Privacy policy.

1. Who we are.

Jobo AI LLC, a Wyoming limited liability company ("Jobo", "we", "us") provides job data infrastructure through APIs and data delivery tools. This policy describes what personal data we handle, why, and the choices you have. For questions, contact support@jobo.world.

2. Information we collect.

Account information

When you register we collect your name, email address, and optionally a company name. We use this to operate your account, send service notices, and provide support.

Billing information

Payments are processed by Stripe. Jobo does not store your card number; we receive from Stripe only what is needed to manage your subscription and wallet, such as payment status and the card's last four digits.

API request logs

We log API requests — endpoint, timestamp, response status, and key identifier — for metering, debugging, and abuse prevention. Request logs are retained for 30 days.

API key addresses

To protect your account, we record each IP address your API keys are used from (IPv6 addresses by network block), the approximate country derived from it, the client's user agent, and when the address was first and last seen. When a key is used from an address it has not used before, we email the account owner the key's name, the address, its approximate country, the client, and the time, so you can rotate the key if the use was not yours. These security notices cannot be turned off. We also use these records to investigate suspected misuse of a key and to resolve disputes about your account, usage, or payments. We do this on the basis of our legitimate interest in keeping accounts and API keys secure and in establishing, exercising, or defending legal claims, and we use these records for nothing else.

Sign-in and dashboard activity

When a sign-in needs a second step, and when you ask us to remember a browser, we record the IP address, approximate country, and browser user agent used. When you sign in from a browser we do not recognize, we email you the device, approximate location, IP address, and time. When you use the dashboard, we record the pages you open, when, and the IP address and approximate country you used. We use these records to keep your account secure, to support you, and to investigate suspected misuse and disputes about your account, usage, or payments, on the basis of our legitimate interest in doing so.

Website and API traffic logs

Our web servers log each request to our websites and API: the IP address, the page or endpoint requested, the time, the response status, the referring page, and the browser or client user agent, with access tokens in links masked. We use these logs for security and troubleshooting and delete them after 30 days.

Acceptance records

When you accept our terms and policies — at signup, when we ask you to accept an updated version, or when your business accepts the Auto Apply agreements — we record your account, the versions accepted and their cryptographic hashes, the wording you agreed to, the date and time, your IP address, approximate country, and browser user agent. We use this record only to prove what was accepted and when.

Sales outreach

We may email businesses about Jobo using business contact details they publish on their own websites, such as a company address or the address of a named founder or product lead. We do this on the basis of our legitimate interest in offering Jobo to businesses that could use it. Every such email tells you how to opt out; when you do, we add your address or domain to a suppression list so we do not email you again.

Support communications

Messages you send us by email or WhatsApp are kept as long as needed to resolve your request and maintain a support history. Our contact button opens WhatsApp, where you can choose to send a message. Your Jobo account details are not automatically shared with WhatsApp.

Auto Apply access requests

To review requests for live Auto Apply, we collect legal business identity, establishment country, intended candidate and employer markets, privacy/incident contact, controller or processor role and any upstream controller, intended use, privacy notice URL, and either blank candidate approval wording or a synthetic demonstration URL. Business website and estimated volume are optional. Do not submit candidate personal data or signed candidate consent records in this review. The Auto Apply Data Processing Agreement, which your business reads and accepts in the dashboard when it requests Auto Apply access, describes candidate-data processing, including the supplier functions, retention, responsibilities and transfer obligations in its complete annexes.

3. Cookies.

We do not use advertising or third-party analytics cookies. The WhatsApp contact card does not load an embedded messenger or set support cookies. WhatsApp opens only when you follow a contact link.

The customer dashboard uses cookies required for authentication and security. When you open WhatsApp, its own privacy and cookie policies apply.

4. People in public job and company data.

This section is for people who appear in the job listings and company profiles our APIs deliver, even though they have never used Jobo.

Where it comes from

We collect job listings and company information from publicly available sources — employers' career pages, applicant tracking system job boards, company websites, public business registries and knowledge bases, and publicly available search results — and from business information licensed or obtained from third-party data providers. We use automated tools, including AI models, to extract, normalize, and summarize this information.

What it includes

Mostly job and company information. It can include personal data where a source publishes it: the names, job titles, and roles of company leadership, and the names or business contact details of recruiters or hiring managers named in a listing. We do not collect sensitive categories of personal data on purpose.

Why we use it and our legal basis

We use it to build a searchable index of job openings and employers and to license that index to business customers who run job boards, career sites, recruiting tools, and similar products. Where the GDPR or UK GDPR applies, our legal basis is our legitimate interests and those of our customers and job seekers in making public job information easier to find (Article 6(1)(f)). You can object at any time.

Who receives it

Our business customers, under a license that makes them responsible for their own compliance with privacy law, forbids using the data as a consumer report or for marketing to individuals without a lawful basis and compliance with marketing laws, and requires them to delete records when we notify them of a removal. Under California law, licensing this information to customers may be a "sale" of personal information; you can opt out of it as described under Your choices. Data is processed in the United States and in other countries where we or our service providers operate.

How long we keep it

Listings are kept while live and afterwards as historical records of the job market, and company profiles until they are refreshed or removed. When you ask us to remove a record, we delete or disable it and take reasonable steps, where feasible, to avoid collecting it again.

Your choices

You can ask for access to, correction of, or removal of a record about you, object to our processing, or opt out of its sale or disclosure to our customers, by following our Data removal policy or emailing support@jobo.world. Customers who received the data are required by our Terms and conditions to remove it from their copies after we notify them.

5. Auto Apply candidate data.

When a customer uses Auto Apply, we submit job applications on the customer's instructions using candidate information the customer provides, such as contact details, resumes, and answers to application questions. For this data we act as the customer's service provider (processor); the customer is the controller and is responsible for obtaining the candidate's authorization and giving any required notices. The customer decides which answers are submitted, including any answers generated by the customer's own AI systems; Jobo does not write or verify them. We use candidate data only to perform the customer's requests, and we delete it as the customer instructs or when we no longer need it to provide the service. Candidates should direct requests about their data to the customer they signed up with; we will help that customer respond.

Candidate details and answers are encrypted at rest. Completed applications and their answers are normally retained for 180 days after submission, failure, or cancellation, unless the customer instructs earlier deletion or applicable law requires retention. To troubleshoot failed applications we keep an encrypted record of what each application sent to and received from the employer's system for 30 days. If a customer connects a mailbox so Auto Apply can read verification codes, we store its access credential encrypted and read it only to find verification or confirmation emails for applications the customer started.

6. How we share information.

We share personal data with the service providers needed to run Jobo: Stripe for payments; and infrastructure, content delivery, AI, and email providers for hosting, processing, and communications. These providers process data on our behalf. Auto Apply applications go to the employer's applicant tracking system the customer chose, through a residential proxy and CAPTCHA-solving provider (2Captcha) so they reach it reliably; when an answer has to match a list the employer's form offers, such as a school or a location, that answer and the options may be sent through OpenRouter to a model provider to generate equivalent search terms or pick the match. The DPA’s provider register describes Hetzner hosting, Cloudflare traffic/security and encrypted backup storage, 2Captcha proxy/CAPTCHA services, and OpenRouter AI routing. AI mailbox verification can process relevant verification or confirmation messages. The register distinguishes published supplier information from account-specific arrangements that need supporting evidence. Public job and company data is licensed to customers as described in Section 4. We do not share personal data with third parties for their own marketing.

If you contact us through WhatsApp, your use of that service is covered by WhatsApp’s privacy policy.

7. Data retention.

API request logs are retained for 30 days. API key addresses (Section 2) stay in our live systems until an address has gone 90 days without use, or until your account is deleted. Addresses that reach 90 days are moved, with the account email and key identifier they belong to, to a private archive that we keep as long as needed to establish, exercise, or defend legal claims, such as payment disputes, including after your account is deleted. Sign-in records and the IP address on dashboard page views (Section 2) are moved to the same archive 90 days after they were made (for a remembered browser, 90 days after it expired or was revoked); the page view itself, without the IP address, stays with your account. Website and API traffic logs are deleted after 30 days. Finished Auto Apply applications are deleted 180 days after they finish, and the encrypted record of what they sent after 30 days; deleting an account deletes its Auto Apply applications and connected mailboxes. After account termination, account data is retained for up to 90 days for legal and operational purposes before permanent deletion, consistent with our Terms and conditions. Billing records are kept as long as tax and accounting laws require. Acceptance records (Section 2) are kept as long as needed to establish, exercise, or defend legal claims, including after your account is deleted. Retention of public job and company data is described in Section 4.

The Auto Apply Data Processing Agreement sets separate periods for minimized business agreement and review evidence: unsuccessful onboarding material is erased after 12 months and contract evidence six years after the relationship ends, subject to controlled legal holds or approved exceptional erasure. Those records document business authorization and contract acceptance; their retention does not extend the retention of candidate applications or authorize storing candidate consent documents with onboarding evidence. Documented legal duties or disputes may require limited retention of relevant records, with access restricted and necessity reviewed.

8. Your rights.

You may request access to, correction of, deletion, restriction, or a portable copy of your personal data at any time, or object to our processing of it, by contacting support@jobo.world. We aim to respond within one month, or within 45 days for requests under California law. Depending on where you live, you may have additional rights under laws such as the GDPR, the UK GDPR, or U.S. state privacy laws such as the CCPA, including the right to know what we hold, to delete it, and to opt out of its disclosure to our customers. We honor valid requests regardless of jurisdiction, will not discriminate against you for making one, and may need to verify your identity first. If you are in the EEA or UK, you may also complain to your local data protection authority.

9. Changes to this policy.

We may update this policy as the Services evolve. Material changes will be communicated via email or a prominent notice on the platform at least 30 days before taking effect. The version and effective date of this policy are shown with it.

10. Contact.

Privacy questions and requests: support@jobo.world.

Jobo AI LLC
30 N Gould St, STE R
Sheridan, WY 82801
United States

Wyoming filing number: 2026-002091131.