AJOS ("we", "our", "the platform") processes personal data in accordance with the Personal Data Protection Act 2010 (PDPA Malaysia). This policy explains what we collect, who processes it on our behalf, how long we keep it, and the rights you have over it.
The data controller can be reached at aminmod06@gmail.com for any question about this policy or about your data. Section 12 sets out the specific requests we act on.
1. What We Collect
Account & authentication: your email address, sign-in method (email/password or Google), email-verification status, and account timestamps, managed through Firebase Authentication. We never see or store your plaintext password.
Profile & resume content: the fields you choose to provide, such as full name, education, skills, languages, projects, contact email and phone, LinkedIn and portfolio links, and any resume text you paste. Supplying these is optional; the platform works without them, though matching and drafting are weaker.
Search activity: the job titles, locations, industries and company names you search for, together with the results returned. Kept per account and expiring automatically. Results are also held briefly in a shared cache, described below.
Usage counters: how much of your monthly quota you have used, plus short-lived rate-limiting counters keyed by account or IP address to prevent abuse. These expire automatically.
Device storage: short-lived caches of your current search results and match scores, held in your browser's local storage. These are cleared when you sign out. No theme preference is stored, because the app is dark only.
Technical data: IP address, browser user agent, and request timestamps recorded incidentally by our hosting providers and in security logs.
Shared search cache. So that the same search is not scraped twice, results are cached on our servers and reused across accounts. This means the search terms behind a cached result are held server-side rather than being tied to your account: job searches for up to one hour, company searches for up to seven days. A cache entry contains no account identifier, so it cannot be used to work out what any individual searched for.
We do not collect payment or financial data, and we do not use advertising trackers, analytics pixels, or third-party cookies.
2. What We Never Do
We do not sell, rent, or trade your personal data, resume content, or search history.
We do not share your data with recruitment agencies, employers, advertisers, or data brokers.
We do not contact employers on your behalf. Anything the platform generates is yours to review and send.
We do not build advertising profiles or share your data for cross-context behavioural advertising.
3. How We Use Your Data
To authenticate you and keep your session secure.
To enforce monthly quotas and prevent abuse.
To return job and company results relevant to what you searched for.
To parse your resume, score job matches, generate interview preparation guidance, and draft outreach text, but only when you ask for it.
To restore your working state when you return to a page.
We do not use your data to train AI models, and our providers are configured not to either.
4. Third-Party Processors
We rely on the providers below to run the service. Each receives only what it needs to perform its function:
Google Cloud / Firebase: account authentication and database hosting. Your account, profile, and search data are stored in Firestore.
Groq: AI inference. When you parse a resume, request an outreach draft, generate interview preparation questions, open a job match breakdown, or run a company search, the relevant text (resume content, job or company details, search keywords, and, for match breakdown or interview coaching, your skills, education, and relevant background) is sent to Groq for processing. It is not used to train models.
Have I Been Pwned: password breach checking, using k-anonymity. Your password is hashed in your browser and only the first five characters of that hash are sent. The password itself, and the remainder of the hash, never leave your device.
Google Places: company and business directory lookups.
Cloudflare Turnstile: bot detection on registration and password reset.
Vercel and Northflank: application and scraper hosting.
Job boards: public listings are retrieved from LinkedIn, Indeed, JobStreet, RemoteOK, We Work Remotely, Arbeitnow, and Jobicy. This retrieval involves no personal data about you beyond the search terms you entered.
5. Company Contact Data
The contact-scraping feature reads publicly accessible pages of company websites and extracts business contact details already published there. That data relates to organisations, not to your account, and is cached so the same site is not repeatedly fetched. If you represent a business and want its details purged from our cache, contact us and we will remove them.
6. Retention
Account and profile data: retained while your account is active, and deleted when your account is deleted.
Search results and session state: expire automatically within hours. This is working state, not a permanent history.
Rate-limiting and quota counters: expire automatically on a rolling basis.
Cached company contact data: expires automatically, and contains no personal data about you.
Cached search results: shared across accounts and containing no account identifier. Job searches expire within an hour, company searches within seven days.
Deleted-account allowance record: when an account is deleted, we keep a record of how much monthly search allowance it had left, so that deleting and re-registering cannot be used to reset the allowance. It is keyed by a one-way SHA-256 hash of the email address (the address itself is not stored), carries no name or profile data, and is deleted automatically after 90 days.
7. Your Rights
Under the PDPA you may:
Access: view everything we hold about you in the Profile dashboard, or request a copy.
Correct: update your profile, resume details, or password at any time.
Erase: delete your account and associated records directly in your Profile settings at any time, or request deletion by contacting the platform administrator. This permanently removes your account, stored profile, and Firebase Authentication record.
What survives deletion: a one-way hash of your email address together with the search allowance you had left. Deleting an account would otherwise hand back a full monthly allowance, so re-registering with the same address within 90 days resumes the allowance you had rather than granting a new one. No email address, name, resume, or search result is kept, the hash cannot be reversed into your address, and the record expires automatically after those 90 days.
Withdraw consent: stop using the platform and request erasure. Note that some processing (security logging, quota enforcement) is necessary for the service to function safely.
Complain to the Department of Personal Data Protection (JPDP) Malaysia.
8. Security
All traffic is encrypted with HTTPS/TLS. Database access is restricted to our servers, credentials are scoped to the minimum required, and sessions end automatically after a period of inactivity. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.
9. International Transfers
Our providers operate data centres outside Malaysia, principally in Singapore, the United States, and the European Union. Using the platform therefore involves transferring your data internationally. We select providers that maintain industry-standard contractual and technical safeguards.
10. Children
The platform is intended for users aged 18 and above and is not directed at children.
11. Changes to This Policy
We may update this policy as the platform changes. Material changes are reflected in the "last updated" date above, and continued use after a change constitutes acceptance.
12. Contact
For any privacy question, data access request, or erasure request, contact the platform administrator at aminmod06@gmail.com. We aim to respond to any request promptly, and an erasure request removes your account record, your stored profile and any waitlist entry for your address.