Privacy Policy

Your Privacy Matters

At nuJOB.ai, we are committed to protecting your personal data in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable EU member state legislation. This policy explains what we collect, how we use it, the legal bases for processing, and the rights you hold over your data.

1. Data Controller

This website is operated by: nuJOB.ai, 131 Continental Dr., Suite 305, Newark, DE 19713, USA. Email: [email protected]

For purposes of the GDPR, nuJOB.ai acts as the data controller. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our EU representative can be contacted at [email protected].

2. What Personal Data We Collect

• Email address (required — for login, alerts, and support)
• Phone number (optional — for recruiter contact)
• Location data: country, state, city (optional — for job matching)
• Resume data: skills, work history, education, certifications
• Profile photo (optional — for recruiter identity verification)
• Assessment data: responses, scores, completion times, confidence ratings
• IP address, browser type, device identifiers, and access timestamps (collected automatically)
• Cookies and session identifiers

If you use nuJOB.ai as a recruiter or hiring organisation, we also collect:

• Account details (name, work email, job title, profile photo)
• Company details (name, address, size, verification documents)
• Team member information you invite and manage
• Job postings, assessments, interview questions, and notes you create
• Candidate evaluations, ratings, and hiring-pipeline activity
• Billing and subscription information
• IP address and browser metadata

We do not collect special category data (e.g., racial or ethnic origin, political opinions, health data) unless you voluntarily include such information in your resume.

3. Lawful Basis for Processing (GDPR Art. 6)

• Consent (Art. 6(1)(a)) — when you sign up, submit your resume, or upload a profile photo. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal
• Performance of a contract (Art. 6(1)(b)) — to deliver AI-based job-matching, assessment, and recruitment services you have requested
• Legitimate interest (Art. 6(1)(f)) — to improve our AI models using anonymized and aggregated data, prevent fraud and abuse, and ensure platform security. We have conducted a Legitimate Interest Assessment (LIA) for these purposes
• Legal obligation (Art. 6(1)(c)) — where required by applicable law, such as tax or regulatory reporting

4. How We Use Your Data

• To match you with relevant job opportunities (legal basis: contract)
• To conduct and score AI-powered assessments (legal basis: contract)
• To communicate with you about your account, submissions, or assessment results (legal basis: contract)
• To improve platform features and AI accuracy using anonymized and aggregated analytics (legal basis: legitimate interest)
• To monitor for fraud, abuse, or unauthorized access (legal basis: legitimate interest)
• To comply with legal obligations such as tax reporting or regulatory requests (legal basis: legal obligation)

For recruiters and hiring organisations, we also use your data to:

• Operate your hiring workflows — job postings, assessments, and candidate pipelines
• Generate AI-assisted candidate scoring, assessment analysis, and recommendations for your review
• Manage your account, team, billing, and support requests
• Improve platform features using anonymised analytics
• Monitor for fraud, abuse, or security threats

5. Cookies & Tracking

Which cookies we use depends on where you are. Our product portals (candidate, recruiter, and interview) use strictly necessary cookies only. Our marketing site at nujob.ai also uses optional analytics cookies, and only if you allow them.

• Strictly necessary cookies — required for core functionality such as authentication, session management, and remembering your privacy choices. These cannot be disabled.
• Analytics cookies (nujob.ai only) — Google Analytics, used to understand which pages people visit so we can improve them. These are never set until you accept them, and you can change or withdraw that choice at any time through “Cookie Settings” in the site footer.

• candidateId — identifies your account during a session
• jwt — authentication token that keeps you signed in
• csrftoken — protects against cross-site request forgery
• privacyAccepted — remembers that you've accepted this privacy policy
• isEu — remembers whether you're in the EU so we can show the right consent experience
• regEmail — short-lived token used during account registration to verify your email

Disabling these cookies in your browser may prevent the site from working correctly, including signing in and maintaining your session.

6. AI & Automated Decision-Making (GDPR Art. 22)

nuJOB.ai uses artificial intelligence to analyze your resume, conduct assessments, generate candidate scores, and suggest job matches. These processes involve automated decision-making and profiling as defined under GDPR Article 22.

How it works: Our AI models process your resume text, assessment responses, and behavioral signals (such as completion time and confidence ratings) to generate a composite score. This score may influence which job opportunities are surfaced to you and how recruiters view your profile.

Your rights: You have the right to (a) obtain meaningful information about the logic involved in automated processing, (b) express your point of view and contest the decision, and (c) request human review of any automated decision that significantly affects you. To exercise these rights, contact [email protected].

Safeguards: We regularly audit our AI systems for bias. No automated decision is used as the sole basis for rejecting a candidate from a position — recruiters always retain final discretion.

7. Data Retention Policy

• Active account data: retained for the duration of your account plus 30 days after deletion request
• Inactive accounts: data is deleted after 12 months of inactivity, with a 30-day notice sent before deletion
• Assessment results: retained for 24 months to support ongoing job matching, then anonymized
• Analytics and log data: anonymized after 90 days
• Backup copies: purged within 30 days of the primary data deletion

You may request earlier deletion of your data at any time (see Section 8).

8. Your Rights Under the GDPR

• Right of access (Art. 15) — obtain a copy of your personal data and information about how it is processed
• Right to rectification (Art. 16) — correct inaccurate or incomplete personal data
• Right to erasure (Art. 17) — request deletion of your personal data ('right to be forgotten')
• Right to restrict processing (Art. 18) — limit how we process your data in certain circumstances
• Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format (JSON or CSV) and transmit it to another controller
• Right to object (Art. 21) — object to processing based on legitimate interest, including profiling
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint — you have the right to lodge a complaint with your local Data Protection Authority (DPA). A list of EU DPAs is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en

We will respond to all data rights requests within 30 days. In complex cases, this may be extended by a further 60 days, and we will inform you of any such extension.

If you are unsatisfied with our response to a privacy concern, you have the right to lodge a complaint with your local Data Protection Authority.

9. International Data Transfers

nuJOB.ai is based in the United States. If you are located in the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the United States. We protect these transfers using the following safeguards:

• EU-U.S. Data Privacy Framework (DPF) — where applicable, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework
• Standard Contractual Clauses (SCCs) — we use the European Commission's approved Standard Contractual Clauses (2021/914) with all sub-processors to ensure adequate protection
• Supplementary measures — including encryption in transit and at rest, access controls, and regular security assessments

You may request a copy of the SCCs we use by contacting [email protected].

10. Third-Party Data Processors (Sub-Processors)

We share data only with GDPR-compliant sub-processors bound by Data Processing Agreements (DPAs) that include Standard Contractual Clauses where required. We conduct due diligence on all sub-processors before engagement.

• AI & Interview Analysis — third-party AI services used to process and score assessments (data is pseudonymized before transfer where possible)
• Payment Processing — PCI-DSS compliant payment processors for subscription billing (we do not store card details)
• Cloud Hosting & Infrastructure — ISO 27001 certified hosting providers for platform operation and data storage
• Email & Communications — transactional email services for account notifications and alerts

We share data only with trusted service providers necessary to deliver our services. All providers are bound by data processing agreements and are vetted for appropriate security practices.

11. Data Security (GDPR Art. 32)

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls with least-privilege principles
• Multi-factor authentication for administrative access
• Regular penetration testing and vulnerability scans
• Pseudonymization and data minimization by design
• Automated backup with encrypted off-site storage
• Incident response plan with defined escalation procedures

12. Consent Mechanism

Where consent is the legal basis, we collect it through clear, affirmative opt-in actions (not pre-ticked boxes) during registration and data uploads. Consent is granular — you may consent to some processing activities and not others. You can withdraw consent at any time by updating your privacy settings in your account profile or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

13. Children's Data

nuJOB.ai is not intended for use by individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will delete it promptly. If you believe a child has provided us with personal data, please contact [email protected].

14. Data Rights Portal

You can view, correct and delete your personal data at any time in your account settings. To receive a copy of your data, email [email protected] — we respond within 30 days. As further self-service controls are added they will appear in your account settings. For any request you cannot complete yourself, contact:

15. Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee GDPR compliance. For privacy concerns, data subject access requests, or questions about this policy, contact our DPO:

16. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to your registered address at least 14 days before they take effect. The updated policy will be posted on this page with a revised effective date. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

17. Data Breach Notification (GDPR Art. 33 & 34)

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant Data Protection Authority without undue delay and no later than 72 hours after becoming aware of the breach (GDPR Art. 33). Where the breach is likely to result in a high risk to you, we will also notify you directly and without undue delay (GDPR Art. 34), describing the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

18. Contact Us

If you have questions about this policy or your data: nuJOB.ai, Email: [email protected], Website: nujob.ai