Privacy Policy

Who We Are and the Roles That Apply

Joblobos is operated by Andre Blunt Kft ("Joblobos", "we", "us", "our"), a company registered in Hungary in the European Union. Registered company name: Andre Blunt Korlátolt Felelősségű Társaság. Registered office: 1085 Budapest, József körút 69. Fsz. 1. ajtó. Company registration number: 01-09-451918. You can reach us about privacy at legal@joblobos.com.

Data protection law distinguishes between a "controller" (the party that decides why and how personal data is processed) and a "processor" (the party that processes data on behalf of a controller). Joblobos acts in two different roles depending on the data.

For account and platform data, we are the controller. This covers the people who sign up for and administer a Joblobos account, our billing relationship, our website visitors, and the telemetry we collect to run and secure the service. This Privacy Policy describes that processing.

For the business data a tenant enters into Joblobos, the tenant is the controller and Joblobos is the processor. When a trade business uploads or creates records about their own End Customers, leads, quotes, invoices, and system designs, the business decides why that data exists and how it is used. We process it only to provide the service to that business and on their documented instructions. Our handling of that data is governed by the agreement between us and the tenant, including a Data Processing Agreement (DPA), which is published at joblobos.com/legal/dpa. If you are an End Customer of a trade business and you want to exercise rights over your data, contact that business first, since they are the controller. We will support them in responding.

What Data We Collect and Why

Account data. When someone registers, we collect the account holder's email address and name, the tenant business name, login credentials managed through our authentication provider, and the role and permissions assigned within the tenant. We use this to create and secure accounts, authenticate users, operate the multi-tenant workspace, and provide support. Legal basis: performance of a contract, and our legitimate interest in running a secure, multi-user platform.

Tenant business data. Tenants enter operational records into Joblobos, including their own customers and leads, product catalog items, quotes, orders, invoices, recorded payments, and system designs. For this category the tenant is the controller and we are the processor. We process it to provide the platform features the tenant has chosen to use, on the tenant's instructions. We do not sell it, mine it for our own purposes, or use it to build separate products.

Billing data. Subscription billing runs through Stripe. We hold a record of the plan, subscription status, and billing contact, while card and payment details are handled by Stripe under its own terms. Joblobos never custodies tenant or End Customer funds. When a tenant records payments from their own End Customers inside Joblobos, that is bookkeeping inside the platform. The tenant's own payment gateway, if any, is the tenant's processor, not ours. Legal basis: performance of a contract and compliance with our accounting and tax obligations.

Usage and telemetry. We collect technical logs, error reports, device and browser information, IP address, and product usage events. We use this to keep the service available, diagnose faults, prevent abuse, and improve features. Legal basis: our legitimate interest in operating, securing, and improving the platform, balanced against your interests.

Communications. If you contact us for support or sales, we keep the messages and contact details needed to respond and to keep a record. Legal basis: legitimate interest and, where relevant, performance of a contract.

Artificial intelligence features. Some features of Joblobos use a third-party AI provider (Anthropic) to generate text, including the lead-capture assistant, the design calculator, and estimating assistance. When these features are used, the content of the request is sent to that provider to produce a response, as described under Sub-Processors and Infrastructure and under International Transfers. AI outputs are aids, not professional, engineering, legal, or tax advice, and must be reviewed before they are relied upon. Where a tenant enables an AI feature that processes its own customers' data, the tenant is the controller for that data and is responsible for telling its customers that AI is used.

Legal Bases (GDPR Article 6)

Where the GDPR applies, we rely on the following legal bases.

Contract (Article 6(1)(b)): to create accounts, deliver the platform to the tenant who subscribed, and bill for it.

Legitimate interests (Article 6(1)(f)): to secure the service, prevent fraud and abuse, monitor and fix errors, understand how the product is used, and improve it. We weigh these interests against your rights and do not let them override your interests where the law requires otherwise.

Legal obligation (Article 6(1)(c)): to meet accounting, tax, and other obligations that apply to us as an EU company.

Consent (Article 6(1)(a)): only where we specifically ask for it, for example certain optional communications. You can withdraw consent at any time without affecting processing already carried out.

For tenant business data, the legal basis for processing the underlying personal data rests with the tenant as controller. Joblobos processes it under the contract and DPA with that tenant.

Controller and Processor Split

To be precise about the multi-tenant model:

Joblobos is the controller for account data, billing data, website data, and usage and telemetry described above. We decide why and how we process it.

The tenant (the trade business) is the controller for the End Customer and business records it enters into Joblobos. Joblobos is that tenant's processor for those records. We act on the tenant's documented instructions, we keep each tenant's data logically separated from other tenants, and we restrict access to authorized personnel and sub-processors needed to run the service.

The terms of our processing on behalf of tenants, including security commitments, sub-processor handling, breach notification, and assistance with data-subject requests, are set out in our Data Processing Agreement, published at joblobos.com/legal/dpa.

Sub-Processors and Infrastructure

We use a small number of vetted providers to run Joblobos. Each is bound by contractual data protection terms, and where they process tenant business data on our behalf they act as sub-processors under our DPA with tenants.

Supabase: database, authentication, and file storage, hosted in an EU region. This is the primary store for account and tenant data.

Vercel: application hosting and content delivery for the website and app; may process limited data outside the EEA under an appropriate Chapter V safeguard (Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework).

Stripe: subscription billing for Joblobos plans. Stripe processes payment details under its own terms; may process limited data outside the EEA under an appropriate Chapter V safeguard (Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework).

Resend: delivery of transactional email such as account, security, and notification messages; may process limited data outside the EEA under an appropriate Chapter V safeguard (Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework).

Sentry: error monitoring and diagnostics, which may include limited technical context attached to error events; may process limited data outside the EEA under an appropriate Chapter V safeguard (Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework).

Twilio: sending and delivery of WhatsApp and SMS messages between a tenant and its End Customers. Twilio processes the sender and recipient phone numbers, the message content, and delivery-status information outside the EEA; for that transfer we rely on an appropriate safeguard recognized under the GDPR, in most cases the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework. WhatsApp messages are additionally routed through Meta's WhatsApp Business Platform to reach the recipient.

Anthropic: the optional AI features of the platform, including the lead-capture assistant, the design calculator, and estimating assistance. When a tenant or a tenant's website visitor uses one of these features, the text of that interaction is sent to Anthropic to generate a response. That text can include tenant business content and any personal data the user or visitor includes, such as a name, email, or phone number typed into a lead-capture chat. Anthropic processes this data in the United States, outside the EEA; for that transfer we rely on an appropriate safeguard recognized under the GDPR, in most cases the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework. Under Anthropic's commercial terms it does not use the submitted content to train its models. These features run only when enabled.

The current list of sub-processors is the one set out above and in Annex A of our Data Processing Agreement, published at joblobos.com/legal/dpa. Where required by the DPA, we give tenants advance notice of changes to sub-processors so they can object.

International Transfers

We aim to keep personal data within the European Union, and our primary database, authentication, and storage are hosted in an EU region. Some providers we rely on, such as Stripe, Vercel, Resend, Sentry, Twilio, and Anthropic, may process limited data outside the EU or European Economic Area. In particular, Twilio processes messaging data and Anthropic processes AI-feature content in the United States.

Where data is transferred outside the EEA, we rely on an appropriate safeguard recognized under the GDPR, in most cases the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework, together with supplementary measures where needed. You can ask us for more detail on the transfer mechanism for a specific provider at legal@joblobos.com.

Retention

We keep account data for as long as the account is active, and for a limited period afterward to handle closure, disputes, and our legal obligations.

Billing and accounting records are kept for the period required by applicable tax and company law, which under Hungarian law is 8 years.

Usage logs and error data are kept for a shorter operational window, generally 12 months, after which they are deleted or aggregated so they no longer identify a person.

Tenant business data is retained for as long as the tenant maintains its account and uses the platform. When a tenant's subscription ends, we make the data available for export for a defined window and then delete it in line with the DPA and the tenant's instructions, subject to any backups that age out on a routine cycle and any data we must keep by law.

Security

We take technical and organizational measures appropriate to the risk. These include encryption of data in transit, encryption at rest provided by our infrastructure, authentication and role-based access controls, logical separation of each tenant's data in the multi-tenant database, least-privilege access for staff, monitoring and error tracking, and regular review of our providers.

No system is perfectly secure, so we cannot guarantee absolute security. What we do after a breach depends on our role. For personal data where we are the controller, such as account, billing, website, and telemetry data, if a breach is likely to result in a risk to people we notify the competent supervisory authority, and where the risk is high we also notify the affected individuals, within the timeframes the GDPR sets. For the End Customer and business records a tenant enters into Joblobos, the tenant is the controller and we are its processor: in that case we notify the tenant without undue delay after we become aware of a breach and we support the tenant in meeting its own duties, while the tenant, as controller, is responsible for any notification to a supervisory authority or to the affected individuals. Our processor breach duties are set out in our Data Processing Agreement, published at joblobos.com/legal/dpa.

Your Data Protection Rights

If the GDPR applies to you, you have the following rights over personal data for which we are the controller.

Access: to obtain a copy of the personal data we hold about you.

Rectification: to have inaccurate or incomplete data corrected.

Erasure: to have your data deleted where there is no overriding reason for us to keep it.

Portability: to receive certain data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

Objection: to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.

Restriction: to ask us to limit how we use your data in certain situations.

To exercise these rights for data we control, contact legal@joblobos.com. We will respond within the time the law allows, normally one month. If your request concerns End Customer or business data held inside a tenant's workspace, the tenant is the controller, so please direct the request to that business. We will assist them as their processor.

You also have the right to lodge a complaint with a supervisory authority. In Hungary this is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH). You may also contact the supervisory authority in your own EU country of residence or work.

Cookies

Joblobos uses cookies and similar storage strictly for authentication and session management. These are necessary to log you in, keep you signed in securely, and maintain the integrity of your session across the app.

We do not use advertising cookies, and we do not use third-party tracking cookies for marketing. Because the cookies we set are strictly necessary to deliver a service you have asked for, they do not require consent under the applicable rules. If you block these cookies in your browser, core parts of the app, including signing in, will not work.

Children

Joblobos is a business tool for trade businesses and is not directed at children. The service is not intended for anyone under the age of 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact legal@joblobos.com and we will take appropriate steps to delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the service, our providers, or the law. When we make a material change, we will update the "Last updated" date at the top and, where appropriate, notify account holders by email or through the app. Continued use of Joblobos after an update means you have read the current version. We encourage you to review this page periodically.

Contact

For any question about this policy or about how we handle personal data, contact us at legal@joblobos.com.

Controller: Andre Blunt Korlátolt Felelősségű Társaság (Andre Blunt Kft), 1085 Budapest, József körút 69. Fsz. 1. ajtó, Hungary, EU. Company registration number: 01-09-451918.

We have not appointed a separate data protection officer or representative; for any data protection matter, contact us at legal@joblobos.com. Our Data Processing Agreement and current list of sub-processors are published at joblobos.com/legal/dpa.