1. Introduction
   Best JobFinder ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, web application, desktop application, and Chrome extension (collectively, the "Service").
2. Information We Collect
   2.1 Account Information
   When you create an account, we collect your email address, name, and optional profile information such as resume data, CV, skills, and work experience. You control what information you provide.

2.2 Job Search Data
We collect information about job searches you perform, including job titles, companies, locations, and job postings you save, apply to, or ignore. This data is used to provide application tracking and skill matching features.

2.3 Email Data
If you opt-in to email integration, we access and store metadata about emails related to job applications (subject, sender, timestamps). We do not store email body content unless you explicitly choose to save it. Email credentials are never stored on our servers.

2.4 File Data
You may upload CVs, resumes, cover letters, and other documents. These files are stored securely in cloud storage and are encrypted. Only you can access your files unless you explicitly share them.

2.5 Browser Session Data
We do not store your login credentials for job websites. Browser sessions with websites (LinkedIn, Dice, Indeed, etc.) are managed locally in your browser or desktop application using secure partitioned cookies.

2.6 Technical Data
We collect device type, browser type, IP address, and usage analytics to improve our Service. This data is aggregated and anonymized where possible.

1. How We Use Your Information
   To provide and maintain the Service (job tracking, skill matching, auto-fill)
   To process subscriptions and handle payments
   To communicate with you about account updates, security, or service changes
   To send transactional emails (confirmations, receipts, account notifications)
   To improve and optimize the Service based on usage patterns
   To comply with legal obligations and enforce our Terms of Service
   To detect and prevent fraud, abuse, and security incidents
2. Data Storage and Security
   Your account and application data is stored securely in a PostgreSQL database with enterprise-grade security, encryption at rest and in transit, and regular security audits. Files (CVs, cover letters, and generated documents) are stored using Supabase Storage.

We implement industry-standard security measures including:

SSL/TLS encryption for all data in transit
AES-256 encryption for files at rest
Application-level access controls to ensure users can only access their own data
Regular security backups and disaster recovery procedures
No storage of passwords for external job websites
5. Third-Party Services
We use the following third-party services:

Supabase (File Storage): Stores your uploaded and generated files (CVs, cover letters, and related documents) with their privacy policy available at supabase.com/privacy
Google Authentication (OAuth): Allows you to sign in with your Google account. Google's Privacy Policy applies.
GitHub Authentication (OAuth): Allows you to sign in with your GitHub account. GitHub's Privacy Policy applies.
Google Analytics 4 (GA4): Collects anonymized usage data to help us understand how the Service is used. GA4 respects your privacy settings and does not collect personally identifiable information.
Google Ads: Measures which ads and campaigns lead to sign-ups (conversion tracking), and links an ad click on our landing page to a later sign-up on our web application (cross-domain attribution) so we can tell which ads are effective. Google's Privacy Policy applies.
Stripe (Payment Processing): Processes subscription payments. Stripe does not store your full credit card information. See Stripe's Privacy Policy.
6. Data Sharing and Disclosure
We do not sell or rent your personal information to third parties. We only share your data:

With service providers who help us operate the Service under strict data protection agreements
When required by law or to comply with legal processes (subpoenas, warrants)
To protect our rights, privacy, safety, or property
In connection with a merger, acquisition, or sale of assets (with notice)
7. Legal Basis for Processing (GDPR Art. 6)
Where GDPR applies, we process your data on the following legal bases:

Contract performance (Art. 6(1)(b)): Account management, job tracking, subscription fulfilment.
Legitimate interests (Art. 6(1)(f)): Fraud prevention, service security, product analytics (aggregated only).
Consent (Art. 6(1)(a)): Analytics and advertising cookies (Google Analytics 4, Google Ads). You may withdraw consent at any time via the cookie banner or Privacy settings.
Legal obligation (Art. 6(1)(c)): Billing records retained for 7 years as required by EU accounting law.
8. Data Retention
We retain your data for the following periods:

Account & profile data: Retained until you delete your account.
Job records & application logs: Retained until you delete your account or clear data.
Email content (IMAP sync): Retained until you delete it or disable email sync.
Billing records: 7 years from the date of the transaction (legal obligation).
Server & access logs: Up to 90 days for security purposes.
Consent records: 3 years from the date of consent.
9. Your Rights
Under GDPR, you have the following rights (exercisable at any time):

Right to Access (Art. 15): Request a copy of your personal data. Use Settings → Privacy → Export My Data for an instant download.
Right to Rectification (Art. 16): Correct inaccurate information in your account settings.
Right to Erasure (Art. 17): Delete your account and all data via Settings → Privacy → Delete Account. Billing records required by law are excluded.
Right to Data Portability (Art. 20): Export your data as structured JSON via Settings → Privacy → Export My Data.
Right to Withdraw Consent (Art. 7(3)): Withdraw analytics and advertising consent at any time using the cookie preferences banner or your Privacy settings.
Right to Object (Art. 21): Object to processing based on legitimate interests by contacting us.
Right to Lodge a Complaint (Art. 77): You have the right to lodge a complaint with your local data protection supervisory authority. For EU residents: EDPB member list.
To exercise any right, contact us at info@bestjobfinder.net. We respond within 30 days.

9b. Referral Program
If you sign up through someone's referral link, we record that you were referred by them, when you signed up, and — once you subscribe to a paid plan — that the referral converted, so their reward can be issued. We also store a one-way hash of the IP address used at sign-up, purely to detect people referring themselves from multiple accounts. We do not store the address itself.

What your referrer can see about you: a partially masked version of your email address (for example mu•••@gmail.com), the date you signed up, and whether you subscribed. They never see your full address, your name, or anything you do in the product.

If you delete your account, the referral record linking you to them is deleted with it. A reward they already earned remains theirs.

1. Cookies
   We use the following cookies:

Cookie Provider Purpose Duration
jf-auth-session Best JobFinder Authentication session (strictly necessary) Session (localStorage)
jf-ref, jf-referral-code Best JobFinder Remembers the referral link you arrived through, so the person who invited you can be credited when you subscribe. Cleared once your account is created. Until sign-up (localStorage)
ga, _ga* Google Analytics Usage analytics (requires consent) 2 years
_gcl_au, _gcl_aw Google Ads Conversion tracking — links an ad click to a later sign-up (requires consent) 90 days
cookie_consent Best JobFinder Stores your cookie preference 1 year (localStorage)
When you click a link from our landing page to our web application (e.g. "Sign Up"), a short-lived tracking parameter (_gl) may be appended to the destination URL so a later sign-up can be attributed to the ad or campaign that brought you here. It is read once by the destination page on arrival and is not stored beyond that.

You can change your analytics and advertising preference at any time using the cookie banner at the bottom of this page. Strictly necessary cookies cannot be disabled as the Service cannot function without them.

1. Children's Privacy
   The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, contact us immediately at info@bestjobfinder.net.
2. International Data Transfers
   Your data is primarily stored in the European Union. Some processing may occur outside the EU (e.g., Google Analytics and Google Ads servers in the US). For such transfers, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46 GDPR) or the processor's EU–US Data Privacy Framework certification.
3. Policy Updates
   We may update this Privacy Policy periodically. Significant changes will be notified via email or a prominent notice on the website at least 14 days before they take effect. Continued use of the Service after that date constitutes acceptance.
4. Contact Us
   If you have questions about this Privacy Policy, wish to exercise your rights, or want to report a data concern:

Data Controller: Best JobFinder

Email: info@bestjobfinder.net

We aim to respond to all privacy requests within 30 days.