1. Who is responsible for your data
The operator of getjobtools.com runs GetJobTools at getjobtools.com as an independent sole trader. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the operator is the data controller for everything described on this page. Under the California Consumer Privacy Act as amended by the CPRA, we act as a business.
Privacy questions, requests and complaints: support@getjobtools.com or the contact form. We are a one-person operation, so a person — not a ticketing bot — reads every request.
2. The short version
- The browser tools (word counter, QR code generator, image compressor, and the calculators) run entirely on your device. Your text, images and numbers are never sent to our servers.
- The AI tools have to send your text to a third-party model provider to produce a draft. We do not keep that text, unless you are on a plan with History switched on.
- We log usage metadata — which tool, which model, token counts, timing, success or failure — with no content in it, so we can enforce quotas and spot abuse.
- We show Google AdSense ads on free pages. Google and other ad vendors set their own cookies; §6 explains this and how to opt out.
- We do not sell or share your personal information, in the CCPA/CPRA sense or any other.
- You can delete your account, and everything attached to it, yourself from your profile page.
3. What we collect, feature by feature
Browser-only tools
The word counter, QR code generator, image compressor, words-to-pages, essay length checker, job offer comparison, pay raise, and notice period calculators execute in JavaScript in your browser. Nothing you type, paste, upload or calculate leaves your device, and we cannot see it even if we wanted to. No account is required and none of this is logged.
AI tools
The AI email writer, cover letter generator, paraphrasing tool, text summarizer, interview answer generator and counter-offer email generator require a logged-in account with a verified email address. When you press Generate:
- The text and options you entered are posted to our server and immediately forwarded to a third-party AI provider (§8) over an encrypted connection. We hold it in memory only for the length of that request.
- We write one row to our usage ledger containing: the tool name, the provider and model used, whether a site key or your own key was used, input and output token counts, latency in milliseconds, a status (
ok,failed,rate_limited), an error code if one occurred, and a salted SHA-256 hash of your IP address. This ledger never contains your text or the model's output. - We increment a per-user, per-day counter so we can enforce the daily run limit.
- If — and only if — your plan includes History and you have it enabled, the input and the generated output are stored against your account so you can read them again later. Free accounts have no History, so nothing is stored.
Your own API keys (BYOK)
You may save your own API key for Groq, OpenRouter, OpenAI, Google (Gemini API), Anthropic. The key is encrypted at rest using AES-256 with the application key held on the server, and only the last few characters are ever displayed back to you. It is used for one purpose: signing your own AI requests to the provider you chose. We do not use it for anything else, and you can delete it at any moment from Account → API keys, which removes the ciphertext from the database.
Account
Name, email address, a bcrypt hash of your password (never the password itself), a normalized form of your email used to detect duplicate sign-ups, your email-verification timestamp, plan and subscription status, and standard created/updated timestamps. At registration we also check the email domain's DNS records and a public list of disposable-email domains, and rate-limit sign-ups by IP address — an anti-abuse measure, not profiling.
Contact form
Your name, email address, subject, message, and the IP address the message was sent from.
Site analytics
We run our own minimal analytics instead of a third-party tracker. We store a daily count of views per URL path (no personal data at all), and, to count unique visitors, a SHA-256 hash of IP address + application secret + today's date. Because the date is part of the input, the hash changes every day and cannot be used to follow anyone across days, nor reversed back to an IP address.
Advertising
Google AdSense is loaded on free tool pages, the home page and the tools index. Google receives your IP address, user agent and the page you are on, and may read or write advertising cookies in your browser. See §6.
4. Legal bases (GDPR and UK GDPR)
If you are in the EEA or the UK, we rely on the following legal bases under Article 6(1):
| What | Why | Legal basis |
|---|---|---|
| Account data | To create and run your account and provide the tools you asked for | Contract — Art. 6(1)(b) |
| Text sent to an AI tool | To produce the draft you requested | Contract — Art. 6(1)(b) |
| Usage metadata and quota counters | To enforce fair-use limits, prevent abuse and keep the free tier affordable | Legitimate interests — Art. 6(1)(f) |
| Registration anti-abuse checks | To keep bots and disposable addresses out | Legitimate interests — Art. 6(1)(f) |
| Aggregate analytics | To see which pages are useful and which are broken | Legitimate interests — Art. 6(1)(f) |
| Encrypted API keys | To route your AI requests through your own provider account, at your request | Contract — Art. 6(1)(b) |
| Contact form messages | To answer you | Legitimate interests — Art. 6(1)(f) |
| Personalized advertising cookies | To show ads that pay for the free tools | Consent — Art. 6(1)(a) |
| Keeping records of payments (once Pro launches) | Tax and accounting law | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, we have weighed them against your rights: the data involved is minimal, pseudonymous where possible, and used only to keep the service running. You can object at any time (§11). Where we rely on consent, you can withdraw it at any time without affecting processing that already happened.
5. Advertising and Google AdSense
Free pages on getjobtools.com carry advertising supplied by Google AdSense. Pro subscribers see no ads.
- Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
- You may opt out of personalized advertising by visiting Google Ads Settings (
https://www.google.com/settings/ads). - You can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info/choices, or youronlinechoices.eu in Europe.
For the full detail of what Google collects when you visit a site that uses its services, read How Google uses information from sites or apps that use our services and the Google Privacy Policy. Opting out of personalization does not remove ads; it makes them non-personalized.
If you are in the EEA, the UK or Switzerland
Before any personalized advertising cookie is set, Google's certified consent management platform — the consent message we have enabled in AdSense → Privacy & messaging — asks for your choice and records it under the IAB Transparency & Consent Framework, as required by Google's EU user consent policy and the ePrivacy Directive. If you refuse, you will still see ads, but non-personalized ones. You can change your answer at any time from the Cookie settings link in our footer and in Google Ads Settings.
If you are in California or another US state with a privacy law
We do not sell personal information and we do not share it for cross-context behavioral advertising for money. Because some US state laws define "sale" and "sharing" broadly enough to cover advertising cookies, we treat the opt-out signals seriously: we honor Global Privacy Control browser signals where our ad partner supports them, and the "Do Not Sell or Share My Personal Information" choice is handled through the same Cookie settings link in our footer, which reopens Google's US state consent message and turns off personalized ads for this browser. You can also email us and we will apply it to your account.
6. Cookies and local storage
These are the only things GetJobTools itself stores in your browser:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
getjobtools-session | Cookie (strictly necessary) | Keeps you logged in and holds flash messages | Session / 120 minutes |
XSRF-TOKEN | Cookie (strictly necessary) | Cross-site request forgery protection on every form | Session |
remember_web_* | Cookie (functional) | Set only if you tick "Remember me" when logging in | Up to 5 years or until logout |
theme | Local storage | Remembers your light/dark mode choice | Until you clear site data |
cookie-notice-v1 | Local storage | Remembers that you dismissed our cookie notice | Until you clear site data |
Strictly necessary cookies do not require consent under the ePrivacy Directive or the UK PECR;
the site cannot log you in or submit a form securely without them. In addition, Google sets its
own advertising, frequency-capping and fraud-prevention cookies (such as __gads,
__gpi and IDE) on pages where ads appear — those are described and
controlled by Google at the links in §5. We run no Google Analytics, no Facebook pixel, and no
third-party analytics or heat-mapping tools.
7. How long we keep things
| Data | Kept for |
|---|---|
| Usage metadata (tool, model, tokens, timing, hashed IP) | 24 months, then deleted |
| Daily quota counters | 7 days |
| AI history (inputs and outputs) | Only if your plan includes History — 90 days on Pro, not stored at all on Free. Deleting an item removes it immediately. |
| Accounts that never verified their email | Deleted automatically 7 days after sign-up |
| Contact form messages | 12 months |
| Encrypted API keys | Until you delete the key or the account |
| Account data | Until you delete your account; deletion is immediate and cascades to quotas, history and keys |
| Aggregate page-view counts | Indefinitely — they contain no personal data |
| Daily unique-visitor hashes | 24 months; the hash is already unlinkable after the day it was made |
| Payment and invoice records (once Pro launches) | As long as tax law requires, typically 6–7 years |
8. Who else receives your data
We use as few processors as we can get away with. They are:
- AI model providers. Depending on the tool, the plan, and whether you added your own key, the text you submit to an AI tool is sent to one of: Groq, OpenRouter, OpenAI, Google (Gemini API), Anthropic. The default provider for free, site-key requests is Groq. If you saved your own key, your text goes to your account with the provider you picked, under that provider's terms and not ours. Each provider's own privacy policy governs what it does with the request; we send no account identifier, name or email with it.
- Google Ireland Limited / Google LLC — advertising (AdSense) on free pages, as described in §5.
- Our web host — stores the database and serves the site; it processes data only on our instructions.
- Our transactional email provider — sends verification, password-reset and notification emails, and therefore receives your email address.
- A payment processor (Stripe, Paddle or Lemon Squeezy — not yet selected, and no paid plan is live yet). When Pro launches it will handle card details directly on its own systems; we will never see or store a full card number.
We also disclose data if a law, court order, or valid request from a public authority requires it, and we would tell you unless legally barred from doing so. If the site is ever sold or transferred, your data would move with it and you would be told first. We never sell your data to data brokers, and we do not use your text to train any model.
9. International transfers
Our providers, and therefore your data, may be located in the United States and elsewhere outside the EEA and the UK. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the UK Addendum issued by the Information Commissioner's Office, or on the EU–US Data Privacy Framework where the recipient is certified under it (Google LLC is). For Canadian users, PIPEDA permits such transfers provided we remain accountable for the data, which we do. For Australian users, Australian Privacy Principle 8 applies to these disclosures.
10. Your rights
EEA and UK (GDPR / UK GDPR)
You have the right to:
- Access a copy of the personal data we hold about you (Art. 15).
- Rectify data that is wrong or incomplete (Art. 16) — name and email are editable in your profile.
- Erasure — delete your account and everything attached to it (Art. 17).
- Restrict processing while a dispute is resolved (Art. 18).
- Portability — receive your data in a structured, machine-readable format (Art. 20); we provide JSON.
- Object to processing based on legitimate interests (Art. 21).
- Withdraw consent for advertising personalization at any time (Art. 7(3)).
- Complain to your supervisory authority. In the UK that is the Information Commissioner's Office; in the EU, the authority in your country of residence.
We answer within 30 days, and we do not charge for it.
California (CCPA / CPRA)
- Right to know the categories and specific pieces of personal information we collected in the last 12 months, the sources, the purposes, and the categories of third parties we disclosed it to — §3 and §8 answer this in advance.
- Right to delete personal information we collected from you.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing. We do not sell personal information and we have not sold or shared it in the preceding 12 months. Our "Do Not Sell or Share My Personal Information" control is the Cookie settings link in the footer, which turns off personalized advertising for this browser.
- Right to limit the use of sensitive personal information — we do not collect any sensitive personal information as the CPRA defines it.
- Right to non-discrimination — exercising any of these rights changes nothing about the service or price you get.
Residents of Colorado, Connecticut, Virginia, Utah, Texas and other states with comprehensive privacy laws have equivalent rights, including the right to appeal a refused request; we apply the same process to everyone.
Canada (PIPEDA)
You may request access to your personal information and challenge its accuracy, and you may withdraw consent subject to legal and contractual restrictions. Complaints can be made to the Office of the Privacy Commissioner of Canada. Quebec residents additionally have rights under Law 25, including data portability.
Australia (Privacy Act 1988)
Under the Australian Privacy Principles you may request access to and correction of your personal information, and complain to us first and then to the Office of the Australian Information Commissioner if you are not satisfied with our response.
How to exercise any of this
- Delete everything: log in and use Delete account on your profile page. It is immediate and irreversible, and removes your account, history, quota rows and stored API keys.
- Delete history only: Account → History.
- Delete a stored API key: Account → API keys.
- Everything else (access, portability, correction, objection, opt-out): email support@getjobtools.com from the address on your account. If we cannot verify that a request is really yours, we will ask for more information rather than hand data to the wrong person.
11. Security
The whole site is served over HTTPS. Passwords are hashed with bcrypt and are not recoverable. API keys are encrypted with AES-256-CBC before being written to the database, and only the last few characters are ever rendered. Sessions and CSRF tokens use Laravel's signed, HTTP-only cookies. Access to the server and database is limited to the operator. No system is perfect: if a breach ever affects your personal data, we will notify the relevant supervisory authority within 72 hours as GDPR Article 33 requires, and tell affected users without undue delay.
12. Children
GetJobTools is intended for job seekers and students aged 16 and over, and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or under 16 in EEA countries that set that age for consent under GDPR Article 8). If you believe a child has given us data, email us and we will delete the account.
13. Changes to this policy
When we change this policy we update the effective date at the top of the page and, for changes that materially affect your rights, email registered users before the change takes effect. Continuing to use the site after that date means the updated policy applies.
14. Contact
The operator of getjobtools.com. Email support@getjobtools.com, or use the contact form. Related pages: our Terms of Service and our AI use disclaimer.