Privacy Policy

1. Data Controller

The data controller for your personal data is: Sylvain Querné (on behalf of JobMentis) Via Veneto 11, 20068, Peschiera Borromeo (MI), Italy VAT ID: 14107420961 Contact: support@jobmentis.com

2. Why We Collect Data

At JobMentis, our core philosophy is transparency and data minimization. We only collect the data we need to provide personalized, AI-assisted career coaching, CV optimization and job tracking. You should always know exactly what information we hold and how it is used to support your career.

3. Data Collection Summary

Here is a summary of the data we collect, why we collect it, and our legal basis for doing so:

• Account and identity: name, email address, profile picture, to create and manage your account, provide secure login and communicate updates. Legal basis: Contract.
• Professional profile and what you write: CVs, target roles, work history, skills, and the text you write or dictate in our tools (stories, answers, notes, interview practice), to analyze your applications and prepare your documents and coaching. Legal basis: Contract. See section 4 for the personal details this text can contain.
• App data (jobs): saved jobs, interview schedules and activity in the app, to provide the job tracking dashboard and coaching tools. Legal basis: Legitimate interest.
• Technical and usage data: IP address, browser type, device information and navigation patterns, to keep the site secure, analyze usage with product analytics and improve the platform. Legal basis: Consent and legitimate interest.
• Payment data: billing details and subscription status, to manage premium features. We do not store full card details. Legal basis: Contract.
• Imports of your job-search system: when you import what you built elsewhere (an export from ChatGPT or Claude, a document, or a workbook your coach prepares for you), we keep only the items you tick, in the same places as if you had typed them, and never your current salary. The pasted text and any file are not stored, and an import your coach prepares waits for your review. For every import we also record statistics that contain none of your content (how many items of each kind, which fields were filled, warning codes), linked to you only by a one-way code so they are deleted with your account, and kept 12 months. Legal basis: Contract for the import, Legitimate interest for the statistics. If you tick the option to share them, we also keep your search rules, preferences and notes with every name, past employer, email and link removed, for 12 months, to learn how people run their search. Legal basis: your consent, which you can withdraw in Account > Job search.
• Documents about your work (Evidence): a performance review, 360 feedback, project report, award or client testimonial that you choose to paste or upload, so that we can offer you what it says about your work to keep in your career record. An uploaded file is deleted as soon as it has been read. Until you have reviewed what we found, we keep a copy of its text with email addresses, links, phone numbers and personal-detail lines removed: it is deleted as soon as your review is finished, and after 7 days at the latest. After that we keep only the items you chose to keep; items you have not reviewed are deleted after 30 days. Pay, leave, health, improvement plans and other people's performance are never taken from it, and no item names another person. Legal basis: your consent, asked for the first time you use it and recorded with its version.
• Questions to Ask JobMentis: when you use Ask JobMentis, the guide inside the app, we keep each question you ask, the answer it gave, a topic label and how it went (whether you followed a link or rated the answer) for 90 days, to learn what people need and improve the answers. They are read only by the JobMentis team, never shown with your name, never shared with your coach, and deleted with your account. Legal basis: Legitimate interest.
• Connected calendars and contacts: if you connect Google or Microsoft (in Settings > Integrations, on the Calendar or from the contacts import), we read your calendar and contacts without ever changing them, keep only job-search events (title, times, meeting link), or every event if you choose to see all of them, and the contacts you choose to import, and store your access tokens encrypted. Disconnecting deletes everything imported. Legal basis: Contract, at your request.
• Daily check-ins from your coach: if your coach turns on the daily check-in, each evening we email you the day's numbers we already counted from your tracker and network, and keep what you send back: anything else you did, your answers to your coach's questions and, only if your coach asks and you choose to answer, how you feel on a scale of 1 to 5. How you feel is seen only by your own coach, never by their colleagues; it is never used by our AI and never appears in a summary. Check-ins are deleted after 12 months, and you can stop them in Account > Notifications. Legal basis: Contract; for how you feel, your consent, which you give by answering and can stop giving at any time.
• Your coaching group's board: if your coach runs a group (a cohort) and turns on its board, the other members see your weekly effort against your goals and your streak of active days, as "A member" unless you choose to show your first name and photo. They never see your tasks, applications, companies or notes. Legal basis: Contract; showing your name and photo is your choice, which you can change at any time on your cohort page.
• Consent records: a record of your consent choices (privacy, terms, marketing, the statement on personal details in section 4, and the Evidence statement) with a timestamp and the version you accepted. Legal basis: Legal obligation.

4. Personal Details We Never Ask For

Some personal data has special protection under Article 9 GDPR: health, disability, religion or belief, political opinions, trade union membership, racial or ethnic origin, sexual orientation and sex life. Other details, such as age, pregnancy, family situation, nationality or a photograph, are not in that list but can lead to discrimination in hiring. JobMentis never asks for any of them and offers no field for them. They can still reach us inside what you write: a CV that lists a union role or a parish, a story that explains a career break, an answer that mentions your health.

• What we do with them: we process them only as part of the document, answer or coaching you asked for, and store them with it. When you sign up, and once for existing accounts, we ask you to confirm that you understand this. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), recorded with the version of the statement you saw.
• What we never do: no feature infers, labels, stores or scores a protected characteristic, and our AI instructions forbid a model to comment on one unless you ask. We test this: CVs that differ only by such a detail must receive the same score and the same advice.
• A check before you send: the CV editor can point out details an employer may not ask about, so you can decide whether to keep them. The check runs in your browser, and nothing it finds is saved or sent to us.
• Kept out of what our tools share: date of birth, age, marital status, children and nationality lines are removed from the profile summary our AI features share with each other. The photo you add to your CV in our editor is never sent to an AI model; a photo printed inside a CV file you upload is read with the rest of the file.
• How long, and how to remove them: they are kept as long as the document that contains them. Delete the CV, story or answer, or your whole account, and they are deleted with it. Deleting them is also how you withdraw this consent; you can write to us as well.

How we use AI explains, feature by feature, what our AI sees and what it never sees.

5. Data Processors and Where They Are Based

To run the service, JobMentis relies on the following providers, acting as processors under Article 28 GDPR. The country in parentheses is where each provider is established; section 8 covers transfers outside the European Union.

• Vercel Inc. (United States), hosting and infrastructure.
• Supabase, Inc. (United States, databases hosted in the EU), managed PostgreSQL database.
• Google LLC (United States), sign-in (Firebase Authentication), document database (Firestore), file storage, and AI text processing with Gemini models on Vertex AI in the European Union. Under Google Cloud's terms, your prompts and the model's answers are not used to train Google's models.
• Anthropic PBC (United States), Claude models, used only when the Gemini models are unavailable. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models.
• OpenAI OpCo, LLC (United States), a further AI provider the platform can fall back to when it is configured. API data is not used to train its models by default.
• TypeSafe AI, Inc. (United States), the Jev model, which answers narrow questions about a text (yes or no, a choice, a score) and writes none: how well your CV shows a job's requirements, whether a job matches your search, how to tag a story or an interview answer. It receives the text each check needs: your CV, a job posting, your interview answers and stories and, for job matches, the goals and direction you wrote. For job matches your name and contact details are removed from the CV first. Under TypeSafe's terms, this data is not used to train its models.
• ElevenLabs, Inc. (United States), voice features: the First CV interview, mock interviews, networking rehearsal and Story Bank dictation. It runs speech recognition, the AI voice and the conversation, and keeps the transcript of each session.
• Stripe, Inc. (United States), secure payment processing and subscription management.
• Sendinblue SAS (Brevo) (France), transactional and marketing email, contact list management.
• Resend, Inc. (United States), transactional email.
• PostHog, Inc. (United States, data hosted in the EU), product analytics and session replay for signed-in users. Form fields are masked, and our privacy check on CVs is excluded from recording.
• Inngest, Inc. (United States), background job orchestration (notifications, scheduled maintenance, AI processing queues).
• Meta Platforms Ireland Ltd. (Ireland), advertising measurement and audience building through the Meta Pixel and Conversions API. Loaded only after you accept cookies; personal identifiers (email, name) are SHA-256 hashed before transmission. Configurable per tenant.
• Your coach's tools: if you work with a coach, their meeting, scheduling and survey tools (such as Calendly, Grain, Granola, Fireflies, Fathom, SpeakApp or Tally) process your data on your coach's instructions, not ours. Your coach decides which of them to use.

Credits: place names in location fields come from GeoNames, licensed under CC BY 4.0. A place GeoNames does not list is looked up with Photon by komoot, using map data © OpenStreetMap contributors, available under the Open Database License; only the text typed in the field is sent, from our servers. Company logos are provided by Logo.dev.

6. Google User Data and Limited Use

JobMentis lets you sign in with Google and lets coaches connect their Google Calendar. When you use these features, we access a limited set of data from Google APIs ("Google user data"):

• Sign in with Google (Google OAuth through Firebase Authentication): your name, email address and profile picture, used only to create, secure and authenticate your account.
• Google Calendar (read-only, calendar.readonly scope): when a coach connects their Google Calendar, we read events from their primary calendar over a rolling 7-day window (today plus the next six days). For each event we read the title, the start and end times, the attendee list (email addresses and attendee count) and the event's Google Calendar link. Attendee email addresses are compared with that coach's own active client list for the sole purpose of labeling which upcoming session belongs to which client. The agenda is shown only to the coach whose account is connected. We never write to, modify or delete calendar entries.
• Google Calendar retention: calendar events are fetched fresh from Google each time the coach loads their dashboard and are never stored in our databases, logs or backups. The only Google Calendar data we keep is the OAuth refresh token, encrypted at rest, which a coach can revoke at any time by disconnecting the integration in JobMentis or by removing access under their Google Account permissions.
• Your Google Calendar (read-only, calendar.events.readonly scope): if you connect your calendar (in Settings > Integrations or on the Calendar), we read the events on your primary calendar from 30 days ago to 60 days ahead. Unless you choose to see all your events, we keep only events related to your job search: those with a person from your network or your coach among the attendees, or with an interview or networking keyword in the title or location. For those we store the title, the times, the meeting link and which of your contacts or applications they match. We never store an event's description or the email addresses of other attendees, and every other event is discarded without being stored. If you choose to see all your events, we store the title, the times and the meeting link of every event in that window instead, and delete those not related to your job search as soon as you switch back. Disconnecting deletes everything imported and revokes our access at Google.
• Your Google Contacts (read-only, contacts.readonly scope): if you turn on Contacts, we read your contacts only while you are choosing people to import, and we store only the people you tick, as contacts in your network tracker.
• How we use it: Google user data is used only to provide and improve these user-facing features. We do not use it for advertising, we do not sell it, we do not transfer it to data brokers or information resellers, and we do not use it to determine creditworthiness. No Google user data is ever used to train AI models. Google Calendar data is never sent to our AI providers: it is read from Google, shown to the coach and discarded.
• Human access: no JobMentis employee or contractor reads your Google user data. Access is limited to the automated processes that run the feature you enabled, except where you explicitly ask us to (for example, to debug a problem you reported), where it is necessary for security purposes such as investigating abuse, or where the law requires it.
• Who we share it with: we do not share, transfer or disclose your Google user data to third parties, except: (a) to the infrastructure sub-processors that host our platform (Google Cloud / Firebase), strictly to run the feature you requested; (b) when you explicitly direct or consent to the sharing; (c) where required by applicable law or a valid legal request; or (d) as part of a merger, acquisition or sale of assets, in which case this Privacy Policy continues to govern the data.

JobMentis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Advertising and Conversion Tracking

On tenants that have enabled it, JobMentis loads the Meta Pixel (Facebook Pixel) and sends server-to-server events through Meta's Conversions API to measure advertising campaigns and build retargeting audiences.

• What is sent: page-view events (which pages you visit) and conversion events for sign-up (CompleteRegistration), purchase (Purchase) and lead-form completion (Lead). Conversion events include your email and, where available, your name and IP address and user agent, only as SHA-256 hashes, never in plain text.
• When it loads: only after you click "Accept" on the cookie banner. If you decline, neither the pixel nor the Conversions API fires.
• Retention: Meta keeps advertising event data for up to 180 days under its own policies. Transmission stops immediately if the tenant disables Meta tracking in the admin settings.
• Opt-out: withdraw cookie consent at any time through the cookie banner; you can also use Meta's Ad Settings or contact Meta through its privacy portal for data deletion requests.

8. International Transfers

Some of our providers are based in the United States or other regions outside the European Union. Transfers to these countries rely on the EU-U.S. Data Privacy Framework (DPF) or on Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure an adequate level of protection for your personal data. Our AI text processing runs on Google's infrastructure in the European Union; the fallback providers and the voice provider are in the United States.

9. Automated Decision-Making and AI

Our platform uses artificial intelligence to analyze CVs, draft documents and run interview practice. These are decision-support tools for you. Nothing here decides anything about you: no employer receives a score from us, and every document is yours to edit before it goes anywhere. We do not carry out automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR). Our AI is instructed never to infer or take into account your health, disability, religion, political opinions, union membership, ethnic origin, sexual orientation, age, pregnancy, family situation or nationality. Voice and chat assistants say they are AI at the start of every conversation, and PDF and Word files created with AI carry an invisible "AI-assisted" tag in their metadata. AI apps you connect: if you connect your own AI assistant (for example Claude, ChatGPT or Cursor) to JobMentis, it reads and changes your JobMentis data only when you ask it to, within what you allowed on the consent screen (read only, or read and write). What it reads is sent to that app, which is run by its own provider under its own privacy policy, not by JobMentis. Changes to your career history wait for you on the review screen. You can disconnect an app at any time in Account > Connected AI apps; we keep which app you connected, what you allowed and when it was last used until you disconnect it or delete your account. Company facts and links you save: if you or an AI app you connect save a public fact about an employer (such as its size or headquarters) or a link to a public article, with the address of its source, we may show that fact or link to other JobMentis users once we have read the page ourselves or a second person has saved the same thing. A fact you save with our browser extension from the employer’s own LinkedIn company page can be shown after that one save, because that page cannot be read from our side and we rely on what the extension read; its description never is. They see the fact or link and its source, never your name, your notes or which job you were looking at. We keep a record of who saved what only to count distinct people. You can stop this and withdraw what you shared in Account > Preferences; deleting the note or your account withdraws it too. Notes and anything without a public source are never shared.

How we use AI lists the models we use, where they run, and what each feature sends them.

10. Data Security

We apply technical and organizational measures to protect your data, including SSL/TLS encryption for all data in transit, PostgreSQL Row-Level Security (RLS) policies to enforce isolation between tenants, and regular security reviews of our infrastructure. Every consent event is logged with the exact policy version accepted, so there is a complete audit trail.

11. The JobMentis Browser Extension

JobMentis offers a browser extension for Chrome. It works in a side panel next to the page you are reading and only ever reads the page you have open. This section sets out what it reads, what it sends to us and what stays in your browser.

12. The Coach Directory

JobMentis publishes a public directory of career coaches at jobmentis.com/coaches/directory. Most listings in it began as a professional listing we compiled, not an account somebody opened, so this section sets out how that works. It applies to coaches listed in the directory; it does not describe how we handle the data of people using the platform to look for work.

13. Your Rights

Under the GDPR, you have the right to:

• Access: access your data and receive a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: delete your data (the "right to be forgotten"). An automated deletion service driven by a single inventory of every place we store your data removes it from our databases, file storage and external services on request.
• Restriction or objection: restrict or object to the processing of your data.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent: at any time, from your account settings, or for the personal details in section 4 by deleting the content that holds them.

To exercise your rights or ask any question about your privacy, contact us at support@jobmentis.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your country of residence.