Legal

Privacy Policy

Last updated: June 5, 2026

This Privacy Policy explains how DataMCP LLC ("DataMCP," "we," "us," or "our") collects, uses, shares, and protects personal data when you use Jobs Tomato (the "Service"), including our website, web application, and related APIs.

Controller: DataMCP LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Privacy contact: privacy@jobstoma.to.

1. Scope

This Policy applies to visitors, registered users, and paying customers of Jobs Tomato. It does not cover third-party websites (employers, job boards, LinkedIn, etc.) that you interact with through or outside the Service.

2. Data we collect

Account & identity

• Email address, name, password hash (if you use password login), OAuth profile identifiers (if you use Google or similar).
• Subscription plan, billing status (payment card data is handled by Stripe - we do not store full card numbers).
• Consent records (terms acceptance, optional marketing opt-in).

Career & application data

• Master CV / résumé (uploaded PDF and parsed structured profile).
• Tailored résumés, cover letters, and generated PDFs.
• Job applications, CRM notes, application status, and job URLs.
• Onboarding preferences: target roles, skills, markets, work setup, compensation expectations.
• Screening profile: answers and strategies for employer application questions (work authorization, availability, links, etc.).
• Agent settings: how automated features should behave on your behalf.

Voluntary equal-opportunity (EEO) data

If you choose to provide EEO-related information (e.g., gender, ethnicity, veteran or disability status) for jurisdictions where employers request it, we treat this as special category data under GDPR Article 9 where applicable. We process it only:

• with your explicit consent at collection;
• to store and transmit it when you direct us to include it in an application; and
• as otherwise required to provide the Service you requested.

You may withdraw consent for optional EEO fields at any time by updating or deleting them in your profile. Withdrawal does not affect prior lawful processing.

Technical & usage data

• Session cookies and authentication tokens (see Cookie Policy).
• IP address, browser type, device information, and request logs for security and debugging.
• Product usage events (e.g., pages visited, features used) where analytics are enabled.

Communications

• Support emails and correspondence with our team.
• Transactional emails (sign-in links, password reset, billing receipts).
• Marketing emails only if you opted in (you may unsubscribe anytime).

3. How we use your data

Purpose	Legal basis (GDPR/UK GDPR)
Provide the Service (tailoring, PDF generation, CRM, agent features)	Contract performance (Art. 6(1)(b))
Account authentication and security	Contract; legitimate interests (Art. 6(1)(b), (f))
Payment processing via Stripe	Contract (Art. 6(1)(b))
AI processing of your CV and job descriptions to generate tailored documents	Contract (Art. 6(1)(b))
Store and submit EEO data when you request	Explicit consent (Art. 9(2)(a))
Marketing communications	Consent (Art. 6(1)(a)) - opt-in only
Improve reliability, prevent abuse, comply with law	Legitimate interests; legal obligation (Art. 6(1)(f), (c))

4. AI processing & your CV

We use third-party AI APIs (currently OpenAI) to tailor résumés and related content. Your documents are sent to these providers only to deliver output to you for the specific request.

• We do not use your CV to train public foundation models.
• OpenAI's API data usage terms apply to API traffic; we configure services for production use consistent with not using your content for model training.
• You should not include unnecessary sensitive data in your CV unless required for applications.

5. How we share data

We do not sell your personal data. We share data only with:

• Subprocessors that help us operate the Service (hosting, database, storage, email, payments, AI). See our DPA for the current list.
• Employers and job platforms when you submit or direct us to submit an application on your behalf.
• Authorities when required by law or to protect rights, safety, and security.
• Successors in a merger, acquisition, or asset sale (with notice where required).

6. International transfers

DataMCP is based in the United States. If you access the Service from the EEA, UK, or Switzerland, your data may be transferred to the US and other countries where subprocessors operate.

Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum with subprocessors. You may request more information at privacy@jobstoma.to.

7. Retention

• Account data: retained while your account is active and for a reasonable period after closure for backups, disputes, and legal compliance.
• CV and application data: retained until you delete it or close your account, unless we must retain copies for legal reasons.
• Billing records: retained as required for tax and accounting (typically 7 years).
• Logs: typically 30-90 days unless needed for security investigations.

8. Security

We use industry-standard measures including TLS in transit, access controls, encrypted credentials where applicable, and hosted infrastructure with reputable providers. No method of transmission or storage is 100% secure; please use a strong password and protect your account.

9. Your rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data.
• Export your data (portability).
• Restrict or object to certain processing.
• Withdraw consent (for consent-based processing).
• Lodge a complaint with a supervisory authority (e.g., your local data protection authority in the EU/UK).

California (CCPA/CPRA): We do not sell personal information. California residents may request access, deletion, and correction. We do not discriminate against you for exercising privacy rights.

To exercise rights, email privacy@jobstoma.to from your account email. We may verify your identity before responding.

10. Children

The Service is not directed to anyone under 18. We do not knowingly collect data from children. Contact us if you believe a child has provided data.

11. Changes

We may update this Policy. Material changes will be notified by email or in-product notice at least 30 days before they take effect where practicable.

12. Contact

DataMCP LLC (Jobs Tomato)
30 N Gould St Ste R, Sheridan, WY 82801, USA
Privacy: privacy@jobstoma.to
Support: support@jobstoma.to