Privacy policy

Last updated: November 6, 2026

This policy explains how job2 ("we") collects, uses and protects your personal information on job2.ai. Questions: support@job2.ai.

What we collect

Account data: email and password (stored encrypted by AWS Cognito; we never see it in plain text); with Google sign-in, the email and name Google provides.
Job-search data: the roles, locations, work types, salary range and US work authorization you choose.
Your resume: the PDF you upload, the experience and skills we structure from it, and the tailored resumes we generate for each job.
Your conversations with the AI resume builder.
Files you attach in the AI resume builder chat (images, PDFs, text files): the AI reads what's relevant to your experience and keeps it as part of that conversation; the files themselves aren't stored.
Full Service / Elite: your application questionnaire answers; if you enable auto-apply and sign in to a third-party account (such as LinkedIn), you sign in yourself in our secure browser window. We never receive your password; we store only the signed-in session, encrypted, use it only to apply on your behalf, and you can sign out and delete it at any time.
Payments: handled by Stripe. We keep your plan, payment status, amount and Stripe transaction IDs; we never see or store your full card number.
Content you give us: feedback, and if interview guides are available, the guides you share and your ratings and reports.
Technical data: server logs (IP address, browser type, request times) for operations and security.

To match jobs to you, score them, generate tailored resumes and, on Full Service / Elite, apply on your behalf.
To process payments and review refund claims under the guarantee terms.
To answer your questions and feedback, improve the service, and detect and prevent abuse.
To meet legal obligations.
We don't sell your personal information or use it for third-party advertising.

To generate tailored resumes and run the AI resume builder, your resume content, conversations and job descriptions are sent to OpenAI through its API. Under OpenAI's API terms this data isn't used to train its models by default.
When you add experience from a project on your computer, the project isn't uploaded. The AI reads only the parts it needs (each shown to you on screen); those parts pass through our server to OpenAI for analysis and aren't kept, only the resume lines it produces are. Files like .env and keys are never read, and anything that looks like a password is masked in your browser first.
The AI only rewrites what you provided, and an automatic check removes numbers and skills that aren't in your original resume.

You can choose to connect Gmail, read-only, to see your upcoming interviews, get your job emails sorted, and be reminded when a recruiter is waiting for your reply. Everything else works without it.
We read new mail every 10 minutes. For each email we first read only the sender, subject and the preview Google provides; only emails that look job-related are downloaded and sent to OpenAI to tell what kind they are and pick out the company, role, interview time and meeting link.
We don't keep email contents. We keep only the company, role, sender, subject, a one-line summary, the interview time and links, and whether you've replied. Nothing is kept from emails that aren't about your job search.
Your Gmail authorization is stored encrypted with AWS KMS, and only the service that runs the sync can decrypt it.
We never send, delete or change anything in your mailbox. Data from Gmail is not used for advertising, not sold and not used to train AI models; our staff look at it only when needed for operations or security, or when the law requires it.
job2.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect any time on the Interviews page, or remove access in your Google Account's security settings. When you disconnect, we revoke the authorization and delete everything obtained from Gmail right away.

Service providers, only to run the service: Amazon Web Services (hosting, database, file storage and sign-in; data is stored in the US), Stripe (payments), OpenAI (AI processing), and Google (if you choose Google sign-in or connect Gmail).
Fonts: the site's typeface is served by Fontshare, so your browser contacts its servers and it can see your IP address.
Employers: when you apply, or we apply for you on Full Service / Elite, your resume and answers go to that employer or the hiring system it uses (such as LinkedIn, Greenhouse, Lever or Ashby).
Referrers: if you sign up through a referral link or use a referral code at checkout, the partner who gave out that code can see your email, when you joined, whether you paid, and which plan you bought and for how much, so we can pay their commission. Without a code, nothing is shared.
When the law requires it, or to protect the rights and safety of our users and us.

We only use the cookies needed to keep you signed in (your session, and a short-lived security cookie during Google sign-in), plus one that remembers a referral code for 30 days when you open a referral link.
We don't use analytics or advertising cookies.

We keep your data while your account is active.
Within 30 days of deleting your account we delete your resumes, tailored resumes, job-search data and conversations; payment records are kept longer where tax and accounting rules require.
Server logs are kept for up to 30 days.

Everything travels over HTTPS; files and databases are encrypted at rest on AWS; keys and third-party account details are protected with AWS KMS / Secrets Manager and only the services that need them can read them.
No system is perfectly secure. If an incident affects your data, we'll notify you as the law requires.

You can ask to see, correct, export or delete your personal information by emailing support@job2.ai. We reply within 30 days.
California residents also have rights under the CCPA / CPRA to know, delete and correct their information, and won't be treated differently for using them. We don't sell or "share" personal information for cross-context advertising.
You can change your preferences and replace your resume on the dashboard at any time.

The service is for job seekers 18 and older. We don't knowingly collect data from anyone under 18.