Back to home

Data Processing Agreement

Last updated: April 2026

1. Introduction

This Data Processing Agreement ("DPA") is entered into between Jobsy (the "Processor") and the customer using Jobsy (the "Controller") to the extent applicable data protection law, including the GDPR, requires such an agreement.

2. Scope

This DPA applies when you use Jobsy to process personal data, including:

  • Resume or CV content
  • Employment history and achievement data
  • Interview preparation content
  • Job descriptions and application materials
  • Any personal data you submit for analysis or generation

3. Roles and Responsibilities

You as Controller

  • Determine the lawful basis and purpose for processing
  • Provide any required notices to data subjects
  • Ensure you have permission to submit the data you process in Jobsy
  • Handle data-subject requests where required by law

Jobsy as Processor

  • Process personal data only to provide the service
  • Apply reasonable technical and organizational safeguards
  • Use subprocessors as needed to operate the service
  • Assist with deletion or export where available

4. Processing Instructions

You instruct Jobsy to process personal data for the limited purposes of:

  • Storing your workspace content
  • Generating resumes, cover letters, and interview materials
  • Analyzing career evidence and job-fit information
  • Supporting backups, reliability, and operational monitoring

5. Subprocessors

Jobsy may use subprocessors such as:

  • Supabase for database, auth, and storage
  • OpenAI for AI generation and analysis
  • Cloudflare for hosting and infrastructure delivery

6. Security Measures

Jobsy uses measures designed to protect personal data, including:

  • Encrypted transport over HTTPS
  • Authenticated access controls
  • Use of managed infrastructure and storage providers
  • Operational monitoring and error tracking

7. Data Subject Rights

To the extent required by law and reasonably possible within the service, Jobsy will assist the Controller with requests related to access, correction, deletion, restriction, and export.

8. Breach Notification

If Jobsy becomes aware of a confirmed personal data breach affecting data processed under this DPA, Jobsy will provide notice without undue delay, taking into account the information reasonably available at the time.

9. International Transfers

Personal data may be processed outside the jurisdiction in which it was collected, including in the United States. Where applicable, transfers are made using lawful mechanisms reasonably available to Jobsy and its providers.

10. Retention and Deletion

Jobsy retains data for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account and associated data subject to technical and legal constraints.