Privacy Policy

Version 2026-04-06-v1 · Effective date: 6 April 2026

This policy describes how Qubora Labs (qubora.ai) collects, uses, stores, and protects personal data when you use Jobsmith, our AI-powered career intelligence platform.

1. Data Collected

Jobsmith collects the following categories of personal data:

a) Account data (from Google OAuth)

Full name
Email address
Profile avatar URL

b) User-submitted content

Resumes and professional profiles
Job descriptions and application notes
Outreach drafts and related career materials

c) API keys

LLM provider API keys you supply (Google Gemini, OpenAI, Anthropic), stored encrypted at rest

d) Technical / session data

Session cookies required for authentication
Basic request metadata (timestamps, user-agent) for operational logging

2. How Data Is Used

Jobsmith uses your data exclusively to deliver the service you requested:

Authentication: Your Google profile data identifies your account and personalises your session.
AI analysis: Your resume, job, and outreach content is sent to the LLM provider you selected so it can generate career intelligence outputs (fit analysis, resume suggestions, outreach drafts).
API key management: Your encrypted keys are decrypted in memory only at the moment an LLM request is made, then discarded from memory after the call completes.
Notifications: Your email address may be used to send transactional messages (e.g., account-related alerts) via Resend.

Qubora Labs does not sell, rent, or share your personal data for advertising or marketing purposes.

3. Third-Party Processors

Jobsmith relies on the following third-party services to operate. Each processor receives only the minimum data required for its function:

Processor	Purpose	Data shared
Google OAuth	Authentication	OAuth token exchange; Google returns name, email, avatar
Google Cloud Run (asia-south1)	Application hosting	All application data transits and is processed on GCP infrastructure
MongoDB Atlas	Database storage	Account data, user content, encrypted API keys
Resend	Transactional email	Email address, message content
Google Gemini / OpenAI / Anthropic	LLM inference (user-selected)	User content submitted for analysis; API key for authentication

4. AI Processing Disclosure

When you trigger an AI-powered action, Jobsmith transmits the relevant content (e.g., your resume text alongside a job description) to the LLM provider you chose. This transmission uses your own API key, meaning the request is attributable to your provider account and subject to that provider's data handling and retention policies.

Qubora Labs does not control how LLM providers process, log, or retain the data they receive. We encourage you to review the privacy and data-use policies of your chosen provider:

5. Retention & Deletion

Account data and user content are retained for as long as your account is active.
API keys are deleted when you remove them from settings or when your account is terminated.
Session cookies expire at the end of your browser session or after a defined inactivity period.

You may request deletion of your account and all associated data by contacting privacy@qubora.ai. Upon receiving a verified request, we will delete your data from primary storage within 30 days. Residual copies in encrypted backups are purged on the next backup rotation cycle.

6. Security Practices

API keys are encrypted at rest using Fernet symmetric encryption (AES-128-CBC with HMAC).
All data in transit is encrypted via TLS.
The application runs on Google Cloud Run with managed infrastructure security, automatic patching, and network isolation.
MongoDB Atlas provides encryption at rest, role-based access control, and audit logging.
Authentication is delegated to Google OAuth; Jobsmith never stores passwords.

7. User Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data Jobsmith holds about you.
Rectify inaccurate data (account details are sourced from your Google profile; update them there).
Delete your data and account (see Section 5).
Export your user-submitted content in a portable format.
Object to or restrict certain processing activities.

To exercise any of these rights, contact privacy@qubora.ai.

8. International Processing

Jobsmith's primary infrastructure runs on Google Cloud Run in the asia-south1 (Mumbai) region. When you use a third-party LLM provider, your content may be processed in data centres outside your country of residence, subject to that provider's infrastructure choices. By using Jobsmith, you acknowledge that your data may be transferred to and processed in jurisdictions with different data-protection laws than your own.

9. Contact

For questions, concerns, or requests related to this Privacy Policy or Jobsmith's data practices, contact Qubora Labs at:

Email: privacy@qubora.ai
Web: qubora.ai