Privacy policy

Last updated 5 October 2026

jobhunts (jobhunts.co.uk) helps software engineers find jobs, prepare applications and keep track of them, on the website and with the optional jobhunts browser extension. This policy explains what we collect, why, and the choices you have.

Who we are

jobhunts is run from the United Kingdom and is the controller of the personal data described here. For any privacy question or request, email support@jobhunts.co.uk.

What we collect

Account details: your email address, name, password (stored only as a salted hash), and sign-in provider (Google, Microsoft or LinkedIn) if you use one.
Your CV, profile and preferences: the file you upload, the profile we extract from it (skills, experience, education and the contact details it contains), the application details you confirm or add (such as phone number, links, right to work in each country, notice period and salary expectation), and your job preferences (roles, countries, work mode, seniority).
Applications: jobs you prepare or apply for, cover letters, drafted answers, and their status.
Equal-opportunity answers, only if you give them: answers you choose to save for diversity questions (such as gender, ethnicity, sexual orientation, disability or age range). These are special category data: we keep them only with your explicit consent, use them only to fill those questions on forms you choose to fill, never send them to our AI or use them for matching, and delete them when you clear them or withdraw consent.
Mailbox data, only if you connect a mailbox: see below.
Extension data, only if you install the extension: see below.
Technical data: server logs (IP address, request times, pages requested) kept for security and troubleshooting.

How we use it

To find and rank jobs for you: we compare postings with your CV and preferences. Your right-to-work answers are used to warn you about, rank lower, or (if you choose) filter out jobs in countries where you would need a visa.
To prepare applications: cover letters and answers to employers' questions, drafted from your CV and profile.
To track applications: from the employer's confirmation page (with the extension) and from your connected mailbox.
To send the emails you have chosen, and to keep the service secure and working.

We do not use your data for advertising and we do not sell it.

Connected mailboxes (Gmail, Outlook, IMAP)

If you connect a mailbox, we read new messages to find emails about your job applications (confirmations, interview invitations, rejections and offers) and update your applications automatically. Specifically:

We request read-only access. We never send, delete, move or modify your email.
Messages that do not look like application email are skipped. For them we keep only the message ID, so they are not processed twice: no sender, subject or content.
For application-related messages we keep the sender, subject, a short snippet and the result of the classification, so you can see what changed and why.
Access tokens and IMAP passwords are encrypted (AES-256-GCM) before they are stored.
You can disconnect a mailbox at any time on the Mailboxes page, which deletes its stored message data. You can also revoke access in your Google or Microsoft account settings.

Google user data. jobhunts' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the application-tracking feature you turned on; we do not use it for advertising, do not sell it, and do not use it to train generalised AI or machine-learning models. Humans do not read your email unless you ask us to for support, it is needed for security, or the law requires it.

The jobhunts browser extension

The optional extension fills in employers' application forms for you. It runs only where you use it: when you click it on a page, or on an employer's form you open from jobhunts.

What it reads: the labels, options and current values of the form's fields on that page, to work out what each field asks. It does not read the rest of the page, other tabs, or your browsing history.
What it sends to jobhunts: the page address and the questions it could not fill from your profile (their labels and options), so jobhunts can draft answers; and, when the employer's page confirms your application, the job title, company and page address so your application shows as Applied.
What it fills in: your jobhunts profile, your CV file, the cover letter and the drafted answers. To work with dropdowns built into some sites, it runs a small helper inside that page; the helper only chooses options in fields the extension is filling.
What it never does: submit a form (you review it and press Submit yourself), tick marketing or newsletter boxes, or guess an answer to an equal-opportunity question. It answers those only with the answers you saved (or "Prefer not to say" if you chose that), and ticks an employer's required privacy-notice and accuracy boxes only if you turned that on in your profile.
What it stores in your browser: its jobhunts sign-in (session tokens) and, for a tab you are applying in, which job it is. Nothing else.
Permissions: it can talk to jobhunts.co.uk and recognise confirmation pages on the main applicant-tracking sites. Working on every site is optional and asked for only when you choose it; even then it fills only pages where you use it, and watches only forms it filled.

Chrome Web Store user data. The use of information received by the jobhunts extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to fill and track your job applications; it is not sold, not used for advertising or creditworthiness, and not transferred except as needed to provide this feature, for security, or as the law requires.

Some employers' application forms are shown inside jobhunts. Those forms belong to the employer and their applicant-tracking provider, and what you enter in them is governed by their privacy notice.

How we use AI

We use Azure OpenAI Service, run by Microsoft in the European Union, to read your CV, score how well jobs fit it, write cover letters, draft answers to application questions, and classify application emails. Only the content needed for each task is sent. Microsoft processes it on our behalf, does not use it to train models, and may keep it for up to 30 days to monitor for abuse. AI drafts are suggestions: you review and edit them before anything is sent to an employer.

Why we process your data (UK GDPR)

To provide the service you asked for (contract): your account, CV parsing, job matching, application preparation, the extension, mailbox tracking and the emails you have turned on.
Legitimate interests: keeping the service secure and reliable, and preventing abuse.
Consent: connecting a mailbox and allowing the extension on all sites. You can withdraw it at any time by disconnecting the mailbox or removing the permission.
Explicit consent (UK GDPR Article 9): equal-opportunity answers you save. You can withdraw it at any time on your Profile page, which deletes them.

Who we share data with

We do not sell personal data. We use these processors to run the service, under contracts that require them to protect it:

Microsoft Azure: hosting, database, file storage, email delivery and AI processing (data held in Sweden, the UK and the EU).
Google and Microsoft: only when you sign in with them or connect their mailbox.

When you apply for a job, you send your application to the employer yourself, on their form. We do not submit applications for you, and we do not give your data to employers or recruiters.

International transfers

We store and process your data in the UK and the European Economic Area. If you sign in with Google or Microsoft, those companies may process your sign-in in other countries under their own safeguards.

How long we keep it

We keep your data while your account is open. When you delete your account we delete your profile, CV, applications and mailbox data within 30 days, except encrypted backups, which expire within a further 30 days. Server logs are kept for up to 30 days.

Security

Data is encrypted in transit (HTTPS) and at rest. Mailbox credentials are additionally encrypted with their own key. Access to production systems is limited to what is needed to run the service.

Your rights

You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. Email support@jobhunts.co.uk and we will respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

Emails from us

We send account emails (confirmation and password resets) and, if you keep them on, job matches, application updates, follow-up reminders and a weekly summary. Each has an unsubscribe link, and all of them can be changed in Preferences.

Cookies

We do not use advertising or analytics cookies. Your browser stores your sign-in session locally so you stay signed in.

Children

jobhunts is for people of working age and is not intended for anyone under 16.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email before the change applies. The date at the top shows when it last changed.