Your privacy, treated with care.

Hejobb is a service provided by Effati Consulting AB, a Swedish company with its registered office at Tränsgatan 3, 183 74 Täby, Sweden (effati.se). Effati Consulting AB is the data controller for the personal data described in this policy. That means we decide why and how your data is processed, and we are responsible for protecting it under the EU General Data Protection Regulation (GDPR).

You can reach us about anything in this policy at privacy@hejobb.com, or through the company's general contact, info@effati.se.

This policy covers the Hejobb website and application. That includes creating an account, building a profile, uploading a CV, and receiving AI-assisted job matches for positions in Sweden. Browsing jobs, AI matching against your CV, cover letters written with the AI assistant and a weekly match digest with your top three matches are free. Hejobb Pro and Pro+ are optional paid subscriptions that add a fuller match digest at the frequency, day and hour you choose, instant match alerts, and extra CV profiles.

It does not cover the websites of universities or employers you reach through job listings on Hejobb. When you apply for a position, you do so on the employer's own site, under their privacy terms.

Hejobb is intended for job seekers and is not directed at children under 16. We do not knowingly collect data from anyone under 16; if you believe we have, contact us and we will delete it.

Account data. When you sign in with Google or LinkedIn, we receive your email address, first and last name, and profile picture URL from that provider. If you create an account with your email and a password instead, we store your email address, a one-way hash of your password (never the password itself), and whether you have confirmed your email address, plus the campaign details described below if the link that brought you to Hejobb carried campaign tags. If you change your email address, we keep the new address with a one-time confirmation link we send to it for up to 24 hours, switch to it once you open the link, and send a notice to your old address if you had confirmed it. If you connect Google or LinkedIn to your account in Account settings, we store which account at that provider is yours, so you can sign in with it. If you disconnect one, we note that, so it can't sign you in again until you reconnect it. If you turn on two-factor authentication, we store the secret your authenticator app uses, encrypted with a key kept outside the database, the time step of the last code you used so it can't be used twice, one-way hashes of your recovery codes (never the codes themselves) and when you turned it on. If you add a passkey, we store its ID, its public key, the name you give it, how your browser can reach it, the sign-in counter your device reports, whether your device syncs it, and when you added it and last used it. Your fingerprint, face or screen lock never leaves your device.

Profile data. Each CV profile holds the profession, availability, salary expectation and up to three academic fields that our AI reads from that CV. To change them, replace the CV. In each CV profile you can also set a career goal (grow, steady or both).

Your CV. When you upload a CV, we convert it to text and keep that text version. The original file is kept only while it is being processed, usually a few minutes, and is deleted automatically as soon as processing finishes or fails. From the text, our AI extracts profile fields (such as profession, academic fields and your career history). To change them, replace your CV. We also compute a numerical representation of your CV (an "embedding") that makes matching possible.

Billing data (only if you subscribe). If you choose Pro or Pro+, checkout runs on Stripe. Stripe collects your card details and billing address directly; Hejobb never sees or stores your card number. We keep your Stripe customer ID and a record of your subscription (plan, status and the end of the paid period) so we can give you access to paid features.

Email preferences. Your choices on the Notification settings page, which apply to all your CV profiles: whether the match digest and instant alerts are on, when and how often the digest arrives, the lowest match score and how many jobs it lists, the alert score, whether CV upload emails are on, the date until which you paused all emails, and whether and when you agreed to receive product news.

In-app notifications. We keep a record of each notification we show you in the app: its type (such as a CV read, new top matches, a cover letter ready or a change to your plan), its text, which can include a CV file name, a CV profile label, a cover letter's name (by default the job title) or, for a sign-in from a new country, the country, browser and device type and time, a link to the page it is about, the profile it belongs to, and whether and when you opened it. While you are signed in, your browser also connects to Ably for a live signal when a new notification arrives, which gives Ably your IP address and connection details (see the sections on transfers and service providers).

Contact messages. When you ask the support chat to pass a question to the team, we store your name, email address, your message, the time it arrived and, if you were signed in, your account ID. The message is also emailed to our team inbox so a person can answer you, together with a short AI-written summary of your chat so far; that summary is kept only in the email, not in our database. If you email us directly, your message is kept in that mailbox only.

Session data. Signing in sets one essential cookie containing a random session token. We store only a cryptographic hash of that token, and never the token itself. If two-factor authentication is on, signing in first sets a short-lived cookie with a random token while you enter your code; we store only a hash of it, with a count of wrong codes, for up to 10 minutes.

Sign-in security details. Each time you sign in, we store with that session the IP address you signed in from, the country it maps to (worked out from your IP address by Amazon CloudFront, our content delivery network) and your browser's user agent, which tells us the browser and device type. If a session doesn't have a country yet, we add the country of your connection the next time that session is renewed. We also keep a list of the countries you have used your account from, each with the last time you signed in from it or a session from it was renewed, without any IP address. We use these details only to keep your account safe: if you sign in from a country you haven't signed in from in the last 90 days, and you have signed in from at least one other country in that time, we email you and show a notification in the app, so you can act if it wasn't you. The first country we see for your account never triggers an alert. They are never used for statistics, analytics or advertising.

Country at sign-up. When you create an account, we store the country you signed up from, worked out the same way. We use it only to count new accounts per country as totals for internal statistics, never to make decisions about you.

Usage analytics (only with your consent). If you opt in, we use two analytics tools to understand how the app is used. Amplitude records sanitized page routes, coarse product actions (such as viewing a job, starting an application, uploading a CV or writing a cover letter) and your internal account ID. Google Analytics records the pages you view as sanitized routes, device and browser data, and an approximate location derived from your IP address, linked to a random cookie identifier rather than to your account. Analytics events never include your name, email, CV content or the identity of a specific job you viewed. See the cookies section below.

Ad conversion measurement (with your consent). We advertise Hejobb on Google, and with your consent Google Ads tells us which of our ads lead people to use the service. When you arrive by clicking one of our Google ads, the link carries a click identifier (gclid), which the Google tag stores in a cookie. The click identifier reaches Google Analytics only if you accept marketing. Conversions reach Google in two ways. With marketing consent, the Google Ads tag records two conversions directly in Google Ads: creating an account and completing a subscription checkout, the checkout with its amount, currency and transaction ID (Stripe's checkout ID). With analytics consent, Google Analytics records four actions as conversions: creating an account, adding your first CV, completing a subscription checkout (with the same amount, currency and transaction ID) and clicking through to apply for a job, and these can be imported into Google Ads. Google Ads links a conversion to your ad click only if you accept marketing. A conversion never includes your account ID, email, name, CV content or which job you applied for. We use this only to measure our own ads: no remarketing, no advertising audiences, no personalised ads, and Google signals stay off.

Campaign details (when you create an account). If the link that brought you to Hejobb carried campaign tags (utm_source, utm_medium, utm_campaign, utm_term and utm_content), we save them on your new account together with the page you landed on, when you create the account during that visit. Without campaign tags, we save nothing, not even the landing page. We use them only to see which campaigns bring sign-ups, based on our legitimate interest (Art. 6.1 f). We use no cookie or browser storage of our own for this: the details stay in the open page and travel with your sign-up, in the short-lived sign-in cookie for Google or LinkedIn or in the sign-in link we email you. They are deleted with your account.

Job listings. Hejobb also collects publicly posted job advertisements from the career pages of Swedish universities and university colleges (published through recruitment platforms such as Varbi and ReachMee) and from the open job ads data of Arbetsförmedlingen, the Swedish Public Employment Service (JobStream, published under CC0). Job listings are public pages that anyone can view without an account, and search engines may index them. An ad can name contact persons and their work email or phone number, as published by the employer, and Hejobb shows them as part of the public ad. These details come only from the public ad, and we process them solely to show the listing as published, based on our legitimate interest (Art. 6.1 f). If you are named in an ad and want your details removed from Hejobb, email privacy@hejobb.com.

Every use of your personal data rests on a legal basis under GDPR Article 6:

We never sell your personal data, we never use it to target or personalise ads, and we never use it to train AI models. The only advertising use is measuring our own Google ads, and only if you accept marketing.

Hejobb uses AI in seven specific, limited ways, and we want you to understand each of them:

1. Reading your CV. When you upload a CV, large language models convert it to text and suggest profile fields. These models are operated by Google and are called directly by us, with no routing intermediary, through Google Cloud's EU endpoint for Vertex AI, which processes the text inside the European Union. You can see the profession and academic fields the AI extracted on your profile page, and your career path, level and industries on its Career path card; to change anything the AI extracted, replace your CV.
2. Understanding job ads. AI helps us fill in missing details (such as city or academic field) and label the career level and industry in job listings collected from university career sites and from Arbetsförmedlingen, the Swedish Public Employment Service. This processing concerns job ads, not your profile.
3. Computing match scores. Your CV text is converted into an embedding by Cohere's embedding model, which we run inside Amazon Bedrock in AWS's EU regions rather than calling Cohere ourselves. The actual matching, which compares your embedding with job embeddings, runs entirely inside our own EU database, not at any AI provider. Career facts. From your CV the AI also derives your career path (job titles with a career level, whether each role managed staff, the industry, and the start and end years; employer names are not stored), a short description of your latest role without the employer's name, which is also turned into an embedding, the level of your latest role and the highest level you have held, whether your latest role manages staff (or that, in the three years up to the most recent role on your CV, you have held both a role that manages staff and a specialist role at about that level), up to three industries ordered by years worked and the industry of your latest role, and the Swedish municipality you live in, read from the address on your CV or, if there is none, from your current workplace. We use these facts to order your matches (for example, roles at your level, in your industries and near you come first), to set the level labels and the level filter described below, and to fill your Career path card. They never hide a job from you, and how long you have been in a role is never used to rank you. Replacing your CV replaces them; deleting the CV profile deletes them. Level labels. Each match can show whether the role is a step up, the same level or a step down compared with your level, which is the higher of your latest role's level and the highest level you have held: a step up is one level above it, the same level is that level or one level below it (never entry level unless you are at entry level), and a step down is anything lower. The label is an automated comparison of career levels, not an assessment of you, and you can filter your matches by it. Career goal. We only use the goal you choose, never a guess, and only to order that profile's matches. Roles hiring now. Your profile page shows the role titles of open job ads labelled a step up that are at least as similar to your CV and latest role as three quarters of your 50 best-ranked matches, and the role titles that come up at least twice among your 50 best-ranked matches labelled the same level, counting only matches in the occupation groups that make up at least 15% of the 50. These are counts of open job ads, not career advice.
4. Writing a cover letter, only when you ask for one. When you ask the AI assistant for a cover letter, its cover-letter writer sends your CV text, that job ad and your instructions to Google's Gemini model on Vertex AI's EU endpoint, the same provider that reads your CV. The letter is saved with its versions in our EU database until you delete it or your account, so you can come back to it, revise it and download it as a PDF.
5. Answering support questions. To find the help articles that match your question, the chat assistant first converts it into an embedding with Cohere's embedding model on Amazon Bedrock in AWS's EU regions. It then sends your chat messages, together with those articles, to Google's Gemini model on Vertex AI's EU endpoint to write a reply. We do not store the conversation; it stays in your browser tab.
6. Using the AI assistant, only when you open it. The AI assistant, available to signed-in users, answers your questions using your profile, CV text, matches, bookmarks and saved cover letters, which it reads when you ask it to revise or discuss one, and can bookmark a job or write a cover letter when you ask (see point 4). Your messages and that context are sent to Anthropic's Claude model, which we run inside Amazon Bedrock in AWS's EU regions. Unlike the support chat, your conversations with the assistant are stored in our EU database until you delete them. Answers can be wrong, so check anything that matters before you act on it.
7. Writing your shareable profile page. When you switch on the profile page for a CV, Google's Gemini model on Vertex AI's EU endpoint writes a short profile page from it. The next section explains what the page contains and who can see it.

Your data is never used to train AI models. Neither we nor our AI providers use your CV, profile, cover letters or any other personal data to train, retrain or fine-tune AI models. Amazon Bedrock and Google Cloud Vertex AI process your data only to return a result to us: under their terms, prompts and outputs are not used to train their models or shared with the model developers (such as Anthropic or Cohere) for that purpose. Hejobb does not train models of its own on user data either.

No automated decision-making with legal effect. Match scores are recommendations that help you prioritise, and nothing more. Hejobb never automatically accepts or rejects you for anything, and no decision producing legal or similarly significant effects is made about you by automated means (GDPR Art. 22). Whether and where you apply is always your decision, and hiring decisions are made by employers, outside Hejobb. If you ever have questions about how a match score was produced, contact us and a human will look into it.

When you switch on Public profile on your profile page, Hejobb's AI writes a short profile page from that CV. The text is written by Google's Gemini model on Vertex AI's EU endpoint, the same provider described in the AI section above.

What the page contains. Your name, a headline, a short summary, your skills, your experience (including the names of the organisations you worked for), your education and your languages, as read from that CV. It never contains contact details: no email address, phone number, personal identity number or links, and the generator rejects any text that includes them.

Where it lives. Each page has its own address on hejobb.com, made of /p/, your name and a random code.

Who can see it. You choose, separately for each CV profile, on your profile page:

• Off (the default). The page is hidden from everyone else, and its address returns "not found" to them. Only you, while signed in, can open it as a preview.
• Private. Only signed-in Hejobb users who have the link can open the page, and it tells search engines not to index it.
• Public. Anyone with the link can open the page, and search engines may index it.

View counts. While the page is Public, we count how many times it is opened each day and show you the total and the last 30 days. We store only the daily number: no IP address, browser details or cookies, nothing about who opened it, and no consent is needed. Obvious bots and your own visits while signed in are not counted.

How long it is kept. The generated text is kept while its CV profile exists, also while the page is set to Off. When you replace the CV while the page is Private or Public, the page is written again from the new one; a page set to Off is written again when you switch it back on. The text and its view counts are deleted when you delete that CV profile or your account.

Your account, profile, CV text and match data are stored and processed on AWS (Amazon Web Services) infrastructure located in the European Union. Our databases, backups and application servers all run in EU regions.

The AI models that read your CV, compute your embeddings and write cover letters also run inside the EU, so your CV is both processed and stored in the EU. On the way there, every request passes through Amazon CloudFront's content delivery network, which can route it through an edge location outside the EU/EEA (see International transfers). Opt-in Amplitude analytics are stored in Amplitude's EU data centre. Opt-in Google Analytics and Google Ads data is processed by Google, including on servers in the United States. Content delivery, signing in, account emails, match digests and alerts, live notification signals, Google Analytics, Google Ads and payments can involve providers outside the EU, as described in the next section.

AI processing stays in the EU. The models that read your CV, compute your embeddings and write cover letters run on Amazon Bedrock and Google Cloud Vertex AI, configured for EU processing: on Bedrock through EU inference profiles whose destination regions are all inside the EU, and on Vertex AI through Google's EU endpoint, which Google documents as processing the data inside the EU. We do not send your CV text outside the EU/EEA for AI processing.

Other parts of the service do involve providers established outside the EU/EEA, and data may be transferred there:

• Signing in with Google or LinkedIn. You authenticate on their systems, where they act as independent controllers under their own privacy policies.
• Content delivery through Amazon CloudFront, AWS's content delivery network. Every request from your browser to Hejobb passes through a CloudFront edge location, usually the one nearest you, which can be outside the EU/EEA, for example when you use Hejobb from outside Europe. There, CloudFront processes your IP address and the request, and works out the country you sign in from. Amazon Web Services is certified under the EU–U.S. Data Privacy Framework, and under the AWS data processing addendum the Standard Contractual Clauses apply.
• Account confirmation, password reset and security emails, which we send through Google's Gmail API. Only your email address and the message itself are involved; a new sign-in alert also names the country, device and time of the sign-in.
• Match digests and alerts. The match digest is on by default and sent separately for each profile, and instant alerts are sent only if you switch them on. Either can be turned off for all your profiles on the Notification settings page or from the unsubscribe link in any of them. They are also sent through Google's Gmail API. They include your email address, CV profile label, recommended jobs, match scores and unsubscribe links.
• Messages you send us through the support chat handoff or by email are delivered to our team inbox through Google's Gmail API and kept in that Google Workspace mailbox. They include your name, email address, topic and message, and for a chat handoff a short summary of the chat.
• Support chat messages are matched to help articles through an embedding computed on Amazon Bedrock in AWS's EU regions, and answered by Google's Gemini model on Vertex AI's EU endpoint, which Google documents as processing the data inside the EU. We do not store the conversation, and only a handoff to the team leaves that EU processing, as the bullet above describes.
• Google Analytics, only if you accept analytics. The service is provided by Google Ireland Limited, and Google LLC processes the data, including on servers in the United States. Google is certified under the EU–U.S. Data Privacy Framework, and standard contractual clauses apply as a fallback.
• Google Ads conversion measurement, only if you accept marketing. The service is provided by Google Ireland Limited, and Google LLC processes the data, including on servers in the United States, under the same Data Privacy Framework certification, with standard contractual clauses as a fallback.
• Payments through Stripe, only if you subscribe to Pro or Pro+. Stripe may transfer payment data to the United States. For its own legal and fraud-prevention obligations, Stripe acts as an independent controller under its own privacy policy.
• Live notification signals through Ably (Ably Realtime Ltd, based in the United Kingdom). While you have Hejobb's signed-in pages open, your browser keeps a connection to Ably so a new in-app notification shows up without reloading. The signal is an empty message on a channel named with a pseudonymous code derived from your account, never your account ID; the notification itself is then fetched from our servers in the EU. Ably sees your IP address and connection details, such as your browser type and when you are connected. We use Ably's standard global network, which can carry these signals through Ably data centres outside the EU/EEA. Under Ably's data processing addendum, Ably holds a signal only as long as it takes to deliver it (typically two minutes or less, at most 24 hours) and keeps IP addresses for up to 14 days. We do not turn on Ably's message history. Ably's data processing addendum includes the Standard Contractual Clauses.

Where such a transfer takes place, we rely on the safeguards required by GDPR Chapter V:

• Adequacy decisions (Art. 45), including the EU–U.S. Data Privacy Framework for certified US providers, and/or
• Standard Contractual Clauses (Art. 46) in our agreements with providers, together with supplementary measures where needed.

We keep these transfers as narrow as we can: only what the specific task requires is sent. Where providers act as our processors, they are bound by data processing agreements and our instructions. The profile and CV data in our own databases and backups remains in the EU; the emails, contact messages, analytics and ad measurement data, payment data and Ably's connection data (your IP address and the short-lived notification signals) described above may also be stored by the relevant providers outside the EU/EEA.

You can request a copy of the safeguards that apply to a specific transfer by writing to privacy@hejobb.com.

We share personal data only with providers that help us run Hejobb, under data processing agreements or as independent controllers where stated, and only what each task requires:

Beyond this, we disclose personal data only if the law requires it, or in connection with a corporate transaction (such as a merger). In that case this policy continues to protect your data and we will notify you of any change of controller.

• Account and profile data, CV text and embeddings are kept while your account is active. When you delete your account in the app, or ask us to delete it, they are erased at once, with residual copies removed from backups within 90 days.
• Sessions expire within 30 days of inactivity; expired sessions are deleted daily.
• Sign-in security details: the IP address and user agent are cleared from a session 90 days after the sign-in, and the country is kept while the session is active. All three are deleted earlier when the session ends or your account is deleted. A country on your list of sign-in countries is kept while you sign in from it or keep using a session from it, and is deleted 90 days after its last use, or when your account is deleted.
• Two-factor settings and passkeys are kept until you turn two-factor authentication off, remove the passkey or delete your account. A recovery code is deleted as soon as it's used. An unfinished two-factor sign-in expires after 10 minutes, and an unfinished passkey sign-in or setup after 5 minutes; expired ones are deleted daily.
• Email confirmation links are valid for 24 hours and password reset links for 30 minutes; expired links are deleted daily.
• Shareable profile pages are kept while their CV profile exists, and deleted when you delete that CV profile or your account.
• Cover letters and CVs written with the AI assistant are kept until you delete them or your account. Earlier versions are kept for 7 days, up to the last 50.
• Data exports you ask for in Account settings are stored encrypted in our EU storage for 7 days, then deleted automatically, or at once when you delete your account. Only you can download them, after signing in.
• In-app notifications are kept until you delete your account, except notifications about a sign-in from a new country, which are deleted 90 days after they were created. Notifications about a CV profile are also deleted when you delete that profile. Deleting a cover letter does not delete the notification about it, and opening a notification only marks it as read.
• Contact messages are kept for 12 months after they arrive, then deleted automatically from our database. The email copy in our team inbox is kept only as long as we need it to answer you and handle any follow-up. You can ask us to delete either copy sooner.
• Analytics data is collected only while your consent is active; you can withdraw consent at any time.
• Email preferences are kept while your account is active. When you withdraw your consent to product news, we delete the record of when you gave it.
• Campaign details and the country you signed up from are kept on your account until your account is deleted.
• Ad measurement data is collected only while your marketing consent is active. The Google Ads cookies on your device last up to 90 days.
• Subscription records are kept while your account is active. Payment and accounting records for paid subscriptions are kept for seven years, as the Swedish Bookkeeping Act (bokföringslagen) requires, even if your account is deleted.
• Other data we must keep by law is kept for the legally required period, then deleted.

Hejobb uses a minimal set of browser storage, in two groups.

Strictly necessary. These items are needed to provide the service you asked for, so under the Swedish Electronic Communications Act (LEK, chapter 9, section 28) they are exempt from consent. They are never used for analytics or advertising.

Only with your consent. Analytics and marketing storage needs your consent, and is off by default.

On your first visit we ask, and you can reject all, accept all, or choose separately between Analytics (Amplitude and Google Analytics) and Marketing (Google Ads conversion measurement). Marketing lets Google Ads read the ad click identifier and link it to the conversions described above; it is never used for remarketing, audiences or personalised ads. If you accepted analytics before marketing was a separate choice, we ask you once more.

We use Google Consent Mode in its basic form: Google scripts load only after you accept analytics or marketing (the Google Ads tag with marketing, Google Analytics only with analytics), every consent signal starts as denied, and if a Google script is loaded, your choice is passed to it. Amplitude also loads only if you accept analytics. Even then, Amplitude events contain sanitized page routes, coarse product actions and your internal account ID, and Google Analytics receives sanitized page routes, device and browser data and a cookie identifier, never your account ID. Google signals and ads personalisation are turned off. Analytics events never contain your name, email, CV content or the identity of a specific job. If you decline or later withdraw analytics, Google Analytics is switched off, Amplitude stops, and the analytics cookies and local storage listed above are deleted. If you decline or later withdraw marketing, the Google Ads cookies and local storage (gcl…) are deleted right away and Google is told at once; a Google tag already loaded on the page stops on the next page load.

You can change your choices at any time with the button below, or via the "Cookie settings" link in the footer.

• All traffic between your browser and Hejobb is encrypted in transit (TLS), and stored data is encrypted at rest on AWS.
• Session tokens are stored only as cryptographic hashes, in httpOnly cookies that page scripts cannot read.
• Sign-in uses modern OAuth (with PKCE), your email and password, or a passkey. Passwords are stored only as salted one-way hashes (scrypt), never in readable form, and reset links are single-use and short-lived.
• Two-factor authentication is optional. The secret for your authenticator app is encrypted (AES-256-GCM) with a key kept outside the database, recovery codes are stored only as one-way hashes, each code works once, and wrong codes are rate-limited.
• Passkeys use public-key cryptography: we store only the public key, and your fingerprint, face or screen lock never leaves your device.
• Original CV files are held, encrypted, in our EU database only while they are being processed, and are deleted as soon as processing finishes or fails.
• Card details go straight to Stripe and never reach Hejobb's servers.
• If your account is signed in to from a country you haven't signed in from in the last 90 days, and you have signed in from another country in that time, we email you and show a notification in the app.
• Access to production data is restricted to the few people who need it to operate the service.

No system is perfectly secure. If a breach ever puts your rights at risk, we will notify you and Integritetsskyddsmyndigheten (IMY) as GDPR requires.

Under the GDPR you have these rights:

• Access. Get a copy of the personal data we hold about you. You can download it yourself under Your data in Account settings: we prepare a ZIP file, email you when it is ready and keep it for 7 days.
• Rectification. Correct inaccurate data (to change anything the AI extracted from your CV, replace your CV).
• Erasure. Have your account and data deleted ("right to be forgotten"). You can delete your account yourself in the app, or email privacy@hejobb.com.
• Restriction. Limit how we process your data while a question is resolved.
• Portability. Receive your data in a machine-readable format. The download in Account settings holds your data as a JSON file, with your CV text as Markdown files.
• Objection. Object to processing based on legitimate interest.
• Withdraw consent. You can do this for consent-based processing (like analytics, ad measurement and product news) at any time, without affecting past processing. Product news can be switched off on the Notification settings page.

To exercise any of these, email privacy@hejobb.com. We respond within one month. Exercising your rights is free of charge.

If you believe we handle your data unlawfully, you also have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) at imy.se, or with the supervisory authority where you live or work in the EU.

We update this policy when the service or the law changes. The date at the top always shows the current version. We will notify you in the app or by email before a material change takes effect, such as a new category of data or a new AI provider handling your CV.

Privacy questions and requests: privacy@hejobb.com

Effati Consulting AB Tränsgatan 3 183 74 Täby, Sweden effati.se · info@effati.se

We aim to answer every privacy question within a few business days, and formal requests within one month as required by the GDPR.