Privacy Policy

1. Who is responsible for your data

Striped Hare Ltd (company number SC869047, registered in Scotland, see Legal & Company Info for the full details)

is the data controller for the personal data described here. Contact: contact@myjobby.co.uk. ICO registration reference: CSN8212170.

2. What we collect

• Onboarding answers, your stated job preferences, discipline, career stage, location, right-to-work status, and similar information you provide when signing up.
• CV (optional), see Section 4 below for exactly how this is handled and how long it's kept: in short, much less than you might expect.
• AI-generated profile summary, a short summary of your CV/background, and a structured profile derived from your CV and/or answers, retained on an ongoing basis to match you against new vacancies.
• Telegram account ID, used to send you alerts and identify your account. We do not collect your phone number or Telegram contacts.
• Payment information, processed by Stripe, our payment provider. We do not store your full card details ourselves; Stripe shares back only what's needed to manage your subscription.
• Feedback, if you rate a job match (👍/👎) or reply to correct something, we store that rating/correction against your account to improve future matches.

3. Why we process your data, and our legal basis

Purpose	Legal basis
Creating and running your account, delivering job matches	Performance of a contract with you
Processing your CV/answers via AI to build and update your matching profile	Consent (given at sign-up)
Processing your payment and managing your subscription	Performance of a contract with you
Improving the Service based on aggregated usage and your feedback ratings	Legitimate interests
Security, fraud and abuse prevention	Legitimate interests

You can withdraw consent at any time by contacting us or deleting your account (/delete_me, see Section 8); this won't affect processing already carried out.

4. How AI is used, and what we actually do with your CV

We use OpenAI models via Azure OpenAI Service (part of Microsoft Foundry) to:

• Summarise your CV (if uploaded) and your stated answers into a structured profile;
• Compare new job vacancies against your profile to generate your personalised shortlist, daily.

This runs entirely inside Microsoft's own Azure environment. Per Microsoft's documentation, Azure OpenAI Service does not interact with any service operated by OpenAI itself (for example, the consumer ChatGPT product or OpenAI's own API) — prompts and completions are processed by Microsoft's infrastructure, and OpenAI, as the underlying model provider, has no access to your data. If our AI provider changes, this page will be updated first.

Your raw CV text is not stored in our database at all. If you upload a CV, it is used transiently, for the few seconds it takes to generate your structured profile summary, and is then discarded; only the short AI-generated summary (education, experience, key skills) is kept, so you and our support team can see what's on file without us retaining the source document. Our AI provider retains no persistent copy of your CV or profile data either.

Microsoft's abuse-monitoring system may, in narrow cases, sample flagged prompts/completions for automated (AI-based) review first, escalating to human review only when automated review isn't sufficient. Where human review does happen, Microsoft states that reviewers for services deployed in the European Economic Area are themselves located in the European Economic Area (see Section 6). We use the paid Azure OpenAI Service, not any free/consumer product: under Microsoft's terms, your prompts and completions are not used to train, retrain, or improve any AI model, and are not shared with other customers or with OpenAI. See Microsoft's Azure OpenAI data, privacy, and security documentation for the source this section summarises.

We do not sell or share your personal data with employers, recruiters, or any other third-party business. Your data is used only to generate matches for you.

5. Who else processes your data

Processor	Purpose
Microsoft Azure (Azure OpenAI Service)	CV/profile extraction and job matching, see Section 4
Telegram	Delivering your daily alerts and running the bot conversation
Microsoft Azure (hosting)	Hosting the Service and database (Sweden Central region), see Section 6
Stripe	Payment processing and subscription management
Cloudflare	Hosting this website (myjobby.co.uk)
Google (Analytics)	Website traffic measurement, only if you accept analytics cookies, see Section 10

6. International data transfers

Our hosting infrastructure (Microsoft Azure) runs in the Sweden Central region, within the European Economic Area. Our database and the underlying storage are encrypted at rest. As of 15 August 2026, our AI processing (Section 4) also runs on Azure OpenAI Service, deployed in the same Sweden Central region — both are now governed by the same Microsoft Products and Services Data Protection Addendum, rather than a separate arrangement per AI provider as before. Because AI processing now runs in the same EEA region as our hosting, this does not involve a transfer of your data outside the UK/EEA.

7. How long we keep your data

• Raw CV text: not stored, see Section 4.
• Profile summary, answers, and match history: retained while your account is active, and deleted immediately and permanently if you use /delete_me (see Section 8).
• Payment/billing records: retained as required for tax and accounting purposes (typically up to 6 years under UK law), even after account deletion, where we're legally required to keep them.
• System logs and fault records: kept for a limited operational period to diagnose problems, and are not used for any other purpose.

8. Your rights, including the right to erasure

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion ("right to be forgotten"), message /delete_me to the bot for immediate, self-service deletion (two-step confirmation, so nothing is deleted by accident). This permanently removes your profile, CV summary, stated preferences, match history, and feedback from our systems straight away. It does not automatically cancel an active Stripe subscription, cancel that separately via /manage if you don't want to keep being charged. You can also email us to request deletion instead;
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time;
• Complain to the ICO (ico.org.uk) if you believe we've mishandled your data.

To exercise any of these (other than /delete_me, which is instant), contact contact@myjobby.co.uk. We'll respond within one month.

9. Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, restricted access controls, and key-based (not password) server access, to protect your data. No system is 100% secure, but we take reasonable steps to minimise risk, including limiting how much raw personal data (like CVs) we retain in the first place.

10. Cookies and analytics

This website uses Google Analytics 4 to count visits and understand which pages people find useful. It is not used for advertising, and we do not sell or share the data.

Analytics cookies are not set unless you click "Accept" on the banner shown on your first visit. Until you choose, and if you choose "Decline", no analytics cookies are stored and no analytics data is sent. Your choice is remembered in your browser's local storage (jobby_consent_v1) and you can change it at any time by clearing your browser storage for this site, which makes the banner appear again.

Cookie	Purpose	Retention
_ga	Distinguishes returning visitors (Google Analytics)	2 years
_ga_<id>	Maintains analytics session state (Google Analytics)	2 years

Legal basis: consent (UK GDPR Art. 6(1)(a), and regulation 6 of the Privacy and Electronic Communications Regulations 2003). Google acts as our processor for this data; see Section 6 on international transfers, which applies here too.

We deliberately strip sensitive URL parameters, including Stripe payment identifiers and any email address, before any page address is sent to Google, so checkout details are never transmitted to analytics.

11. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy from time to time; material changes will be notified via Telegram or email. The "last updated" date at the top reflects the current version.

13. Contact us

contact@myjobby.co.uk, for any questions about this policy or how your data is handled.