Privacy Policy - Jobago

Plain English note: This policy explains what data we collect, why we collect it, who we share it with, and your rights. We do not sell your personal data. Ever. If you have any questions, email privacy@jobago.ai.

1. Who We Are Jobago Ltd ("Jobago", "we", "us") is the data controller responsible for your personal data. We are registered in England and Wales. Contact us about data and privacy at: privacy@jobago.ai

2. Who This Policy Covers This policy applies to all users of the Jobago platform, whether you access it directly or through an employer (current, former or prospective) or an authorized reseller. It covers personal data collected through our website (jobago.ai) and our application (app.jobago.ai). Our services are not directed to individuals under 18. If you are under 18, please do not use the Platform. If you believe a child under 18 has provided us with personal data, please contact us at privacy@jobago.ai and we will delete it.

3. What Data We Collect 3.1 Data you give us directly Account information Your email address and password when you register. CV / resume content The CV or resume you upload to the Platform, including employment history, qualifications, skills, and any other information you choose to include. AI conversation content The questions you ask and responses you receive through our AI career coach. This may include career goals, salary expectations, and job search information. Job application data Jobs you search for, save, or apply to through the Platform. Communications Emails or messages you send to our support team.

3.2 Data we collect automatically Usage data Pages and features you use, time and date of access, and how you navigate the Platform. Device and browser data Browser type and version, operating system, screen resolution, and IP address. Log data Server logs recording access times, features used, and error reports. Cookies See Section 7 (Cookies) below.

3.3 Data from third parties If you choose to connect a LinkedIn, Google, or other social media account, we may receive basic profile information (such as your name and email) in accordance with your settings on that service.

4. Why We Use Your Data and Our Legal Basis To provide the Platform and its features Legal basis: Performance of contract. We need this to deliver the service you have requested. To personalize your experience (e.g. tailored job suggestions, AI responses based on your CV) Legal basis: Legitimate interests (to provide a more useful service to you). To communicate with you about your account, security, and service changes Legal basis: Performance of contract / Legitimate interests. To send you marketing emails about Jobago features and updates Legal basis: Consent. You can withdraw consent at any time by clicking "unsubscribe" in any marketing email or emailing privacy@jobago.ai. To improve and develop the Platform using anonymized and aggregated analytics Legal basis: Legitimate interests (to improve our product). We use Google Analytics, Mixpanel and Microsoft Clarity for this purpose. To comply with legal obligations (e.g. responding to court orders or regulatory requests) Legal basis: Legal obligation.

We do not sell your personal data to third parties. We do not share your personal data with third parties for their own marketing purposes.

5. Who We Share Your Data With We share personal data only with the following categories of recipients:

5.1 Sub-processors (service providers who process data on our behalf) We use the following sub-processors. All are contractually required to process data only on our instructions and to maintain appropriate security measures. • Microsoft Azure — Cloud hosting and infrastructure. Location: UK region. Transfer basis: UK data center, no international transfer. • Microsoft / OpenAI — AI features (career coach, CV optimization, interview prep). Location: USA. Transfer basis: UK-US International Data Transfer Agreement (IDTA) / SCCs; data processed under OpenAI's Data Processing Agreement. • Google Analytics — Platform usage analytics (anonymized). Location: USA. Transfer basis: UK-US IDTA; Google Analytics data is anonymized before transfer. • Mixpanel — Product analytics: feature usage, event tracking, and user behavior data. Location: USA. Transfer basis: UK-US IDTA / SCCs via Mixpanel DPA (mixpanel.com/legal/dpa). • Microsoft Clarity — Session recording, heatmaps, and user interaction analytics; configured to mask sensitive fields including CV content, salary inputs, and the AI chat interface. Location: USA. Transfer basis: UK-US IDTA / SCCs via Microsoft Data Processing Addendum.

5.2 Other disclosures We may also share your personal data: • With professional advisers (lawyers, accountants) who are bound by confidentiality obligations; • With law enforcement or regulatory bodies where required by law; • In the event of a merger, acquisition, or sale of Jobago — in which case the new owner will be required to honor this Privacy Policy. We will notify you by email of any such change.

6. International Data Transfers Jobago is based in the UK. Some of our sub-processors are located outside the UK and EEA (see Section 5.1 above). Where we transfer personal data internationally, we ensure that appropriate safeguards are in place: Transfers to the USA (Microsoft/OpenAI, Google Analytics, Mixpanel, Microsoft Clarity): covered by the UK International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses.

7. Cookies What are cookies? Cookies are small text files stored on your device when you visit a website. They help us recognize you, remember your preferences, and understand how the Platform is used. What cookies do we use? Essential cookies Required for the Platform to function. Cannot be disabled. Examples: keeping you logged in, security tokens. Analytics cookies (Google Analytics) Help us understand how users navigate the Platform so we can improve it. Data is anonymized. You can opt out at tools.google.com/dlpage/gaoptout. Preference cookies Remember your settings and preferences between sessions.

We do not use advertising or behavioral tracking cookies. Managing cookies You can control cookies through your browser settings. Disabling essential cookies may affect Platform functionality. You can also set your cookie preferences when you first visit the Platform.

8. Data Retention We keep your personal data only for as long as is necessary. Our retention periods are: Account data (email, login) Retained while your account is active, plus 12 months after closure. CV / resume content Retained while your account is active. Deleted within 180 days of account closure or erasure request. AI conversation transcripts Retained for 30 days from the chat date. Deleted automatically after 30 days. Job application history Retained while your account is active. Deleted within 180 days of account closure. Usage and analytics data Anonymized after 14 months (Google Analytics default). Anonymized data may be retained indefinitely. Financial / payment data Retained for 7 years as required by UK tax law. Payment card details are not stored by Jobago — see Section 5.1. Support communications Retained for 2 years from the date of your last communication with our support team.

We may retain data for longer if required by law or to defend a legal claim.

9. Your Rights Depending on where you live, you have the following rights over your personal data. To exercise any of these rights, email privacy@jobago.ai. We will respond within 30 days. Right to access Request a copy of the personal data we hold about you. Right to rectification Ask us to correct inaccurate or incomplete data. Right to erasure ("right to be forgotten") Ask us to delete your personal data. We will comply unless we have a legal obligation to retain it. Right to restriction Ask us to limit how we process your data while a complaint is being resolved. Right to portability Receive your data in a structured, machine-readable format. Right to object Object to processing based on legitimate interests, including for direct marketing. Right to withdraw consent Where processing is based on consent (e.g. marketing emails), withdraw consent at any time. This does not affect processing that already occurred.

These rights are not absolute and may be subject to legal exceptions. We will always explain if we cannot fulfill a request. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant bodies in your jurisdiction.

10. Security We take reasonable and appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. These include encryption in transit and at rest, access controls, and regular security reviews. No method of internet transmission is 100% secure. If you suspect your account has been compromised, contact us immediately at privacy@jobago.ai.

11. UK and EEA Residents If you are in the UK or EEA, the data protection laws that apply to Jobago include the UK GDPR, the Data Protection Act 2018, and (where applicable) the EU GDPR. The legal bases for our processing are set out in Section 4. The supervisory authority for Jobago is the UK Information Commissioner's Office (ICO).

12. California Residents (CCPA / CPRA) If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA): • Right to know: You can request details of the categories and specific pieces of personal information we have collected about you in the preceding 12 months. • Right to delete: You can request deletion of your personal information, subject to legal exceptions. • Right to correct: You can request correction of inaccurate personal information. • Right to opt out of sale or sharing: We do not sell or share personal information for cross-context behavioral advertising. • Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of personal information collected in the preceding 12 months: Identifiers (name, email); professional or employment-related information (CV / resume content); internet activity information (usage data); and inferences drawn from the above (personalized recommendations). To exercise your California rights, email privacy@jobago.ai. We will verify your identity before processing your request. You may also submit requests through an authorized agent with written proof of authorisation.

13. Changes to This Policy If we make material changes to this Privacy Policy, we will notify you by email at least 30 days before the changes take effect, and update the "Last updated" date at the top of this page. For minor changes (such as clarifications that do not affect how we process your data), we will update the policy without advance notice.

14. Contact Us For all privacy and data protection enquiries: • Email: privacy@jobago.ai • ICO complaint: ico.org.uk/make-a-complaint

This Privacy Policy is governed by the laws of England and Wales.