Privacy Policy

Engineering draft — counsel review required. This document was drafted by engineering and has not been reviewed by legal counsel. Draft, not yet in effect.

This Privacy Policy explains how JobMax.ai, operated by Alex Rabinovich and Max Glubochansky ("JobMax.ai", "we", "us"), collects, uses, and shares information when you use our platform that turns finished-job photos into scheduled social media content for contractors.

1. Information We Collect

1.1 Account information

• Email address and password credentials, managed through our authentication system (SuperTokens, self-hosted in our infrastructure). Passwords are stored only as cryptographic hashes. Signed-in sessions use strictly necessary cookies only; see our Cookie Policy.
• Multi-factor authentication state (for example, authenticator-app pairing or email one-time codes).

1.2 Business and location profiles

• Business name, trade, service locations (city/region), and related profile details you provide to tailor generated content.

1.3 Job photos and media

• Photos (and, on applicable tiers, videos) you upload of completed jobs. Media is stored in Amazon S3 and served only through CloudFront signed URLs with short expiry — media files are never publicly readable.

1.4 Generated content

• AI-generated captions, hashtags, and schedules produced from your uploads, along with the approval decisions you make on them.

1.5 Connected social account data

• OAuth access and refresh tokens for the Meta and TikTok accounts you connect. These tokens are encrypted at the application layer (AES-256-GCM envelope encryption with per-record keys managed in AWS KMS) before being stored. We store only ciphertext.
• Basic metadata about connected pages/accounts needed to publish on your behalf.

1.6 Payment information

• Payments are processed by Stripe. We do not collect or store card numbers or full payment credentials. We store Stripe customer and subscription identifiers and your plan status so we can operate your subscription.

1.7 Usage data and logs

• Operational logs and metrics, including request identifiers (correlation IDs), timestamps, feature usage counters (for example, posts used this month), and error diagnostics. Our logging pipeline is designed to scrub secrets, tokens, and payment identifiers from log output.

2. How We Use Information

• Provide the Service: generate content from your photos, schedule posts, and publish approved content to your connected accounts.
• AI processing: your photos, business profile details, and related context are sent to third-party AI model providers (currently Anthropic and OpenAI) through our internal AI gateway to generate captions and related content. We instruct these providers to process the data to provide the service to us.
• Billing: manage subscriptions, enforce plan limits, and process payments through Stripe.
• Publishing: transmit your approved content, on your instruction, to Meta and TikTok.
• Security and operations: authenticate you, detect abuse, debug issues, and maintain audit records.
• Communications: send transactional email (login codes, account and billing notices) via Amazon SES. We do not sell your personal information, and we do not use it for third-party advertising.

3. How We Share Information

We share personal information only with service providers acting on our behalf, with the platforms you explicitly connect, or as required by law:

Recipient	Purpose	What is shared
Amazon Web Services (AWS)	Cloud hosting, storage (S3/CloudFront), database, email (SES), key management (KMS)	All service data, hosted in our AWS environment
Stripe	Subscription billing	Email, billing details you provide to Stripe, subscription state
Anthropic	AI text generation via our internal gateway	Photos and business/context data needed to generate content
OpenAI	AI image/multimodal processing via our internal gateway	Photos and business/context data needed to generate content
Meta	Publishing approved posts; ad budget settings you direct	Approved content, media, and page identifiers
TikTok	Publishing approved posts; ad budget settings you direct	Approved content, media, and account identifiers

We may also disclose information to comply with law, enforce our terms, or protect the rights, safety, and security of JobMax.ai, our users, or the public. If we are involved in a merger, acquisition, or asset sale, information may be transferred subject to this policy.

4. Data Retention

• Account, business, and content data are retained while your account is active.
• When you delete your account (see Section 6), it is deactivated immediately and permanently purged after a 7-day grace period: your profile, business and location details, photos, media, generated content, and connected-account records are deleted or irreversibly de-identified, including our internal audit records about them.
• We retain invoices and billing records after account deletion because tax and accounting law requires it (GDPR Art. 17(3)(b)). These records are kept only as long as those laws require.
• Residual copies in routine backups age out on the backup retention schedule and are not restored except for disaster recovery.
• Operational logs and transient processing records are retained on short, fixed schedules and purged automatically.

5. Security

• Encryption in transit (TLS) for all connections.
• Social account OAuth tokens encrypted with AES-256-GCM envelope encryption using per-record data keys managed by AWS KMS.
• Media served only via expiring signed URLs; storage buckets are not publicly accessible.
• Platform credentials kept in AWS Secrets Manager, not in code or environment files.
• Least-privilege access controls between our internal services, and log scrubbing to keep secrets and tokens out of logs.

No system is perfectly secure; please use a strong, unique password and enable multi-factor authentication.

6. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing.

• You can access and update business profile data in the product.
• You can disconnect social accounts at any time, which revokes our publishing access.
• You can delete your account yourself in the Service under Settings ("Danger Zone"). Deletion takes effect immediately and your data is permanently purged after a 7-day grace period (see Section 4).
• You can also request account deletion or exercise other rights by emailing privacy@jobmax.ai. We will verify your request and respond within the timeframe required by applicable law.

We do not discriminate against you for exercising privacy rights.

7. Children

The Service is a business tool and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

8. International Transfers

We operate from the United States and our infrastructure is hosted in the United States on AWS. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards for such transfers (see our Data Processing Addendum).

9. Changes to This Policy

We may update this policy from time to time. For material changes we will provide notice by email or in-product notice before the changes take effect. The "Last updated" date on this page reflects the latest revision.

10. Contact

Privacy questions or requests: privacy@jobmax.ai.