Privacy Notice

1. Personal data we collect

• Account details: name, email address, password (stored only as a secure hash) and account type.
• Candidate profile: headline, location, bio, and the resume or portfolio link you provide.
• Applications: the jobs you apply to, your cover letters, and the status employers set.
• Employer details: company name, website, location and description, and the jobs you post.
• Technical data: IP address and session cookies needed to keep you signed in and to protect accounts.

2. Why we process it

• To create and secure your account.
• To let candidates find and apply to jobs, and employers post jobs and review applicants.
• To provide optional AI features (AI job search and cover letter drafts) when you choose to use them.
• To prevent fraud and abuse, and to comply with the law.

3. Who we share it with

• Employers you apply to. When you apply, the employer receives your name, email, profile, resume link and cover letter.
• Service providers who host and run JobUp on our behalf, such as our hosting and database providers.
• Anthropic (AI provider). If you use AI search or "Draft with AI", your request, and for drafts your profile and the job details, are sent to Anthropic to generate the result.
• Authorities, where the law requires it.

Some of these providers process data outside Malaysia. Where that happens, we take steps to make sure your data stays protected as required by the PDPA.

4. Is providing data compulsory?

Your name, email and password are needed to create an account; without them we can't provide the service. Profile details, resume links and cover letters are optional, but employers may be less able to assess your application without them.

5. How long we keep it

We keep your data while your account is active, and delete or anonymise it within a reasonable period after you close your account, unless we must keep it longer by law.

6. Your rights

You can ask to access or correct your personal data, withdraw your consent, or limit how we process it. You can update most details yourself from your profile or company page. For anything else, contact us at [privacy@your-domain.my]. We may charge a fee for access requests as the PDPA allows, and will respond within the time it requires.