Privacy Policy

This Privacy Policy explains how JobSprout ("JobSprout", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use our website and services at https://www.jobsprout.ai/ (the "Website"). It also describes your rights under UK data protection law.

Who we are

Controller: JobSprout operated by David Culemann as a sole trader ("JobSprout"). Contact: david@jobsprout.ai. Registered address: Flat 1, 64 Catharine Street, Cambridge, CB1 3AW, UK.

Data Protection Contact: david@jobsprout.ai

Personal data we collect

• Account data: email address, name and identifiers created by our systems (via Supabase).
• Profile and content: information you enter into your resumes and cover letters, job preferences, and any files or text you upload.
• Billing data: processed by Stripe. We receive limited information such as transaction status, amounts, currency, and your Stripe customer ID.
• Usage and device data: IP address, device and browser information, pages viewed, timestamps, and cookies or similar technologies.
• Diagnostics and logs: application error data and session information to help us monitor performance and troubleshoot (e.g., Sentry; see “Recipients”).
• Communications: emails and messages you send to us.

How and why we use your data (legal bases)

• Provide and improve the service (contract; legitimate interests for improvement and security).
• Payments, billing, and fraud prevention (contract; legal obligations; legitimate interests).
• Analytics and product development (consent where required; otherwise legitimate interests using privacy‑protective analytics).
• Error monitoring and security (legitimate interests; some replay/diagnostic features may rely on consent in UK/EU).
• Marketing communications (consent; withdraw any time).
• Legal compliance (legal obligations) and to establish/exercise/defend legal claims (legitimate interests).

AI processing

When you request AI‑generated content, your prompts and relevant content may be sent to third‑party AI providers to fulfill your request. We use paid API tiers where available, which generally means your data is not used to train the provider's models, subject to each provider's terms.

We currently send AI requests to these providers:

• Google (Gemini models), including any photo you upload to the headshot tool
• OpenAI (GPT models), for resume tailoring, resume feedback and LinkedIn rewrites
• Z.ai (GLM models), for the AI writer, cover letters, skill suggestions and reading the job descriptions you paste. These requests may be served by another company that hosts the same model, such as Baseten.
• TypeSafe AI (Jev), which scores resumes and LinkedIn profiles. We ask for zero data retention on every request.

Requests to OpenAI, Z.ai and TypeSafe AI pass through Vercel AI Gateway, which forwards them to the provider. Requests to Google go to Google directly. The providers we use may change over time, and we update this list when they do.

Do not include special‑category personal data unless you have a lawful basis.

Recipients and processors

We share data with trusted service providers who act as our processors. The specific providers may change over time, but we use services in the following categories:

• Payment processing (e.g., Stripe)
• Hosting, database, and authentication (e.g., Supabase, Vercel)
• AI providers (see "AI processing" section above)
• Error monitoring and diagnostics (e.g., Sentry)
• Analytics (e.g., PostHog) for product improvement
• Customer support (e.g., Chatwoot) for live chat and help
• Background job processing (e.g., Inngest)
• Email delivery (e.g., Resend, Cloudflare)
• File storage and bot protection (e.g., Cloudflare)
• Company logos (Logo.dev), which receives the names or website domains of companies on your resume or LinkedIn profile

All processors are selected for their data protection commitments and, where applicable, offer Data Processing Agreements. Contact us if you require specific details about our current processors.

We may disclose data where required by law, to protect our rights, or in connection with a business transfer.

International transfers

Your data may be transferred outside the UK/EEA (e.g., to the United States). We use appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or other lawful mechanisms. Contact us for details.

Retention

We retain personal data for as long as necessary to provide the service and meet legal obligations. Financial records may be kept for up to six (6) years under UK law. Logs and diagnostics are retained for limited periods consistent with troubleshooting and security.

Free resume checker

Our free ATS resume checker works without an account. When you score a resume, we cache the analysis (and the resume content it was computed from) for about 24 hours so re-checking the same resume is instant, after which it is automatically deleted. We also store a one-way hashed version of your IP address (never the raw IP) to rate-limit the free service and manage costs.

If you choose to share a result, that report becomes viewable by anyone with the link for about 30 days. The shared report includes its contents, such as any contact details in your resume, so only share the link with people you intend to see it.

YouTube

We use the YouTube API Services to publish and manage the videos on our own YouTube channel. We never ask you to connect a YouTube or Google account, and we do not access, collect, store or share any YouTube data about you.

Pages that show one of our videos load YouTube's player only when you press play. From then on, YouTube handles the playback, and the Google Privacy Policy applies to it. You can review or remove any access you have given apps to your Google account in Google's security settings.

Your rights

Subject to law, you may request access, rectification, erasure, restriction, portability, or object to processing. Where we rely on consent, you can withdraw it at any time. Contact: david@jobsprout.ai.

You can also complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.

Cookies

We use cookies and similar technologies. Non‑essential cookies are used only with your consent where required. For details and to manage your choices, see our Cookie Policy.

Children’s privacy

Our services are not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version here and update the “Last updated” date at the top.

You should review this page periodically for the latest information on our practices.

Contact Us

If you have any questions about this Privacy Policy, you can contact us:

• By email: david@jobsprout.ai