Last updated: September 2026
We collect information you provide directly: name, email, location, employment history, education, skills, resume text, and career goals. We also collect usage data: which tools you use and when, application tracking entries you create, and roadmaps you generate. We do not collect payment information — this is handled directly by Stripe.
Your data is used solely to provide and improve JobSurf's services: generating personalized roadmaps, analyzing your resume, matching you with jobs, and understanding aggregate, anonymized usage patterns to improve the product. We never sell your personal data to third parties, and we do not use your individual profile data to train third-party AI models beyond the API calls needed to generate your own roadmap in the moment.
All data is transmitted over HTTPS. Data at rest is encrypted in our Supabase database. We implement row-level security so you can only access your own data, and administrative access to raw user data is restricted. We regularly review and update our security practices, but no online service can guarantee absolute security, and we cannot guarantee against every possible breach.
We use: Supabase (database and authentication), Stripe (payment processing — they never share your payment data with us), Vercel (hosting), OpenAI (AI generation — only the conversation and profile context needed to generate that response is sent, not a bulk export of your account), Resend (delivering account emails), Adzuna (job listings), and Google AdSense (advertising, shown to free-tier users only). Each has its own privacy policy governing how it separately handles data it processes on our behalf.
We retain your account data for as long as your account is active, so your roadmaps, tracker history, and profile remain available to you. If you request deletion, we delete your personal data within 30 days, except where retaining limited records (e.g. billing history) is required by law or for legitimate accounting purposes, in which case that residual data is kept only as long as legally necessary and is not used for any other purpose.
JobSurf operates from Canada, but several of our service providers (including Supabase, Vercel, and OpenAI infrastructure) may process or store data in the United States or other countries. By using the Service, you understand your data may be transferred to and processed in a country outside Canada, which may have different data protection laws than your own.
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to: access your personal information, correct inaccurate information, withdraw consent, and request deletion of your account and data. Account deletion requests will be processed within 30 days.
If you are located in the European Union or United Kingdom, you additionally have rights under the GDPR/UK GDPR, including the right to data portability, the right to restrict or object to certain processing, and the right to lodge a complaint with your local data protection authority. This is also why JobSurf shows a cookie consent choice to visitors detected as browsing from the EU/UK. Contact us at jobsurfsupport@gmail.com to exercise any of these rights, from any country.
Roadmap fit scores and pathway suggestions are generated automatically by an AI model based on the profile information you provide. This automated output is a suggestion, not a decision made about you with legal or similarly significant effect, and no automated decision on our part determines your access to the Service, your billing, or any real-world outcome.
JobSurf is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. Users between 13 and 18 must have parental or guardian consent to use the Service, consistent with our Terms of Service. If we learn we have collected information from a child under 13 without appropriate consent, we will delete it.
We use essential cookies for authentication (Supabase session management) and analytics (Vercel Analytics). No advertising cookies are used for Premium users. Free users may see AdSense cookies if ads are displayed, and visitors detected as browsing from the EU/UK are shown a consent choice before any non-essential cookie is set.
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will update the "Last updated" date above, and will notify users of material changes via email.
For privacy questions or data requests: jobsurfsupport@gmail.com