This Privacy Policy explains how AIDEMAIN LTD ("we", "us", "our") collects, uses, shares, and protects your personal data when you use MyJobs Tracker, our early-access web application at myjobs.zubiaojiang.com (the "Service"). It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are the data controller for the personal data described here. AIDEMAIN LTD is registered in England and Wales under company no. 17112411 and with the ICO under reference ZC111842; our registered office is 124 City Road, London EC1V 2NX, United Kingdom. To ask questions or exercise your rights, contact public@zubiaojiang.com.
This document is written in English; the Chinese text is a courtesy translation for convenience. If the two versions differ, the English version prevails.
Please note: this is plain English, not a substitute for independent legal advice. Because MyJobs Tracker uses AI, parts of the content you provide are sent to third-party AI providers outside the UK — only in the United States and the EU. We explain this below so you can make an informed choice.
1. Quick summary
- We collect your email, the profile/CV content you give us, your tracked applications, AI chat history, AI-generated documents, some usage metrics, and a salted hash of your IP address (never your raw IP).
- We use it to run the Service, sign you in, generate AI output, keep the Service secure, and improve it.
- To generate AI output we send relevant content to AI providers only in the United States and the EU (listed below).
- We do not sell your data and do not use your content to train our own AI models.
- You can export and delete your data yourself, and you have full rights under UK law, including complaining to the ICO.
2. The data we collect
- Account data: your email, for sign-in and service messages.
- Profile & CV content: what you provide — CV details, uploaded CVs, photos/screenshots, voice notes (files stored in Cloudflare R2). May include data about you and, if you add it, others.
- Job-tracking data: the applications, roles, companies, statuses and notes you record.
- AI chat history: your messages with AhBiao and the context you provide.
- AI-generated documents: the reviews, CVs and cover letters created for you.
- Assistant action log: when you ask AhBiao to change your board or profile (and confirm the change), we record the action type and the names of the fields changed — never the content — for security, support and abuse prevention.
- Usage metrics: limited technical/usage info such as token counts, to run, meter and improve the Service. This includes first-party, server-side usage-event analytics — a count of which product steps you reach (e.g. sign-up, role added, AI review, document generation), keyed to your sign-in session when you are signed in, plus — at sign-up — a short tag for the channel that brought you to us (e.g. a link tag like “xhs” or the referring site’s domain; captured from the link you clicked, kept only for your browser session before sign-up, never an advertising identifier) — on public pages (the landing page and the free sponsor-licence checker) we count only the bare event, e.g. a page view or a check's result status, with no identifier at all — and stored without any advertising/device identifier. Purpose: improving the product. Basis: legitimate interests (UK GDPR Art 6(1)(f)); retention: 90 days; you can object at any time (Art 21).
- Anti-abuse data: a salted (one-way scrambled) hash of your IP address, used to detect abuse and automated sign-ups and for per-IP throttling at sign-up, sign-in, verification-code sending and the free sponsor-licence checker. We do not store your raw IP for this.
- Public sponsor-licence checker: the free checker works without an account. When anyone runs a check we store a salted, one-way hash of their IP solely to throttle per-IP usage (the throttle counter is kept for about 24 hours) and record an anonymous "sponsor_check" usage event carrying only the result status — no identifier. The checker looks up our copy of the public gov.uk sponsor register (public sector information licensed under the Open Government Licence v3.0). Basis: legitimate interests in providing and protecting a free public tool.
- Cookies & device data: see our Cookie Policy — a sign-in cookie, a pre-launch access cookie, and a security check at sign-up and, after repeated failed attempts, at sign-in and password reset (Cloudflare Turnstile). Local storage holds non-identifying interface preferences and one-time-tip flags — your theme (including the landing-page theme), language, target date, board view and tour/tips-seen flags — plus your cookie-consent choice.
We do not ask for special-category data (health, religion, race or ethnicity). Please avoid putting such data in your CV or chats unless necessary; if you do, you are choosing to provide it to us and the AI providers that process it.
If the content you add includes other people's personal data (for example a referee), please only add it where you are entitled to. Those individuals can contact us at public@zubiaojiang.com to exercise their rights.
3. Why we use your data (lawful basis)
- To provide the Service — account, sign-in, storing content, generating reviews/drafts, and sending content to AI providers to produce output. Basis: performance of a contract.
- To keep the Service secure & prevent abuse — Turnstile (at sign-up and, after repeated failed attempts, at sign-in and password reset) and salted IP hashes for per-IP throttling, including on the free public sponsor-licence checker, which works without an account. Basis: legitimate interests in protecting the Service and users; we consider this limited, privacy-protective processing proportionate.
- To screen content for safety & enforce our Acceptable Use rules — we run an automated safety check over your messages and uploaded material (via the same US AI gateway, under zero-data-retention). Basis: legitimate interests in keeping the Service and other users safe.
- To improve and maintain the Service — usage metrics (including first-party, server-side usage-event analytics), fixing problems, building features. Basis: legitimate interests; you can object (Art 21). We do not train our own models on your content.
- To communicate with you — sign-in links and important messages. Basis: contract; any optional marketing relies on consent you can withdraw.
- To meet legal obligations — lawful requests, records, and (once billing is live) tax/accounting. Basis: legal obligation.
You don't have to give us this data, but we need your email and the content you choose to add to create your account and generate AI output — without them the Service can't work. Marketing is optional.
4. AI providers & other sub-processors
Infrastructure: Cloudflare — hosting, the D1 database (your structured data), R2 storage (uploaded files, photos, screenshots, voice notes), Workers, Browser Rendering, and Turnstile (anti-bot at sign-up and, after repeated failed attempts, at sign-in and password reset).
AI gateway & providers — most AI runs through OpenRouter (United States) under a zero-data-retention policy: depending on the feature and model, relevant content (e.g. your CV text, a job description, your chat, or an uploaded image/voice note) is routed to a US-based inference provider and not stored. The underlying model providers act as OpenRouter's sub-processors: OpenAI (via Microsoft Azure), Anthropic (via Amazon Bedrock), Google (Gemini) (via Google Vertex AI), and the open-weight DeepSeek, Qwen and GLM models on US inference hosts (e.g. Fireworks, DeepInfra, Together) — all in the United States. If you pick one of our optional Mistral (European) models, that content goes directly to Mistral AI (France, EU) under zero-data-retention instead — Mistral is EU-default (some of its own sub-processors may process outside the EU under Standard Contractual Clauses).
We have a Data Processing Agreement with OpenRouter and with Mistral AI, and zero-data-retention means these providers do not retain your content or use it to train their models. Zero-data-retention applies to the AI prompt and response content at the AI providers — it does not change how MyJobs itself stores your account and content (see section 6); as the gateway, OpenRouter keeps only limited request metadata (such as token counts and timing), not your content. We do not sell your data and do not train our own models on it. This list may change as we add or switch providers; we will keep this policy up to date. See our full Sub-processors page for the current list with locations.
Other processors (each receives only the data needed for its function, not your CV content): Resend — sends transactional & product emails (receives your email address and the email content); Google Analytics 4 — optional website analytics (US), loaded only if you accept analytics cookies (see the Cookie Policy); Google / Apple — only if you choose social sign-in; Stripe — card payments once paid plans are live (Stripe handles card details; we never see your full card number).
5. International transfers (US & EU)
- Transfers to the US (most AI, via OpenRouter and the US providers it routes to — OpenAI/Azure, Anthropic/Bedrock, Google/Vertex, and the US hosts serving DeepSeek/Qwen/GLM): we use the safeguards required by UK GDPR — the Article 46 standard data protection clauses (the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses) under our data-processing agreement with OpenRouter, together with our own assessment that the data protection test is met (recorded in our Transfer Risk Assessment) — plus encryption in transit and a zero-data-retention policy.
- Transfers to the EU (only if you choose a Mistral European model — sent to Mistral AI in France): the EU/EEA is covered by the UK's "adequacy" regulations, so no additional Article 46 safeguard is required for the EU transfer itself; Mistral applies zero-data-retention, and any onward sub-processing it makes outside the EU is covered by Standard Contractual Clauses.
- We do not send your content to AI providers in China.
6. How long we keep your data
- Account & content — while your account is active. Delete specific content and we remove it from live systems; close your account and we delete or anonymise your data, normally within 30 days, except where law requires retention.
- Sessions — the session cookie lasts ~30 days; email verification and password-reset codes expire after 15 minutes.
- Anti-abuse — the salted IP hash is kept only as long as needed to protect the Service; the public sponsor-checker throttle counter is deleted after about 24 hours.
- Backups — deleted data may persist in routine encrypted backups for up to ~30 days before being overwritten.
- Billing — once live, invoices/tax records kept for the period UK law requires (generally six years).
7. How we protect your data
We use appropriate measures including encryption in transit, access controls, reputable infrastructure (Cloudflare), password sign-in (PBKDF2-hashed) with one-time email verification codes — and optional Google/Apple sign-in, HttpOnly session cookies scripts cannot read, and anti-bot protection at sign-up and, after repeated failed attempts, at sign-in and password reset. No online service is perfectly secure, but we work to reduce risk and will notify you and the ICO of a breach where the law requires.
8. Your rights
Under UK data protection law you can: be informed; access a copy of your data; have it corrected; have it erased ("right to be forgotten"); restrict or object to processing (including processing based on legitimate interests); receive certain data in a portable format; and withdraw consent where we rely on it.
You are not subject to solely automated decisions with legal or similarly significant effects — AI output is advisory and you make all job-application decisions, so UK GDPR Article 22 is not engaged.
Exercise many rights yourself with the Export and Delete tools on your Account page; for anything else email public@zubiaojiang.com and we will respond within one month. These rights are usually free. You can withdraw marketing consent anytime — use the unsubscribe link in any marketing email, or the marketing toggle on your Account page.
9. Complaints
Please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
10. Children
MyJobs Tracker is not intended for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
11. Changes
We may update this policy, e.g. when we add or change a provider or feature. For significant changes we will give reasonable notice (email or in-app). The "last updated" date shows the current version.
Last updated: 6 July 2026.
12. Contact
AIDEMAIN LTD (company no. 17112411, registered in England and Wales; ICO registration ZC111842), 124 City Road, London EC1V 2NX, United Kingdom. Email: public@zubiaojiang.com.
本隐私政策说明 AIDEMAIN LTD（"我们"）在您使用 MyJobs Tracker（我们位于 myjobs.zubiaojiang.com 的早期访问网页应用，"本服务"）时如何收集、使用、共享和保护您的个人数据，旨在遵守英国《通用数据保护条例》（UK GDPR）和《2018 年数据保护法》。
对于本文所述个人数据，我们是数据控制者。AIDEMAIN LTD 在英格兰和威尔士注册（公司编号 17112411），并在 ICO 登记（登记号 ZC111842）；注册办公地址为 124 City Road, London EC1V 2NX, United Kingdom。如需提问或行使权利，请联系 public@zubiaojiang.com。
本文件以英文撰写；中文文本仅为方便阅读提供的参考译文。如两种版本存在差异，以英文版本为准。
请注意：本政策为通俗说明，不能替代独立法律意见。由于 MyJobs Tracker 使用 AI，您所提供内容的部分会发送给位于英国境外的第三方 AI 提供商——仅在美国和欧盟。我们在下文详细说明，以便您知情选择。
1. 简要概述
- 我们收集您的邮箱、您提供的资料/简历内容、您跟踪的申请、AI 聊天记录、AI 生成的文档、部分使用指标，以及您 IP 地址的加盐哈希（绝不存储原始 IP）。
- 用于运营本服务、登录、生成 AI 输出、保障安全并改进服务。
- 为生成 AI 输出，我们将相关内容仅发送给位于美国和欧盟的 AI 提供商（见下）。
- 我们不出售您的数据，也不使用您的内容训练我们自己的 AI 模型。
- 您可自行导出和删除数据，并享有英国法下的全部权利，包括向 ICO 投诉。
2. 我们收集的数据
- 账户数据：您的邮箱，用于登录和服务消息。
- 资料与简历内容：您提供的内容——简历详情、上传的简历、照片/截图、语音备忘（文件存于 Cloudflare R2）。可能包含您及（若您填入）他人的个人数据。
- 求职跟踪数据：您记录的申请、职位、公司、状态和备注。
- AI 聊天记录：您与阿彪往来的消息及上下文。
- AI 生成的文档：为您创建的评估、简历和求职信。
- 助手操作日志：当您要求阿彪更改看板或资料（并确认更改）时，我们记录操作类型和被更改字段的名称——绝不记录内容——用于安全、支持与防滥用。
- 使用指标：运营、计量和改进所需的有限技术/使用信息，如 token 计数。其中包括第一方、服务器端的使用事件分析——记录您到达了哪些产品步骤（如注册、添加职位、AI 评估、文档生成），登录后以您的登录会话为标识——在公开页面（落地页与免费担保资质查询）上，我们仅统计事件本身，例如页面浏览或查询的结果状态，不含任何标识符——且不使用任何广告/设备标识符存储。目的：改进产品。依据：合法利益（UK GDPR 第 6(1)(f) 条）；保留期：90 天；您可随时反对（第 21 条）。
- 反滥用数据：您 IP 地址的加盐（单向扰乱）哈希，用于检测滥用和自动化注册，并用于注册、登录、验证码发送及免费担保资质查询的按 IP 限流；不为此存储原始 IP。
- 公开担保资质查询：免费查询无需账户即可使用。任何人运行查询时，我们仅为按 IP 限流而存储其 IP 的加盐单向哈希（限流计数保留约 24 小时），并记录一条仅含结果状态、不含任何标识符的匿名 "sponsor_check" 使用事件。该查询检索我们保存的 gov.uk 公开担保人名录副本（依据开放政府许可证 v3.0 授权的公共部门信息）。依据：提供并保护免费公开工具的合法利益。
- Cookie 与设备数据：见《Cookie 政策》——登录 Cookie、发布前访问 Cookie，以及注册时和多次尝试失败后登录或密码重置时的安全验证（Cloudflare Turnstile）。本地存储保存不含身份的界面偏好和一次性提示标记——主题（含落地页主题）、语言、目标日期、看板视图和引导/提示已读标记——以及您的 Cookie 同意选择。
我们不要求特殊类别数据（健康、宗教、种族或族裔）。除非必要，请勿将此类数据填入简历或聊天；若填入，即表示您选择将其提供给我们及处理该数据的 AI 提供商。
若您填入的内容包含他人的个人数据（例如推荐人），请仅在您有权的情况下填入。相关个人可发邮件至 public@zubiaojiang.com 行使其权利。
3. 我们使用数据的目的（合法依据）
- 提供本服务——账户、登录、存储内容、生成评估/草稿，以及将内容发送给 AI 提供商以生成输出。依据：履行合同。
- 保障安全并防止滥用——Turnstile（注册时，以及多次尝试失败后的登录与密码重置时）与用于按 IP 限流的加盐 IP 哈希，包括无需账户即可使用的免费公开担保资质查询。依据：合法利益，保护服务与用户；我们认为此种有限、保护隐私的处理是适度的。
- 内容安全审查与执行可接受使用规则——我们对您的消息及上传内容进行自动安全检查（经同一美国 AI 网关，处于零数据保留之下）。依据：合法利益，以保障服务与其他用户的安全。
- 改进与维护服务——使用指标（含第一方、服务器端的使用事件分析）、修复问题、开发功能。依据：合法利益；您可反对（第 21 条）。我们不以您的内容训练自有模型。
- 与您沟通——登录链接和重要消息。依据：合同；任何可选营销依据您可撤回的同意。
- 履行法律义务——合法请求、记录，及（计费上线后）税务/会计。依据：法律义务。
您并非必须提供这些数据，但我们需要您的邮箱以及您选择填入的内容来创建账户并生成 AI 输出——没有这些，本服务将无法运作。营销为可选项。
4. AI 提供商及其他子处理方
基础设施：Cloudflare——托管、D1 数据库（结构化数据）、R2 存储（上传文件、照片、截图、语音备忘）、Workers、Browser Rendering，以及 Turnstile（注册时及多次尝试失败后登录/密码重置时的反机器人验证）。
AI 网关与提供商——大部分 AI 通过 OpenRouter（美国）在零数据保留政策下运行：视功能与模型而定，相关内容（如简历文本、职位描述、聊天，或上传的图片/语音）会被路由至美国推理服务商处理，且不予存储。底层模型提供商作为 OpenRouter 的子处理方：OpenAI（经 Microsoft Azure）、Anthropic（经 Amazon Bedrock）、Google（Gemini）（经 Google Vertex AI），以及开源权重的 DeepSeek、Qwen 与 GLM 模型（运行于 Fireworks、DeepInfra、Together 等美国推理主机）——全部在美国。若您选择我们可选的 Mistral（欧洲）模型，相关内容将直接发送至 Mistral AI（法国，欧盟）并处于零数据保留之下——Mistral 以欧盟为默认（其部分子处理方可能依据标准合同条款在欧盟以外处理）。
我们与 OpenRouter 及 Mistral AI 均签有数据处理协议；零数据保留意味着这些提供商不会保留您的内容或用其训练模型。零数据保留适用于 AI 提供商处的 AI提示与回复内容——并不改变 MyJobs 自身对您账户与内容的存储方式（见第 6 节）；作为网关，OpenRouter 仅保留有限的请求元数据（如 token 计数与时延），而非您的内容。我们不出售您的数据，也不以其训练自有模型。随着提供商增减或更换，此列表可能变化，我们将及时更新。完整清单（含所在地）见《子处理方列表》。
其他处理者（各自仅接收其功能所需的数据，不含简历内容）：Resend——发送事务性与产品邮件（接收您的邮箱地址与邮件内容）；Google Analytics 4——可选网站分析（美国），仅在您接受分析 Cookie 后加载（见《Cookie 政策》）；Google / Apple——仅在您选择社交登录时；Stripe——付费方案上线后处理银行卡支付（由 Stripe 处理卡信息，我们永不接触完整卡号）。
5. 国际传输（美国与欧盟）
- 传往美国（大部分 AI，经 OpenRouter 及其路由的美国提供商——OpenAI/Azure、Anthropic/Bedrock、Google/Vertex，以及服务 DeepSeek/Qwen/GLM 的美国主机）：我们采用 UK GDPR 要求的保障——我们与 OpenRouter 的数据处理协议下的第 46 条标准数据保护条款（英国《国际数据传输协议》IDTA，或对欧盟标准合同条款的英国附录），并结合我们自行作出的"数据保护测试已满足"的评估（记录于我们的传输风险评估 TRA）——并辅以传输中加密与零数据保留政策。
- 传往欧盟（仅当您选择 Mistral 欧洲模型时——发送至法国的 Mistral AI）：欧盟/欧洲经济区受英国“充分性”认定覆盖，故该欧盟传输本身无需额外的第 46 条保障；Mistral 实行零数据保留，其在欧盟以外的任何后续子处理均由标准合同条款覆盖。
- 我们不会将您的内容发送给中国的 AI 提供商。
6. 我们保留数据的期限
- 账户与内容——账户活跃期间保留。删除特定内容即从在线系统移除；注销账户后通常 30 天内删除或匿名化，依法须保留的除外。
- 会话——会话 Cookie 约 30 天；邮箱验证与密码重置验证码 15 分钟后失效。
- 反滥用——加盐 IP 哈希仅在保护服务所需期间保留；公开担保资质查询的限流计数约 24 小时后删除。
- 备份——已删除数据可能在常规加密备份中存留至多约 30 天后被覆盖。
- 计费——上线后，发票/税务记录按英国法律要求期限（通常六年）保留。
7. 我们如何保护数据
我们采取传输中加密、访问控制、信誉良好的基础设施（Cloudflare）、密码登录（PBKDF2 哈希）配合一次性邮箱验证码——以及可选的 Google/Apple 登录、脚本无法读取的 HttpOnly 会话 Cookie，以及注册时和多次尝试失败后登录/密码重置时的反机器人保护等措施。任何在线服务都无法绝对安全，但我们努力降低风险，并将在法律要求时向您和 ICO 通报泄露。
8. 您的权利
依据英国数据保护法，您可：知情；访问数据副本；更正；删除（"被遗忘权"）；限制或反对处理（含基于合法利益的处理）；以可携格式获取特定数据；以及在我们依赖同意时撤回同意。
您不受仅基于自动化、产生法律或类似重大影响的决定约束——AI 输出仅供参考，所有求职决定由您做出，故 UK GDPR 第 22 条不适用。
许多权利可通过账户页的「导出」与「删除」自行行使；其他请发邮件至 public@zubiaojiang.com，我们将在一个月内回复。行使这些权利通常免费。您可随时撤回营销同意——使用任何营销邮件中的退订链接，或账户页的营销开关。
9. 投诉
请先联系我们。您也有权向英国信息专员办公室（ICO）投诉：ico.org.uk，电话 0303 123 1113，或邮寄 Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF。
10. 儿童
MyJobs Tracker 不面向 16 周岁以下人士，我们不会在知情下收集 16 周岁以下儿童的数据。若您认为某儿童向我们提供了数据，请联系我们删除。
11. 变更
我们可能更新本政策，例如新增或更换提供商或功能。重大变更将给予合理通知（邮件或应用内）。"最后更新"日期标明当前版本。
最后更新：2026 年 7 月 6 日。
12. 联系我们
AIDEMAIN LTD（公司编号 17112411，于英格兰和威尔士注册；ICO 登记号 ZC111842）, 124 City Road, London EC1V 2NX, United Kingdom。电子邮件：public@zubiaojiang.com。
This is a plain-language summary for an early-access product, not formal legal advice. © 2026 AIDEMAIN LTD. All rights reserved.