Legal

Data Processing Addendum

Last updated: June 5, 2026

This Data Processing Addendum ("DPA") supplements the Terms of Service and Privacy Policy between DataMCP LLC ("Processor" or "we") and the customer using Jobs Tomato ("Controller" or "you").

1. Roles

For personal data you upload about yourself (your CV, profile, applications), you are the Controller and DataMCP is the Processor, processing data on your instructions to provide the Service.

For account administration, billing, security, and product analytics, DataMCP acts as an independent Controller as described in the Privacy Policy.

2. Subject matter & duration

• Subject matter: Processing of personal data submitted to Jobs Tomato for CV tailoring, job tracking, and application assistance.
• Duration: For the term of your subscription or account, plus retention periods in the Privacy Policy.
• Nature & purpose: Hosting, parsing, AI-assisted rewriting, PDF generation, storage, and transmission per your use of the Service.
• Categories of data subjects: You (the job seeker) and, incidentally, references or contacts mentioned in your CV.
• Types of personal data: Identity, contact, employment history, skills, compensation preferences, work authorization, optional EEO data, and application content.

3. Processor obligations

We will:

• Process personal data only on documented instructions from you (your use of the Service and settings), unless required by law.
• Ensure personnel with access are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see Section 5).
• Assist with data subject requests where feasible, via privacy@jobstoma.to.
• Notify you without undue delay of a personal data breach affecting your data where required by law.
• Delete or return personal data upon account deletion, subject to legal retention requirements.
• Make available information necessary to demonstrate compliance and allow reasonable audits on written request (no more than once per year, subject to confidentiality).

4. Subprocessors

You authorize us to engage subprocessors. We maintain contracts requiring subprocessors to protect data at least to the standard of this DPA. We will notify material subprocessor changes via this page.

Current subprocessors

Provider	Purpose	Location
Neon	PostgreSQL database hosting	USA / EU regions
Render	Application hosting, Redis	USA
Cloudflare	R2 object storage, CDN, DNS	Global
Stripe	Payment processing	USA / global
OpenAI	AI text generation for tailoring	USA
Resend	Transactional email (magic link, reset)	USA

Object to a new subprocessor by emailing privacy@jobstoma.to within 14 days of notice. If we cannot accommodate your objection, you may terminate the affected Service.

5. Security measures

Measures include, as appropriate:

• TLS encryption for data in transit.
• Access controls and least-privilege administrative access.
• Encrypted storage for sensitive credentials where applicable.
• Hosted infrastructure with reputable cloud providers.
• Logging and monitoring for abuse and incidents.

6. International transfers

Where personal data is transferred from the EEA, UK, or Switzerland to the United States or other countries without an adequacy decision, the parties agree that EU Standard Contractual Clauses (Module 2: Controller to Processor) and, for UK transfers, the UK Addendum to the EU SCCs, are incorporated by reference and apply to such transfers.

You may request executed copies of transfer mechanisms by contacting privacy@jobstoma.to.

7. Special category data

If you submit EEO or similar sensitive data, you represent that you have a lawful basis (typically explicit consent) to provide it and instruct us to store and transmit it when you use application features. We process such data only per your configuration and the Privacy Policy.

8. Liability & order of precedence

Liability between the parties is governed by the Terms of Service. If this DPA conflicts with the Terms regarding GDPR/UK GDPR processing obligations, this DPA prevails for those obligations.

9. Contact

DataMCP LLC
30 N Gould St Ste R, Sheridan, WY 82801, USA
Data protection: privacy@jobstoma.to