A job search touches some of your most personal data — your history, your contacts, your reasons for leaving. JobEmber is built so that data goes only where you allow it, is never used to train a model, and can be erased in one click.
Your writing samples, voice profile, generated documents, feedback, and help-chat content are never used to train, fine-tune, or evaluate any model — ours or a provider's. Model providers are configured on no-training terms where offered.
With PII redaction on, your name, email, phone, address, and target cities are swapped for placeholders before any prompt leaves for a provider. The real values stay in your account and are re-inserted only when you download a finished document.
The samples you upload to build your writing voice are deleted the moment the voice profile is generated. The profile persists; the raw samples don't. A product commitment, in the Terms.
Your tier decides which providers run your sensitive documents. Higher tiers keep sensitive work on no-training providers only.
| Tier | Providers | Sensitive ops (CV / CL / voice) |
|---|---|---|
| Free | Gemini (free) + Ollama (local) | Generation disabled — demo only |
| Low | DeepSeek + Gemini | May be processed by providers that train on API data |
| Medium Recommended | Anthropic + DeepSeek | Anthropic only (no training, no retention) |
| High | Anthropic only | Anthropic — full pipeline, no DeepSeek, no Gemini |
The exact processors, locations, and transfer mechanisms are listed on the Sub-processors page. Cost per tier is on the Pricing page.
Text from job postings, uploaded files, and forms is untrusted by design: it's wrapped, regex-screened, judged by a separate model, and schema-validated. A posting that tries to hijack an agent is dropped, logged, and skipped — the pipeline continues without it.
Every document, match, and template is scoped to your account. Agents run against your data only; one user's run can never read another's rows.
JobEmber drafts and tracks. It never submits an application, sends a message, or contacts an employer on your behalf. You review, edit, and send every one yourself.
Erase everything, in one click. GDPR Article 17 right to erasure is built in — a full cascade deletes your profile, templates, documents, matches, and sign-in links. What survives is anonymized proof-of-consent that the law requires.
Export your data. Access and portability of the data you gave us, on request.
You own the outputs. Every CV, cover letter, and message JobEmber helps you produce is yours. You're the author and the sender.
Complain to a regulator. EU/EEA users can complain to their data-protection authority; ours is Romania's ANSPDCP.
Full detail in the Privacy Policy. Security reports: [email protected]. Privacy questions: [email protected].