Privacy Policy

Last updated: February 2026

CyberJobs Pro ("we," "us," or "our") operates the CyberJobs Pro platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Full name and email address
• Password (stored as a cryptographic hash, never in plain text)
• Role selection (job seeker or employer)

1.2 Profile Information

Job seekers may provide:

• Resume/CV uploads
• Professional certifications and credentials
• Security clearance level
• Desired salary and location preferences
• LinkedIn, GitHub, and personal website URLs
• Professional biography

Employers may provide:

• Company name, logo, and description
• Industry, size, and headquarters location
• Company website URL

1.3 Usage Data

We automatically collect:

• Job applications submitted and their status
• Bookmarked job listings
• Job alert preferences and filters
• Job search queries and filters used
• Page views and interaction data
• IP address, browser type, and device information

1.4 Payment Information

Payment details (credit card numbers, billing addresses) are processed directly by Stripe and are never stored on our servers. We retain only transaction identifiers and subscription status.

2. How We Use Your Information

• Job Matching: To match job seekers with relevant cybersecurity positions based on certifications, clearance level, and preferences.
• Job Alerts: To send email notifications about new job listings matching your saved alert criteria.
• Applications: To facilitate the job application process between job seekers and employers.
• Employer Review: To allow employers to review applicant profiles and manage hiring pipelines.
• Service Improvement: To analyze usage patterns and improve the platform experience.
• Security: To detect and prevent fraud, abuse, and unauthorized access.
• Communication: To send account-related emails (verification, password resets, billing confirmations).

3. Third-Party Services

We share data with the following third-party service providers, each under their own privacy policies:

We do not sell your personal data to any third party.

3.1 Affiliate Partners

Certification detail pages may contain affiliate links to exam registration providers. If you click an affiliate link and make a purchase, we may receive a commission at no additional cost to you. Affiliate partners may collect data according to their own privacy policies. We do not share your personal data with affiliate partners.

4. Cookies and Local Storage

We use only essential cookies required for:

• Authentication cookies: Session tokens managed by Supabase for secure login. These expire when you log out or after inactivity.
• Cookie consent preference: A localStorage flag recording whether you accepted or declined this cookie notice.

We do not use advertising, analytics, or tracking cookies. Sentry error monitoring may collect IP addresses in error logs but does not use cookies for tracking.

You may decline non-essential cookies via the cookie banner. Since we use only essential cookies for authentication, declining cookies may affect your ability to log in but will not affect browsing public pages.

5. Data Retention

• Active accounts: Your data is retained for as long as your account remains active.
• Deleted accounts: Upon account deletion, your personal data is removed within 30 days. Anonymized, aggregated analytics data may be retained indefinitely.
• Audit logs: Security-related logs (login attempts, account changes) are retained for 90 days.
• Backups: Database backups containing your data are automatically purged within 30 days of account deletion.

6. Your Rights

Under the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and similar data protection laws, you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you. Use the "Export My Data" feature in your account settings.
• Right to Rectification: Correct inaccurate or incomplete personal data via your profile settings.
• Right to Erasure: Request deletion of your account and associated data via the "Delete My Account" feature in account settings.
• Right to Data Portability: Receive your data in a structured, machine-readable JSON format via the data export feature.
• Right to Restrict Processing: Request that we limit how we use your data by contacting us directly.
• Right to Object: Object to the processing of your data for certain purposes by contacting us.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Row-level security policies on database tables
• Rate limiting on authentication and API endpoints
• CSRF protection on all state-changing operations
• Regular security audits and monitoring via Sentry

8. International Data Transfers

Our Service is hosted in the United States via Vercel. If you access the Service from the European Union, United Kingdom, or other regions with data protection laws, your information may be transferred to and processed in the United States.

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and other appropriate safeguards for transfers of personal data from the EU/UK to the United States. Our third-party service providers (Supabase, Stripe, Sentry, Vercel, Resend, Upstash) maintain their own data processing agreements and transfer mechanisms.

9. Data Breach Notification

In the event of a data breach that affects your personal data, we will notify affected users via email within 72 hours of becoming aware of the breach, as required by GDPR. We will also notify the relevant supervisory authority where required by law.

Breach notifications will include: the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed to address the breach.

10. US State Privacy Rights

10.1 California (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of personal information
• Opt out of the sale or sharing of personal information (we do not sell your data)
• Non-discrimination for exercising privacy rights
• Correct inaccurate personal information
• Limit use of sensitive personal information

To exercise these rights, use the data export and account deletion features in your account settings, or contact us at privacy@cyberjobspro.com.

10.2 Other US States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have similar rights to access, correct, delete, and port their personal data. To exercise these rights, use your account settings or contact us at the address above.

11. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

• Email: privacy@cyberjobspro.com