 1 certified).
• Google Gemini, OpenAI, OpenRouter: Large language model enterprise API providers for real-time document tailoring.

8. Data Security, International Transfers & Retention

8.1 Security Safeguards (GDPR Art. 32)

• Encryption in Transit: All traffic between your browser, the extension, and Jobmio servers is encrypted using TLS 1.3.
• Encryption at Rest: All user profile data, resumes, and application records stored in Google Cloud Firestore are encrypted at rest using 256-bit AES encryption.
• Access Control: Multi-tenant database security rules isolate each candidate's data strictly to their authenticated account identifier (uid).

8.2 International Cross-Border Data Transfers (GDPR Chapter V)

Jobmio is operated by Vinnogro in New South Wales, Australia, with cloud infrastructure and sub-processors hosted in Australia and the United States. Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, we ensure appropriate safeguards are implemented, including:

• Utilizing European Commission-approved Standard Contractual Clauses (SCCs) with our cloud and API vendors.
• Engaging sub-processors certified under recognized adequacy frameworks or equivalents.

8.3 Data Retention Schedule (GDPR Art. 5(1)(e))

• Candidate Profile & Application Records: Retained for the lifetime of your active account to maintain your continuous career history. If you delete your account, this data is irreversibly purged from our active databases immediately.
• System & Diagnostic Logs: Kept for up to ninety (90) days strictly for security diagnostics and abuse prevention, after which they are automatically rotated and purged.
• Financial Transaction Records: Anonymized billing records and transaction IDs are retained for up to seven (7) years to satisfy Australian and international statutory taxation obligations.

9. Your Rights Under GDPR, APPs & CCPA

Regardless of your geographic location, Jobmio empowers you with full statutory control over your personal data:

• Right of Access (GDPR Art. 15): You can inspect your complete career profile, documents, and application history at any time through the platform interface.
• Right to Rectification (GDPR Art. 16): You can edit or correct any inaccurate work experience, profile details, or notes directly in your account settings.
• Right to Erasure / Right to be Forgotten (GDPR Art. 17): You may delete your account and all associated work history, applications, documents, and interview preps at any time via Settings or by emailing privacy@vinnogro.com. Account deletion irreversibly purges your data from our active database.
• Right to Restriction of Processing (GDPR Art. 18): You have the right to request restriction of data processing if you dispute data accuracy or lawfulness.
• Right to Data Portability (GDPR Art. 20): You can export your customized resumes in standard DOCX and PDF formats at any time.
• Right to Object (GDPR Art. 21): You have the right to object to the processing of your personal data based on legitimate interests.
• Right to Withdraw Consent (GDPR Art. 7(3)): Where processing is based on consent, you may withdraw your consent at any time without penalty.
• Right to Lodge a Complaint (GDPR Art. 77): If you are an EEA or UK resident and believe our processing infringes data protection laws, you have the right to lodge a complaint with your local EU Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).
• CCPA "Do Not Sell" Notice: Jobmio does not sell or share personal information as defined under the California Consumer Privacy Act.

10. Children's Privacy

The Service is not intended for or directed to individuals under the age of sixteen (16). We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please notify us at privacy@vinnogro.com and we will promptly delete it.

11. DMCA & Copyright Takedown Procedure

Vinnogro respects the intellectual property rights of others. If you believe that content available on Jobmio infringes your copyright or trademark, please transmit a formal notice to our designated agent at support@vinnogro.com.

12. Contacting the Privacy Officer

If you have questions, complaints, or wish to exercise your statutory privacy rights, please contact our Privacy Officer:

Vinnogro — Data Privacy Officer
Email: privacy@vinnogro.com
Support Desk: support@vinnogro.com
Jurisdiction: New South Wales, Australia
Web: https://jobmio.app