1. Who we are
NextJobStep Inc. ("we", "us", "our", "the Company") operates the job search, application tracking, and career platform at nextjobstep.com and app.nextjobstep.com (the "Service"). For all personal data described in this policy, NextJobStep Inc. is the data controller.
Privacy contact: privacy@nextjobstep.com.
We have not appointed a formal Data Protection Officer, as our current scale does not meet the threshold requiring one under GDPR Article 37. Privacy inquiries are handled directly by our team and answered within 30 calendar days.
2. Who this applies to
- Job seekers who create an account to track applications and receive recommendations
- College placement coordinators, verified institutional users managing placement activity for their students
- Employers who post opportunities on the platform
- Visitors to nextjobstep.com who haven't created an account
This policy is designed to comply with the EU General Data Protection Regulation (GDPR), and, where applicable, the California Consumer Privacy Act (CCPA) and India's Digital Personal Data Protection Act.
3. Data we collect
- Account data: Name, email, password (hashed, never stored in plain text), your primary career field, years of experience, college affiliation
- Profile data: Username, headline, bio, location, mailing address, profile photo (all optional)
- Education, experience, and skills: Schools, degrees, work history, projects, certifications, listed skills
- Job search preferences: Preferred job types, locations, salary range, remote/relocation preferences
- Uploaded documents: Resumes and cover letters (PDF or Word, up to 5MB), stored securely and used to help match you to roles
- Application tracking data: Job URLs you track, status, and any personal notes you add
- College data (where applicable): Your institution's name and affiliation, used to enable partnership features
- Notifications and feedback: Notification history and any feedback messages you send us
When you track a job by its URL, the listing itself (company, title, description) becomes a shared record other users can discover, this is separate from your personal application record, which is never shown to other users. See Section 7.
We do not intentionally collect special category data (health, religion, ethnicity, and similar, as defined under GDPR Article 9).
4. How we collect it
Directly from you
Account registration, profile updates, document uploads, job tracking, and any feedback you send us.
Automatically through use of the Service
Usage patterns, technical data (browser, device, IP address), and session activity, used to operate and secure the Service.
From sign-in providers
If you sign in with Google, we receive your name, email, and profile photo as authorised during Google's consent screen.
From job postings you track
When you submit a job URL, we retrieve the publicly available content of that listing. See Section 7.
5. Why we process it
- Contract performance: Running your account, authentication, application tracking, sending status notifications, resume processing
- Legitimate interest: Match scoring and recommendations, improving the Service, rate limiting and abuse prevention, security monitoring
- Consent: Google sign-in, where Google's consent screen applies
- Legal obligation: Responding to valid legal requests, such as a court order
6. AI and automated matching
We use an AI model to help match your profile to relevant job listings. This model runs entirely on our own servers, your resume and profile data is never sent to a third party to compute these matches, and none of your personal data is used to train or fine-tune any AI model.
Match scores are advisory only. They help surface relevant roles, but they do not determine your access to any job listing or to the Service itself, and no automated process makes a decision about you that has a legal or similarly significant effect. Jobs may also be suggested based on patterns among users with similar profiles; this uses aggregated data only and never reveals your identity to other users.
If you believe an automated process has affected you in a way you'd like reviewed by a person, or you'd like to opt out of pattern-based suggestions, contact privacy@nextjobstep.com.
7. Job posting data
When you submit a job URL for tracking, we retrieve the publicly available content of that listing, title, company, description, location, and similar details, so it can be added to your pipeline automatically. We only access publicly available pages: we do not bypass logins, paywalls, or CAPTCHAs, and this data is used solely to support your own job search, not republished elsewhere.
9. International transfers
Your data is stored on our own servers in the EU. Where a provider listed in Section 8 is located outside the EEA, we rely on the EU Standard Contractual Clauses or, for UK-based providers, the UK's adequacy decision, as the legal safeguard for that transfer.
10. Data retention
- Account and profile data: kept while your account is active, deleted within 30 days of account closure
- Uploaded documents: kept until deleted or replaced by you
- Application records: kept until you delete them
- Shared job listing data (the public details of a role, not your personal application to it): retained as a shared resource, since it isn't personal data about you specifically
- Feedback submissions: kept for 2 years
- Security and access logs: kept briefly for operational and security purposes, then deleted or anonymised
12. Security
- All data in transit is encrypted (TLS)
- Passwords are hashed and never stored in plain text
- Uploaded documents and stored data are encrypted at rest
- Optional two-factor authentication is available, including authenticator apps, hardware security keys, and passkeys
- New and changed passwords are checked against known breach data before being accepted, without your actual password ever leaving our server
- Access to personal data is limited to what's needed for the Service to function, with role-based restrictions for institutional features
No system is completely immune to risk, but we design around minimising what could go wrong and how much it would matter if it did.
13. Your rights
Under GDPR and other applicable laws, you have the right to:
- Access: Get a copy of the personal data we hold about you
- Rectification: Correct inaccurate data (most of this you can edit directly in your account)
- Erasure: Request deletion of your data, subject to limited legal exceptions
- Restriction: Ask us to pause processing in specific circumstances
- Portability: Receive your data in a machine-readable format
- Object: Object to processing based on our legitimate interest
- Withdraw consent: Where processing relies on consent, withdraw it at any time
- Automated decisions: Request human review of any automated outcome, see Section 6
To exercise any of these, email privacy@nextjobstep.com. We respond within 30 calendar days (extendable by up to 60 additional days for complex requests, with notice). You also have the right to lodge a complaint with your local data protection authority, including Ireland's Data Protection Commission at dataprotection.ie.
14. Deleting your account
You can delete your account at any time from your account settings. When you do, your profile, uploaded documents, application records, and any AI-derived data about you are removed, and identifying details in logs are anonymised shortly afterward. You can also request a full export of your data, or delete individual pieces of it (like a single application or education entry) without closing your account, by contacting privacy@nextjobstep.com.
15. Children's privacy
The Service is not directed at anyone under 16, and we do not knowingly collect data from children under that age. Institutional features for college placement coordinators are only accessible to verified staff and are used solely for placement purposes on behalf of enrolled students. If you believe a child has provided us data, contact privacy@nextjobstep.com and we'll delete it.
16. Data breach notification
If a personal data breach occurs, we will notify the relevant supervisory authority within 72 hours where required, and notify affected users without undue delay where the breach poses a real risk to you, by email, in-app notice, and a notice on our website, along with what happened and what we're doing about it.
17. Communications
We send account-related messages only, verification, password resets, application status updates, and similar, since these are necessary for the Service to work. We do not send marketing emails, promotions, or newsletters.
18. Third-party links
The Service links to external sites, such as the job postings you track. We aren't responsible for how those sites handle your data. If you sign in via Google, Google's own privacy policy also applies to that part of the experience.
19. Changes to this policy
We may update this policy as our practices evolve. Material changes will be communicated by email at least 30 days before they take effect, along with a notice on the site. Continuing to use the Service after that point means you accept the update; if you don't, you can delete your account beforehand.
20. Contact us
General privacy questions or data requests: privacy@nextjobstep.com
Security concerns specifically: security@nextjobstep.com
NextJobStep Inc. All rights reserved.