Legal
Privacy Policy
Last updated: 14 May 2026 · Version v1.1
1. Who we are
The Next Job (thenextjob.app) is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, contact us at hello@thenextjob.app.
2. What data we collect and why
We only collect data necessary for the service we provide (data minimisation, GDPR Art. 5(1)(c)). The data we collect depends on how you use the service.
Account and identity data
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account creation, transactional notifications (order status, billing, account management) | Performance of contract (Art. 6(1)(b)) |
| Name and profile picture | Sourced from your OAuth provider (Google or GitHub) for display in the dashboard | Performance of contract (Art. 6(1)(b)) |
| OAuth tokens | Used internally by NextAuth to maintain your session; never exposed or shared | Performance of contract (Art. 6(1)(b)) |
| Language and country preference | To deliver the interface in your preferred language and region | Performance of contract (Art. 6(1)(b)) |
| Marketing consent flag + timestamp | To send product updates and founder communications – only if you opt in | Explicit consent (Art. 6(1)(a)) |
Job application data (core service)
| Data | Purpose | Legal basis |
|---|---|---|
| Your CV / résumé (uploaded file) | Parsed and stored securely so the AI pipeline can tailor it to each role you apply for. Your original is never modified. | Performance of contract (Art. 6(1)(b)) |
| Job descriptions you paste | Analysed to identify keywords, required skills, seniority, and role-specific priorities | Performance of contract (Art. 6(1)(b)) |
| AI-generated content (tailored CVs, cover letters, gap analysis, interview prep) | Generated per application and stored so you can access, compare, and download your results | Performance of contract (Art. 6(1)(b)) |
| Target role, company name, job location | Stored per order to organise your application history | Performance of contract (Art. 6(1)(b)) |
Billing data
| Data | Purpose | Legal basis |
|---|---|---|
| Stripe customer ID and subscription metadata | To manage your subscription, process payments, and handle billing events | Performance of contract (Art. 6(1)(b)) |
| Withdrawal waiver consent (EU only) | For subscribers who waive the 14-day right of withdrawal under EU Directive 2011/83/EU to access the service immediately; recorded with anonymised IP and timestamp | Legal obligation (Art. 6(1)(c)) |
Usage and error data
| Data | Purpose | Legal basis |
|---|---|---|
| Page views and custom events (Vercel Analytics – cookieless) | To understand how the service is used. No cookies are set; Vercel uses a privacy-preserving hashed fingerprint that is not linked to your account. | Legitimate interest (Art. 6(1)(f)) – improving the service |
| Error reports and session recordings (Sentry) | To diagnose crashes and bugs. 5% of sessions and 100% of sessions where an error occurs are recorded. Recordings are stored on Sentry's EU infrastructure and automatically expire. | Legitimate interest (Art. 6(1)(f)) – maintaining service reliability |
3. AI processing – how your CV and job description data is used
When you submit a job application through The Next Job, your CV content and the job description you paste are sent to Anthropic (maker of Claude AI) via their API to generate your tailored CV, cover letter, gap analysis, and interview preparation. This is the core function of the service.
Anthropic processes this data as a data processor acting on our instructions. They do not use your data to train their models. Their Data Processing Agreement and privacy commitments are available at anthropic.com/legal/privacy.
Your CV may contain sensitive personal data (name, address, employment history). By using the service you consent to this data being processed by Anthropic solely for the purpose of generating your application materials.
4. What we do not collect
- We do not use tracking cookies or advertising pixels.
- We do not collect your IP address for profiling (IP is anonymised before being stored in consent records – last octet zeroed for IPv4, truncated to /64 for IPv6).
- We do not share or sell your data to third parties for marketing purposes.
- We do not use your CV or job description data to train any AI model.
5. How long we keep your data
| Data | Retention period |
|---|---|
| Account data (email, name, preferences) | Until you delete your account, then immediately anonymised |
| CV file and generated documents | Until you delete your account; hard-deleted from storage within 30 days of account deletion request |
| Order history and job descriptions | Until you delete your account; associated user link removed within 30 days of deletion request |
| Billing records (Stripe) | 7 years minimum for tax and accounting compliance |
| Waitlist email and marketing consent | Until you unsubscribe, or 12 months after public launch – whichever comes first |
| Consent records (withdrawal waiver, marketing consent) | Retained as evidence for the duration required by the applicable legal obligation |
| Sentry error recordings | Automatically expire per Sentry's data retention policy (typically 30–90 days) |
When you request account deletion, your personal data is immediately anonymised (name, email, and profile picture removed; active sessions revoked). Your CV file and generated documents are permanently deleted from storage within 30 days. You will receive a confirmation email when deletion is complete.
You can request deletion at any time from your account settings or by emailing hello@thenextjob.app.
6. Your rights under GDPR
If you are based in the European Economic Area (EEA) or the United Kingdom, you have the following rights:
- Access – request a copy of the personal data we hold about you. Use the “Download your data” button in your account settings for an immediate JSON export.
- Rectification – ask us to correct inaccurate data.
- Erasure – delete your account from settings, or email us. See Section 5 for timelines.
- Restriction – ask us to stop processing your data temporarily.
- Portability – receive your data in a structured, machine-readable format (available via the data export feature).
- Objection – object to processing based on legitimate interests (analytics, error monitoring).
- Withdraw consent – for marketing emails, click unsubscribe in any email or contact us directly. For AI processing of your CV data, you can stop using the core service at any time and request deletion of your data.
To exercise any of these rights, email hello@thenextjob.app. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (in Portugal: CNPD).
7. Third-party processors
We use the following sub-processors to deliver the service. Each operates under a Data Processing Agreement (DPA) or equivalent legal mechanism and processes your data only on our documented instructions.
| Vendor | Purpose | Data processed | Data location |
|---|---|---|---|
| Supabase (AWS) | Primary database – stores account, subscription, order, and consent data | All account and application data | EU (Frankfurt, AWS eu-central-1) |
| Railway | API and background worker hosting – runs the FastAPI backend and Celery tasks | All API request data | EU region |
| Cloudflare R2 | File storage – stores your uploaded CV and AI-generated DOCX/PDF documents | CV files and generated documents | EU region |
| Anthropic | AI processing – generates tailored CVs, cover letters, gap analysis, and interview prep from your CV and job description | CV content and job descriptions | USA (processed under DPA / SCCs) |
| Stripe | Payment processing and subscription management | Billing and payment metadata (no full card numbers stored by us) | USA (processed under EU SCCs) |
| Resend | Transactional email – sends order notifications, billing emails, and account management emails | Email address and email content | EU-compliant (AWS) |
| Vercel | Frontend hosting and edge functions for the Next.js web application | Page view data (cookieless, privacy-preserving) | EU Edge Network |
| Sentry | Error monitoring and session replay for debugging crashes and bugs | Error data, anonymised session recordings (5% of sessions; 100% on error) | EU (ingest.de.sentry.io) |
| OAuth authentication provider (sign in with Google) | OAuth tokens and basic profile (email, name, picture) | Google Privacy Policy applies | |
| GitHub | OAuth authentication provider (sign in with GitHub) | OAuth tokens and basic profile (email, name, picture) | GitHub Privacy Policy applies |
8. International transfers
Some sub-processors (Anthropic, Stripe) are based in the United States. Data transfers to these processors are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring adequate protection for data transferred outside the EEA. All other processors operate within the EU or on EU-region infrastructure.
9. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted connections (TLS), access controls, row-level security on our database, and short-lived authentication tokens. Your uploaded CV is stored in an isolated, access-controlled bucket and is never publicly accessible.
No method of transmission over the internet is 100% secure. If you believe your data has been compromised, contact us immediately at hello@thenextjob.app.
10. Cookies
We use only essential cookies required for the service to function:
- Session cookie – set by NextAuth to maintain your login session. Required for authentication. Expires when you sign out or after 30 days of inactivity.
- Language preference cookie – stores your chosen language. Expires after 1 year.
We do not use advertising cookies, third-party tracking cookies, or analytics cookies. Vercel Analytics is cookieless and does not set any cookies.
11. Changes to this policy
We may update this policy as the service evolves. When we make material changes, we will notify registered users by email and update the version number and date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.
12. Contact
For any privacy-related questions or to exercise your rights:
The Next Job
Email: hello@thenextjob.app