Privacy
How Neural Career Network collects, uses and protects your information — including exactly what our AI does with your CV, and how to get a copy of everything we hold.
On this page
Neural Career Network is a career and recruitment platform operated by Jobora AI ("we", "us"). For the personal data described in this policy we are the data controller, except where stated otherwise in section 4.
Privacy questions and rights requests: privacy@neuralcareernetwork.com. We answer rights requests within one month, and will tell you if we need longer and why.
We collect three kinds of information: what you give us, what we generate about you, and what your device tells us.
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, password hash, plan, verification status | You, at sign-up. Or your Google or GitHub account if you sign in that way — we receive your name, email and profile picture, never your password. |
| Profile | Headline, bio, location, skills, website, photo, visibility settings | You |
| Career documents | CVs, cover letters, portfolio items, uploaded files | You |
| Application activity | Jobs applied to, saved jobs, statuses, interview stages, invitations | You, and employers updating your status |
| Social | Posts, comments, follows, direct messages | You |
| AI-derived | ATS scores, fit scores, skill gaps, career-health findings, profile standing | Generated by us from the above |
| Moderation | Reports, strikes, restrictions, appeals | Generated by us, or reported by other users |
| Technical | IP address, browser and device type, pages viewed, timestamps | Your device, automatically |
| Billing | Stripe customer and subscription identifiers, plan history | Stripe. We never receive or store your full card number. |
We do not have one basis for everything. Each purpose below stands on its own, which is what makes the list meaningful.
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Providing the account and features you asked for | Performance of a contract — Art. 6(1)(b) |
| Running AI features you invoke (CV, match, coaching, diagnostics) | Performance of a contract — Art. 6(1)(b). See the AI Processing Notice. |
| Sending an application to an employer when you apply | Performance of a contract — Art. 6(1)(b) |
| Autopilot applying on your behalf | Consent — Art. 6(1)(a). Off by default; withdrawn by switching it off. |
| Keeping the platform safe: moderation, rate limits, anti-bot, fraud and abuse | Legitimate interests — Art. 6(1)(f), and the interests of every other user |
| Improving reliability and quality of the service | Legitimate interests — Art. 6(1)(f) |
| Optional analytics cookies | Consent — Art. 6(1)(a), and PECR / the ePrivacy Directive |
| Marketing email | Consent — Art. 6(1)(a), separate and unbundled from sign-up |
| Billing, tax and accounting records | Legal obligation — Art. 6(1)(c) |
| Responding to a lawful request from an authority | Legal obligation — Art. 6(1)(c) |
The list is short by design. Every additional processor is another party holding your CV.
| Provider | What for | Where |
|---|---|---|
| Contabo | Hosting, application servers, database | Germany (EU) |
| Stripe | Payments, checkout, billing portal | EU / US, under Standard Contractual Clauses |
| Email delivery (SMTP provider) | Transactional email: verification, notifications, interview invitations | EU / US, under Standard Contractual Clauses |
| Google, GitHub | Optional OAuth sign-in, only if you choose it | US, under Standard Contractual Clauses |
| Google Analytics 4, Microsoft Clarity | Optional analytics — loaded only after you accept cookies, and never on signed-in dashboard pages | US, under Standard Contractual Clauses |
| Sentry | Error monitoring, so faults are found before you report them | EU / US, under Standard Contractual Clauses |
Where data leaves the EEA or UK, transfers rely on Standard Contractual Clauses together with a transfer risk assessment, or on an adequacy decision where one applies.
Running AI over a CV is profiling. We treat it as such rather than describing it as a feature and leaving it there. The full detail is in the AI Processing Notice; the essentials are here.
No decision with a legal or similarly significant effect on you is made by automated processing alone. Specifically: no employer on this platform can auto-reject you. Applicant ranking and screening produce a suggestion with reasons, for a human recruiter to act on.
Autopilot is the one feature that acts for you rather than advising you. It is off unless you switch it on, it applies only above a qualifying match score, every application it submits appears in your own pipeline, and switching it off stops it immediately.
We keep data only as long as the purpose requires, or as long as the law requires us to. Where we cannot delete something on request, the reason is stated.
| Data | Retention | Why |
|---|---|---|
| Account record | Until you delete your account, then 30 days | The 30 days is a grace period during which you can cancel the deletion. |
| CVs, cover letters, roadmaps, study guides | Until you delete them, or with the account | Yours to delete individually at any time. |
| Applications you submitted | Retained by the employer under their own basis | We cannot delete an employer's record of an application you sent them. Ask them directly. |
| Messages and posts | Until deleted; hidden immediately on account deletion | Restored if you cancel a pending deletion. |
| Moderation records (strikes, appeals) | Kept beyond account deletion | Otherwise a restriction is escaped by deleting and re-registering. Strikes stop counting toward escalation after 180 days. |
| AI usage logs | Rolling 24 months | What was run, when, and against which feature — needed for quota accounting and to answer "what did you do with my CV". |
| Security and access logs | Up to 12 months | Abuse investigation and incident response. |
| Billing records | As required by tax law in the relevant jurisdiction, typically 7 years | We cannot delete these on request while the obligation stands. |
| Aggregated, non-identifying counts | Indefinite | Cannot be linked back to you. |
These rights are real and implemented. Each row names the route that satisfies it, so none of them requires a support ticket or our goodwill.
| Right | How to use it | What happens |
|---|---|---|
| Access — get a copy of your data | Settings → Privacy → Download my data, or GET /api/account/data | Immediate. Returns one JSON file covering every category we hold. |
| Erasure — delete your account and data | Settings → Privacy → Delete account | Immediate deactivation, permanent deletion after 30 days. Retained categories are listed at the point of request. |
| Rectification — correct your data | Edit it directly in Settings and your profile | Immediate. |
| Portability — a machine-readable export | The same data export | Structured JSON. |
| Withdraw consent | Settings → Privacy for marketing; the cookie banner for analytics | Applies from the moment you withdraw. Withdrawal does not affect processing already carried out lawfully. |
| Object to processing | Email privacy@neuralcareernetwork.com | We respond within one month and tell you the outcome. |
| Restrict processing | Email privacy@neuralcareernetwork.com | We can suspend processing while a dispute is resolved. |
| Complain to a regulator | Your national data protection authority | You do not need to contact us first, though it usually resolves faster if you do. |
We do not charge for these requests and we do not treat you differently for making one.
No system is perfectly secure. If a breach affects your rights and freedoms we will notify the relevant supervisory authority within 72 hours of becoming aware, and tell you without undue delay where the risk to you is high.
The service is for people aged 16 and over, and 18 or over where local law sets a higher age for employment services. We do not knowingly collect data from anyone below that age. If you believe a child has an account, tell us and we will remove it.
This policy is versioned. The current version is 2026-08-08. If we change it materially we will tell you in the product and, where the change requires it, ask you to agree again before continuing. We do not make material changes silently and we do not backdate them.
Additional rights apply depending on where you live. These are set out in the regional annexes, which form part of this policy: EU and UK, United States, Canada, Brazil, India, Japan, South Korea, China, Australia, South Africa, and the Middle East.