Privacy Policy

This Privacy Policy explains what information JobBot HQ (jobbothq.com, the "Service") collects, how we use it, and the choices you have. The Service is operated by Snapshots Cloud ("we", "us"). We do not sell your personal information.

1. Information We Collect

Information you give us:

• Account: username, email address, and a password (stored only as a one-way cryptographic hash, never in readable form). If you choose Sign in with Google, we receive from Google your email address, whether Google has verified it, your name, and a Google account identifier; we do not receive your Google password, and we do not ask Google for access to your contacts, calendar, Drive or any other Google data. If you choose Sign in with Apple, we receive from Apple an account identifier, whether Apple has verified your email address, and the email address you choose to share, which may be a private relay address that forwards to your own inbox, and, the first time only, your name if you choose to share it; we do not receive your Apple ID password, and we do not ask Apple for any other Apple data.
• Job-search profile: desired job titles, city and state, search radius, remote preference, keywords to include or exclude, minimum salary, and alert frequency.
• Resume: if you upload a resume (PDF or text) we store its text, and a structured summary of it (skills, titles, experience) produced by AI. A resume can contain sensitive personal details such as your name, phone number, address, and work history. Upload only what you are comfortable sharing.
• Activity you create: employers on your watchlist, job matches, application-tracker entries and notes, and messages you send to the AI copilot.

Collected automatically: your IP address, browser type, and request details in server logs, used for security, abuse prevention, and troubleshooting. We also record email delivery status (for example bounces and unsubscribes) so we do not keep emailing addresses that cannot receive mail.

We do not collect or store your card number. Paid plans are processed by Stripe, Inc., which collects your payment card details directly on its own secure pages. We receive from Stripe only what we need to run your subscription: a customer and subscription ID, your plan and its status, the renewal date, and invoice records (amount, date, status). Stripe acts as an independent processor under its own privacy policy. We keep billing records as long as needed for accounting, tax and dispute purposes.

2. How We Use Information

• To provide the Service: find and score job listings, run your watchlist, and send the alerts you asked for.
• To parse your resume and generate match scores and AI copilot responses.
• To secure the Service, prevent abuse, and enforce plan limits and our Terms.
• To contact you about your account, security, and important changes.
• To maintain and improve the Service.

We do not use your resume or messages to train our own models, and we do not use your resume, profile, or messages for advertising.

Advertising and measurement. We may advertise JobBot HQ on third-party platforms such as Google Ads and Meta (Facebook and Instagram). To measure whether our ads lead to sign-ups, we may use Google's conversion measurement tag and the Meta Pixel on our public marketing pages and on the sign-up confirmation. These tags let Google and Meta receive information such as your IP address, device and browser details, the page you visited, and whether you came from one of our ads or completed a sign-up. We use them to measure and improve our advertising, not to build advertising profiles from your resume, job searches, or account contents, and we do not send those to Google or Meta. We do not run these tags on your logged-in dashboard, resume, or Copilot pages. If we add remarketing (showing our ads to people who visited our site), we will describe it here and you can opt out through the controls below.

3. Who We Share Information With

We share information only with service providers that help us run the Service, and only as needed:

• Anthropic — AI provider. Your resume text and copilot messages are sent to Anthropic's API to parse resumes and generate responses. Under Anthropic's commercial API terms, content sent through the API is not used to train its models by default.
• Amazon Web Services — hosts our servers and database, and sends alert and account emails through Amazon SES (see the AWS Privacy Notice).
• Job-data providers (for example Adzuna) — we fetch public listings from them. We do not send your personal information to them.
• Stripe — payment processing and subscription billing for paid plans.
• Google — if you use Sign in with Google, Google authenticates you and, in doing so, learns that you signed in to JobBot HQ. Google's handling of that information is described in the Google Privacy Policy. We do not send your resume, profile or activity to Google through sign-in.
• Apple — if you use Sign in with Apple, Apple authenticates you and, in doing so, learns that you signed in to JobBot HQ. Apple's handling of that information is described in the Apple Privacy Policy. We do not send your resume, profile or activity to Apple through sign-in.

We may also disclose information if required by law or to protect our rights, users, or the Service, and in connection with a merger, acquisition, or sale of assets (we would tell you if your information becomes subject to a different privacy policy).

Employers do not receive your resume or profile from us. Nothing is sent to an employer unless you apply to them yourself.

4. Cookies and Local Storage

The Service itself uses only the cookies and browser storage needed to keep you signed in and make it work: a short-lived access token and a longer-lived refresh token (secure, same-site cookies), and temporary session storage for things like dismissed announcements. On the sign-in and sign-up pages, when Sign in with Google is offered, your browser loads Google's sign-in script and button from Google, and Google may set its own cookies for that purpose. If you start a sign-up with Google, a short-lived Google sign-in token is held in your browser's session storage for that tab only (cleared when you finish or close the tab) so you do not have to sign in twice. Sign in with Apple works the same way: when it is offered, your browser loads Apple's sign-in script from Apple, and if you start a sign-up with Apple, a short-lived Apple sign-in token and a one-time security value are held in your browser's session storage for that tab only, and cleared when you finish or close the tab.

Advertising and analytics cookies. If we use Google's advertising or conversion tag or the Meta Pixel (see section 2), Google, Meta and their partners may set or read cookies and similar identifiers in your browser on our public marketing pages and sign-up flow. These collect information about visits to our site and may be used to measure ads and, if we enable remarketing, to show you our ads on other websites. You can block or delete cookies in your browser settings, use Google's Ads Settings or Meta's ad preferences to control personalized advertising, or opt out using the Digital Advertising Alliance opt-out. See How Google uses information from sites that use its services Google's Privacy Policy, and Meta's Privacy Policy.

Do Not Track. Our Service does not currently respond to browser "Do Not Track" signals, because there is no common standard for them. Third parties such as Google and Meta may collect information about your online activities over time and across different websites when you use our public pages while an advertising tag is active; you can limit this with the controls above.

5. Support Access

Authorized administrators can view account information, and can use a read-only "view as user" tool, to provide support, investigate abuse, and keep the Service running. Administrator actions are logged.

6. Data Retention

• Account, profile, resume, watchlist, and copilot history: kept while your account is active. When an account is deleted, the associated profile, resume, matches, watchlist, and copilot messages are deleted from our database.
• Billing records: when you delete your account we cancel any paid subscription immediately. Invoice and payment records (amount, date, status) are kept, detached from your profile, for accounting, tax, and dispute purposes, and Stripe keeps its own records under its privacy policy.
• Job listings (public data, not about you) are refreshed continually and expire automatically after a few weeks.
• Email suppression records (address and reason) may be kept so we honor unsubscribes and bounces.
• Server logs and any backups are kept for a limited period and then removed or overwritten.

7. Your Choices and Rights

You can view and edit your profile and resume in the Service, set how often alerts are sent, and unsubscribe at any time using the link in any alert email. You can export your data and delete your account yourself from your profile page. For anything else (to access, correct, or delete your personal information or account by request), email hello@snapshots.cloud from your account email address and we will respond within 30 days. We will not discriminate against you for exercising your rights.

California residents (CCPA/CPRA): in the last 12 months we have collected the following categories of personal information, as described in section 1: identifiers (username, email address, IP address); internet or network activity (server logs, and, if an advertising tag is active, ad and sign-up measurement data); professional or employment-related information (resume text, desired job titles, work history); commercial information (plan and billing status, invoice records); and inferences (match scores and AI summaries of your resume). A resume can include sensitive personal information, but we use it only to provide the Service you requested and not to infer characteristics about you, so we do not offer a right to limit its use. You have the right to know what personal information we collect, use, and disclose; to request deletion or correction; and to opt out of the sale or sharing of personal information. We do not sell personal information. If we run Google's advertising tag or the Meta Pixel, Google and Meta may collect advertising identifiers from our public pages, which California law can treat as "sharing" for cross-context behavioral advertising; in that case you can opt out of that collection by blocking cookies as described in section 4, by using Google's Ads Settings or Meta's ad preferences, or by emailing us and we will record your opt-out request. You may use an authorized agent to make a request on your behalf; we may ask for proof of the agent's authority and for you to verify your identity by emailing us from your account email address. We respond within 30 days, as described above.

Residents of the EEA, UK, and similar regions: you may have the right to access, correct, delete, restrict, or object to processing of your data, to data portability, and to complain to your local data-protection authority. We process your data to provide the Service you requested (contract), for security and improvement (legitimate interests), and with your consent where required. Our servers are located in the United States, so your information will be transferred to and processed in the U.S.

8. Security

We use reasonable safeguards, including encrypted connections (HTTPS), hashed passwords, access controls, and secure cookies. No system is completely secure, so we cannot guarantee absolute security. Choose a strong, unique password.

9. Children

The Service is for people 18 and older and is not directed to children. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

10. Changes to This Policy

We may update this policy. The "Last updated" date shows the latest version, and we will notify you of material changes in the Service or by email.

11. Contact

Privacy questions or requests: hello@snapshots.cloud.