Privacy Policy

Privacy Policy

Zink Labs LLC ("Company," "we," "us," or "our") operates Job Agent ("Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Service.

The Service is available to job seekers in the United States and in other countries. Section 9 explains where your information is processed and how we handle applications to employers outside your country.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

Last Updated: October 21, 2026 | Version 1.11

1. Information We Collect

1.1 Information You Provide

• Account Information: name, email address, password

• Profile Information: phone number, location (city, state), work authorization status

• Resume Data: uploaded resume files and parsed resume content

• Job Preferences: desired job titles, roles, salary expectations, remote/hybrid/on-site preferences, companies to avoid

• Demographic and EEO Data: gender, race/ethnicity, veteran status, disability status (provided voluntarily for job application forms)

• Gmail Access: IMAP credentials (app password) for reading application-related emails

1.2 Information Collected Automatically

• Usage Data: pages visited, features used, application submission history, job match scores

• Device Information: browser type, operating system, IP address

• Authentication Data: Supabase session tokens

1.3 Information from Third Parties

• Payment Information: Stripe provides us with transaction confirmations and subscription status (we do not store full credit card numbers)

• Job Board Data: publicly available job listing information scraped from employer career pages and applicant tracking systems. We do not collect personal information about other individuals from these pages — only job listing details (title, description, location, requirements, company name, application URL).

2. How We Use Your Information

We use your personal information to:

• (a) Provide the Service, including matching you with job listings and submitting applications on your behalf

• (b) Auto-fill job application forms with your profile data, resume, and demographic information

• (c) Scan your Gmail account via IMAP to identify application-related emails, including verification codes, application confirmations, interview invitations, interview scheduling links, and rejection notices. Email scanning is limited to messages matching known recruiter and applicant tracking system (ATS) sender patterns. We extract email subjects, sender addresses, dates, and relevant body content (such as company names, interview dates, and status updates) to update your application tracking dashboard.

• (d) Process payments and manage your subscription through Stripe

• (e) Send you application status updates, daily progress reports, and service notifications

• (f) Improve the Service, including job matching algorithms and application success rates

• (g) Respond to your support requests

• (h) Comply with legal obligations

• (i) Prevent fraud and abuse, including limiting free trials to one per person. When a trial starts we store one-way keyed hashes of your normalized email address and phone number and of the payment identifier Stripe provides (a card fingerprint or, for Stripe Link, the Link email), and compare them with earlier trials. We never see or store your full card number. If we withhold or cancel a trial for this reason we tell you, and you can reply to have a person review the decision.

2.1 Artificial Intelligence and Automated Processing

The Service uses artificial intelligence (AI) to enhance the job application process. Specifically:

• Application Answer Generation: We use AI language models (currently Anthropic Claude) to generate answers to free-text application questions based on your profile data, resume, and work history. These AI-generated answers are submitted as part of job applications on your behalf.

• Cover Letter Generation: If enabled, AI generates cover letters tailored to each job posting using your resume and work experience.

• Form Field Selection: AI assists in selecting appropriate options from dropdown menus and multi-select fields on application forms.

• Decision Checking and Classification: A typed decision model (TypeSafe, via Vercel AI Gateway) checks the answers our system selects for application forms, scores job matches, groups resume skills, and classifies job-application email. Direct identifiers are replaced with presence markers on the application-form path, and self-identification answers are never sent.

• Screenshot Analysis: Anthropic Claude's vision model analyzes screenshots of application forms to identify and fill empty required fields. These screenshots may contain personal information you have entered into the form. Screenshots are transmitted directly to Anthropic via API, are not retained by us, and are subject to the same 7-day safety-retention policy described above.

You can control AI features through your profile settings (e.g., enabling or disabling auto-generated cover letters). The data sent to AI providers is used solely to provide the features described above and is subject to the AI provider's data processing terms. Our AI providers do not use your data to train their public models. Anthropic retains API inputs and outputs for up to 7 days for safety monitoring before automatic deletion; Voyage AI and OpenRouter do not retain inputs after the request completes; TypeSafe requests are routed through Vercel AI Gateway with zero data retention enforced: Vercel does not retain them, and TypeSafe keeps them only as long as needed to return the result, except where the law requires otherwise (see the DPA for full sub-processor retention details).

3. How We Share Your Information

We share your personal information only in the following circumstances:

3.1 Job Board Platforms

When we submit job applications on your behalf, your personal information (name, email, phone, resume, demographic data, and other application fields) is transmitted to the employer's applicant tracking system (ATS). This is the core function of the Service and is done at your direction.

Some positions are posted directly on Job Agent by an employer. When the Service applies to one of these on your behalf, the employer receives your application inside Job Agent rather than through an applicant tracking system: your name, the email address used for the application, your city and state, your LinkedIn profile URL (if you added one), the tailored resume and cover letter submitted with the application, and your match breakdown for the position. The match breakdown is the same one you see on the job in the Service: your fit score and fit verdict and the inputs behind them, which of the posting's required and preferred skills your resume shows, your years of experience and education compared with the posting, the AI score of how well your resume covers the posting, your minimum salary, your answers to the work-authorization and sponsorship questions, and how the position compares with the target roles you chose, including the resume suggestions the Service makes for those roles. The employer may also see where your application stands, and changes the employer makes (for example, inviting you to interview or not moving forward) are shown on your application in the Service.

3.2 Service Providers

We use the following third-party service providers:

3.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or government request.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. Any such successor entity will be required to honor this Privacy Policy or provide you with notice and a reasonable opportunity to delete your data before applying materially different privacy terms.

We do not sell your personal information for monetary or other valuable consideration.

To measure advertising effectiveness, we use first-party conversion pixels and analytics: Reddit Pixel, Google Ads, X (Twitter) Pixel, Meta Pixel, and Google Analytics 4. These tools share event-level data (page visits, account creations, checkout completions) with their respective platforms so we can attribute paid ads we run to actual sign-ups. They are not used for behavioral profiling across other websites. You may block these pixels using browser-level ad blockers or by enabling Global Privacy Control.

3.5 Automated Decision-Making

The Service uses automated processing to match you with job listings and to generate content for job applications. Specifically:

• Job Matching: An automated scoring algorithm, assisted by AI models, evaluates job listings against your profile (job titles, experience, skills, location, salary, keywords) to produce a match score (0.0–1.0). Only jobs above your match threshold are selected for application.

• AI Content Generation: Artificial intelligence generates answers to application questions and optional cover letters based on your profile data.

• Answer Checking and Email Classification: AI checks the answers selected for application forms against your profile before submission, and classifies job-application email (for example, as a confirmation, rejection or interview request) to update your application tracker.

IMPORTANT: These automated processes do not make employment decisions about you and do not constitute automated decision-making within the meaning of GDPR Article 22. The matching algorithm only assists in submitting applications — it does not determine your suitability for employment. All hiring decisions are made solely and independently by employers. The Service has no role in, and is not responsible for, any employer's hiring decision. Employers who post on Job Agent see each applicant's fit score and match breakdown as an aid to their own review; Job Agent does not decide which applicants an employer interviews or hires.

You have the right to: (a) obtain information about the logic involved in the matching and scoring process; (b) request human review of any automated processing; and (c) contest outcomes by contacting us at [email protected].

4. Data Retention

• Active Accounts: We retain your data for as long as your account is active.

• After Deletion: When you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g., payment records for tax compliance, consent records for legal proof of agreement acceptance).

• Application Records: Application metadata (job title, company, submission status, AI-generated answers) is retained for the duration of your account. Application screenshots are retained on a 90-day rolling basis and automatically deleted thereafter.

• Gmail Credentials: Your encrypted Gmail app password is deleted immediately upon disconnection or account deletion. We do not retain email content after processing — only extracted metadata (company name, email date, status classification) is stored.

• AI Processing: Profile data and resume content sent to Anthropic via the Claude API for answer generation is not used for model training. Per Anthropic's standard API data retention policy, API inputs and outputs are retained by Anthropic for up to 7 days for safety monitoring, after which they are automatically deleted. Data sent to TypeSafe via Vercel AI Gateway is sent with zero data retention: Vercel does not retain it. TypeSafe keeps it only as long as needed to return the result, except where the law requires otherwise, and does not use it for model training.

• Anonymized Data: We may retain anonymized, aggregated data that cannot identify you for analytical and service improvement purposes.

• Trial-Eligibility Records: The one-way hashes described in Section 2(i) are kept after account deletion so a free trial cannot be claimed again by deleting and re-creating an account. They cannot be reversed to reveal your email address, phone number, or card.

• Legal Consent Records: Records of your agreement acceptance (timestamps, IP address, document version) may be retained after account deletion as proof of consent, as permitted by law.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest

• Role-based access controls and row-level security (RLS) on all database tables

• Secure authentication via Supabase Auth

• No direct database access — all data flows through authenticated APIs

• Regular review of security practices

While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure.

5.1 Data Breach Notification (Florida Information Protection Act)

In the event of a security breach affecting your personal information, we will comply with the Florida Information Protection Act of 2014 (FL § 501.171), which requires:

• Individual Notification: We will notify affected Florida residents no later than thirty (30) days after determination of the breach or reason to believe a breach occurred.

• Notification Content: The notice will include the date (or estimated date) of the breach, a description of the personal information involved, and contact information for the Company.

• Regulatory Notification: If the breach affects 500 or more individuals, we will notify the Florida Department of Legal Affairs within 30 days of the breach determination.

• Large-Scale Breaches: If the breach affects 1,000 or more individuals, we will also notify all consumer reporting agencies.

• Notification Method: Notification will be provided by email (to your registered account email), by mail, or by substitute notice as permitted under FIPA if direct contact information is unavailable.

For details on our breach notification procedures and cooperation obligations, see our Data Processing Agreement (DPA), Section 9.

6. Your Rights

6.1 All Users

You have the right to:

• Access your personal data by viewing your profile and application history in the Service

• Update your personal data through your account settings

• Delete your account and associated data by contacting us or using the account deletion feature

• Export your data in a machine-readable format upon request

• Object to automated processing by contacting us at [email protected]

We may retain and use anonymized, aggregated data derived from your usage that cannot reasonably identify you, for service improvement and analytical purposes. Anonymized data is not subject to deletion requests and is not considered personal information.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected.

• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.

• Right to Opt-Out of Sale or Sharing: We do not sell your personal information for monetary consideration. We use first-party conversion pixels (Reddit, Google Ads, X, Meta, TikTok) and Google Analytics 4 to measure the effectiveness of paid advertising; under Cal. Civ. Code § 1798.140(ah) this may be characterized as “sharing” for cross-context behavioral advertising. Zink Labs LLC currently operates below the CCPA/CPRA applicability thresholds (revenue, consumer count, and personal-information-revenue tests in Cal. Civ. Code § 1798.140(d)). To opt out of pixel-based measurement at any time, install a browser-based ad blocker or enable the Global Privacy Control signal in your browser; we will honor GPC for visitors who present it.

• Right to Limit Use of Sensitive Personal Information: We collect sensitive personal information (such as demographic/EEO data and email account credentials) solely to provide the Service. We do not use sensitive personal information for purposes beyond what is necessary to provide the Service.

• Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise your CCPA/CPRA rights, contact us at [email protected] with "CCPA Request" in the subject line.

6.3 EU/EEA Residents (GDPR)

If you are located in the EU/EEA, the United Kingdom or Switzerland, GDPR (or its UK or Swiss equivalent) applies to our processing of your personal data. We send your application details to an employer in the EU/EEA, the United Kingdom or Switzerland only after you give explicit consent in the Service (Art. 6(1)(a) and Art. 49(1)(a)). The consent is recorded with a timestamp, and you can withdraw it at any time in your profile, which stops future applications there without affecting applications already sent.

Our legal bases for processing are:

Rights for EU/EEA residents (if GDPR applies): right of access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Right to lodge a complaint: You have the right to lodge a complaint with your national supervisory authority (data protection authority / DPA) if you believe our processing of your personal data infringes applicable data protection law. A list of EU/EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

EU Representative: Zink Labs LLC currently qualifies for the exemption under GDPR Article 27(2)(a) (fewer than 250 employees; processing is not large-scale, not systematic, and unlikely to result in high risk to data subjects' rights and freedoms). Accordingly, we have not appointed a formal EU representative at this time. If our EU/EEA user base grows materially, this position will be reviewed and a representative appointed as required.

6.4 Florida Digital Bill of Rights

The Florida Digital Bill of Rights (FDBR, FL SB 262, effective July 1, 2024) grants certain privacy rights to Florida residents. However, the FDBR applies only to companies that have global annual revenues exceeding $1 billion and meet other threshold criteria. Zink Labs LLC does not currently meet these thresholds. Notwithstanding, we are committed to privacy best practices and voluntarily provide data access, correction, and deletion rights to all users regardless of jurisdiction (see Section 6.1 above).

7. Cookies

We use essential cookies for authentication and session management. For details, see our Cookie Policy.

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

9. Where We Operate and Where Data Is Processed

The Service is available in the United States and in other countries. By using the Service, you represent that the information you give us about where you live and where you are authorized to work is accurate. We only submit applications automatically in countries where you have told us you may work.

All personal data is processed and stored within the United States via the following infrastructure:

• Supabase (AWS us-east-1): Database, authentication, file storage

• AWS (us-east-1): Application pipeline compute (job matching, application submission, email scanning)

• Vercel (global edge network): Web application hosting

• Anthropic (United States): AI processing

• TypeSafe, via Vercel AI Gateway (United States): AI classification and checking, zero data retention

If you use the Service from outside the United States, your personal information is transferred to and processed in the United States by the infrastructure listed above. When you ask us to apply to an employer in another country, your application information is sent to that employer, in that country, at your direction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last Updated" date at the top indicates the most recent revision.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Zink Labs LLC

Email: [email protected]

Web: https://jobagent.sh

Florida residents may also contact the Florida Attorney General's office with privacy complaints:

Office of the Attorney General, State of Florida
PL-01, The Capitol, Tallahassee, FL 32399-1050
Phone: 1-866-966-7226
Online: MyFloridaLegal.com