Privacy policy

The controller of your data is Landry Dubosson, who runs the service under the trading name Jobunt.

For any question about your data or to exercise your rights, write to [email protected]. Jobunt has not appointed a data protection officer: your requests go directly to the controller, who answers them personally.

This policy concerns everyone whose data Jobunt processes: people who visit jobunt.ch, people with an account, with or without a Pro subscription, people whose business contact details appear in the company directory or in a job listing, and people who receive an application sent with Jobunt.

When you create an account, we record your email address and your password, hashed with argon2 and never stored in plain text, as well as the sign-up date, your language, the date of your last activity, the version of the terms you accepted and the date of that acceptance. Your profile adds your first name, last name, email signature and, if you wish, your phone number and home address, which is used to calculate distances.

To draft and send your applications, you give us your Gemini API key and your mailbox's app password. They are encrypted in the database, with a key kept outside it, and are used only for the applications you request. The text of your CV is stored on our server to draft your letters. The file itself stays in your browser: it passes through our server, without being kept there, when it is sent as an attachment to an application.

For each application, we keep the company and job targeted, the letter and email drafted, the recipient's address, the sending and follow-up dates, and the status and replies you record. We also record the occupations, keywords and places you search for. If you subscribe to Pro, we know your Stripe customer ID, the plan, the currency, the status and the dates of your subscription, but never your card details. Finally, we keep the emails you send us and our replies.

Only the email address, password, first name and last name are required: without them, we can neither open the account nor sign your applications. Everything else is optional, even though some features depend on it. Your profile photo, CV files and display preferences stay in your browser; details are in the cookie policy.

Like any website, our server keeps a log of the requests it receives: IP address, date and time, page requested, browser used and response code. Cloudflare derives your country from your IP address, which lets us choose the language and currency displayed.

On the sign-up and forgotten password pages, the Cloudflare Turnstile bot check analyses technical signals from your browser. When an error occurs, a technical report is sent to Sentry, without IP address or email address. Jobunt only sets cookies that are necessary for the service.

Some data does not come from you. The company directory and the job listings are built from the public sources described below. When you paste the link to a job ad, our server reads that page at your request. Stripe informs us of the status of your payments and subscription, and Google returns the texts Gemini drafts from your requests.

We process your data first and foremost to provide the service you request: searching for companies and jobs, drafting, sending, following up and tracking your applications, and supporting you. The legal basis is then the performance of the contract (Art. 6(1)(b) GDPR). The same applies when we write to you about your account, for a confirmation, a password, inactivity, your subscription or a change to these texts. Jobunt never sends advertising.

Billing for the Pro plan and bookkeeping are based on the contract and on our legal obligations (points (b) and (c)). Protecting the service against abuse, through the bot check, rate limits, logs and error reports, is based on our legitimate interest in the security of the service and its users (point (f)).

Keeping the company directory is based on our legitimate interest, and that of job seekers, in reaching employers through the channels they publish themselves (point (f)). The same applies to the overall statistics we produce, without individual profiles, to improve the service. Finally, we may use your data to respond to an authority or defend our rights in a dispute, on the basis of our legal obligations and our legitimate interest (points (c) and (f)).

Under Swiss law, this processing complies with the principles of the FADP: lawfulness, good faith, proportionality, purpose limitation and accuracy (Art. 6 FADP). Where processing is based on our legitimate interest, you can object to it at any time, as explained in the “Your rights” section.

We do not ask you for any sensitive data, such as information about your health, opinions, religion or origin. If your CV or letters contain any, they are used only to draft and send the applications you request. Avoid including anything an employer does not need to know.

Letters and emails are drafted by Gemini, Google's AI model, with your own API key. Each request contains the relevant extracts from your CV, your profile, the job listing and information about the target company.

Google processes these requests under the terms that apply to your key. On the free tier, Google may use the content to improve its products, and people may review it. On a paid tier, Google states that it does not. Jobunt never uses a key of its own for your data, and does not use it to train a model.

Jobunt ranks companies and jobs according to your search. This ranking has no legal effect and decides nothing for you. No decision about you is taken in a fully automated way: drafted texts remain drafts, and nothing is sent without your action.

Your data is neither sold nor rented. It is passed only to the following recipients, and only as far as they need it. Hetzner Online GmbH, in Germany, hosts the server and the database. Cloudflare, Inc., in the United States, provides the network, protection against attacks, the Turnstile bot check and the loading of the PDF and Word libraries (cdnjs). Google Ireland Limited, in Ireland, stores an encrypted copy of our backups on Google Drive, which it cannot read: the key stays with Jobunt.

Resend, Inc., in the United States, sends the service emails. Stripe Payments Europe, Ltd., in Ireland, collects payment for the Pro plan if you subscribe; Stripe also processes your payment data as a controller, under its own policy. Functional Software, Inc., known as Sentry, in the United States, receives technical error reports, without IP address or email address. Google LLC, in the United States, drafts the texts with Gemini, under your own API key.

Your applications leave from your mailbox, and therefore through your email provider. The recruiters you write to receive what you send them and become responsible for it. We only disclose data to authorities where the law requires us to.

To find companies and jobs, our server consults public registers, OpenStreetMap and Job-Room. Your IP address is never passed to these sources. If Jobunt's business were taken over by a third party, your data would be transferred to it with the service. You would be informed in advance and could delete your account before the transfer.

The server is in Germany. Germany and Ireland provide adequate protection, as recognised by the Swiss Federal Council.

Providers based in the United States are certified under the Data Privacy Framework (Swiss–US and EU–US) or bound by the European Commission's standard contractual clauses, recognised by the Federal Data Protection and Information Commissioner (FDPIC). A copy of these safeguards can be requested at [email protected].

So that you can apply, Jobunt keeps a directory of Swiss companies and a list of job listings. They are built from public sources: the commercial register (Zefix, LINDAS) and the Geneva cantonal business register, OpenStreetMap, jobs published on Job-Room, the public employment service platform, and the public pages of company websites, such as their contact and legal notice pages, consulted directly or through the open Common Crawl archive.

The directory mainly contains company data: company name, address, sector, website, phone and contact email. It may contain named business contact details, for example an address [email protected] or the name of a job listing's contact person, where the company publishes them itself.

This data is used only to enable registered job seekers to apply. It is visible only once logged in, is not sold and is not used for any marketing. It is updated as the sources change.

If your contact details appear there, you can at any time request their correction or deletion, or object to their processing, at [email protected], without giving reasons.

Your account, profile, CV text and applications are kept as long as you use the account. After 12 months without logging in, the account is deleted automatically, with a warning email 30 days beforehand; logging in once is enough to keep it. Accounts with an active Pro subscription are not affected. You can also delete your account yourself, immediately, with the “Delete my account” button in your profile, or ask us to do so by email.

Codes and confirmation links expire quickly: 15 minutes for a code, 60 minutes for a password reset link, 24 hours for a confirmation link. Server logs are kept for 30 days, as are texts already drafted by Gemini, which we cache so as not to repeat the same request. Error reports are kept for 90 days at most at Sentry.

Our encrypted backups are kept for 4 weeks on the server and 8 weeks for the off-server copy: deleted data disappears from them within that period at the latest. We keep our exchanges with you for as long as it takes to handle your request, then for as long as a complaint remains possible. Accounting records, invoices and payments, are kept for 10 years, as required by Swiss law (Art. 958f of the Code of Obligations).

You can at any time find out whether we process data about you and learn which data, where it comes from, why we process it, to whom it is passed and how long it is kept. You can have it corrected if it is inaccurate, have it deleted, request that its processing be restricted and object to processing based on our legitimate interest.

You can also receive the data you gave us in a common format, or have it sent to another service. If any processing were ever based on your consent, you could withdraw it at any time, without affecting what was done before.

Write to [email protected] from your account's email address. If we have doubts about your identity, we may ask you to confirm it. The reply is free of charge and reaches you within 30 days. If a request is complex, this period may be extended: we will then tell you so, with the reason.

You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch) or, if you live in the European Union, with the data protection authority of your country of residence or work.

Passwords are hashed with argon2. Your API key and mailbox credentials are encrypted in the database, with a key kept outside it. All connections use HTTPS, and the session cookie is signed, inaccessible to scripts (HttpOnly) and restricted to the site (SameSite=Lax). The server has no open web port and can only be reached through Cloudflare. Backups are encrypted, and access to production is restricted to the controller.

If a data security breach poses a high risk to you, we will inform you and report it to the FDPIC or the competent authority, as the law requires.

Jobunt is for people aged 16 and over. If you learn that an account belongs to someone younger, write to us and it will be deleted.

Jobunt only uses cookies needed for the service. The full list is in the cookie policy.

We may update this policy. The date at the top of the page shows the latest version. We will tell you about any significant change by email before it takes effect.