This Privacy Policy explains how JobSprout ("JobSprout", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use our website and services at https://jobsprout.ai/ (the "Website"). It also describes your rights under UK data protection law.

Who we are

Controller: JobSprout operated by David Culemann ("JobSprout"). Contact: davidculemann@gmail.com. Registered address: Flat 1, 64 Catharine Street, Cambridge, CB1 3AW, UK.

Personal data we collect

• Account data: email address, name and identifiers created by our systems (via Supabase).
• Profile and content: information you enter into your CVs and cover letters, job preferences, and any files or text you upload.
• Billing data: processed by Stripe. We receive limited information such as transaction status, amounts, currency, and your Stripe customer ID.
• Usage and device data: IP address, device and browser information, pages viewed, timestamps, and cookies or similar technologies.
• Diagnostics and logs: application error data and session information to help us monitor performance and troubleshoot (e.g., Sentry; see “Recipients”).
• Communications: emails and messages you send to us.

How and why we use your data (legal bases)

• Provide and improve the service (contract; legitimate interests for improvement and security).
• Payments, billing, and fraud prevention (contract; legal obligations; legitimate interests).
• Analytics and product development (consent where required; otherwise legitimate interests using privacy‑protective analytics).
• Error monitoring and security (legitimate interests; some replay/diagnostic features may rely on consent in UK/EU).
• Marketing communications (consent; withdraw any time).
• Legal compliance (legal obligations) and to establish/exercise/defend legal claims (legitimate interests).

AI processing

When you request AI‑generated content, your prompts and relevant content may be sent to third‑party AI providers (currently OpenAI and DeepSeek) to fulfill your request. To our knowledge and configuration, API requests are not used to train those providers’ models, subject to their policies.

• OpenAI: Privacy
• DeepSeek: Provider info

Do not include special‑category personal data unless you have a lawful basis.

Recipients and processors

We share data with trusted service providers who act as our processors:

• Stripe (payments): DPA, Privacy
• Supabase (hosting, database, authentication): Privacy
• OpenAI and DeepSeek (AI inference): see links above.
• Sentry (error monitoring and optional session replay): DPA, Privacy
• Vercel (hosting and analytics): Privacy
• Inngest (background jobs/events): Privacy

We may disclose data where required by law, to protect our rights, or in connection with a business transfer.

International transfers

Your data may be transferred outside the UK/EEA (e.g., to the United States). We use appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or other lawful mechanisms. Contact us for details.

Retention

We retain personal data for as long as necessary to provide the service and meet legal obligations. Financial records may be kept for up to six (6) years under UK law. Logs and diagnostics are retained for limited periods consistent with troubleshooting and security.

Your rights

Subject to law, you may request access, rectification, erasure, restriction, portability, or object to processing. Where we rely on consent, you can withdraw it at any time. Contact: davidculemann@gmail.com.

You can also complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.

Cookies

We use cookies and similar technologies. Non‑essential cookies are used only with your consent where required. For details and to manage your choices, see our Cookie Policy.

Children’s privacy

Our services are not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version here and update the “Last updated” date at the top.

You should review this page periodically for the latest information on our practices.

Contact Us

If you have any questions about this Privacy Policy, you can contact us:

• By email: davidculemann@gmail.com