Last Updated: 17 October 2026
This Privacy Policy explains how Woberry AB (org. nr 559474-0267) ("Woberry", "we", "us" or "our") collects and uses personal data when you visit woberry.com or use our services. It applies to users in Sweden, the rest of the EU/EEA and the United Kingdom.
Woberry AB is the controller of your personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swedish Data Protection Act (2018:218). The exception is where this policy says that someone else is responsible, such as an employer you apply to.
You can reach us at support@woberry.com or by post to Woberry AB, Träkilsgatan 50 Lgh 1201, 416 50 Göteborg, Sweden. Use the same address for privacy questions and to exercise your rights (see section 11). Our full contact details are in section 16.
This policy gives you information. It isn't a contract, and you don't have to accept it to use Woberry. Where we rely on your consent, we ask for it separately.
You provide most of this data yourself. Some of it is created when you use the service or comes from the sources listed.
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a salted hash), profile picture, sign-in method (email, Google or LinkedIn), email verification status, account role | You; Google or LinkedIn if you sign in with them |
| CV and cover letter content | Contact details, work history, education, skills, certifications, projects, photo, uploaded CV files and anything else you write or upload | You |
| AI-generated content | Text that the AI features write for you, plus the summary and scores we create when we analyse a CV you upload | Created by our AI providers from your content (see section 4) |
| Job search and application data | Saved and tracked jobs, job searches and job-alert preferences | You |
| Payment and subscription data | Plan, billing interval, subscription status, Stripe customer ID, invoices and payment history. You enter card details directly with Stripe, and we never see or store your full card number | You; Stripe |
| Activity and security data | Sign-ins, password changes and other account events, with the IP address used. We also use IP addresses and the email addresses entered in forms for rate limiting | Your device; our systems |
| Usage, device and error data | Pages viewed, features used, browser and device type, approximate location based on IP address, and error reports, which can include your IP address and user ID | Your device; our systems. Analytics run only with your consent (see section 7) |
| Communications | Emails you send us, your email preferences and a record of when you gave or withdrew marketing consent | You; our systems |
Sensitive information: a CV can reveal special categories of data, such as health, religion or trade union membership, or your ethnic origin through a photo. We don't ask for this kind of information, and we recommend that you leave it out, together with your national identity number. If you include it anyway, we process it only to provide the features you use. It's shared with an employer only when you apply to that employer's job.
We use personal data only when the GDPR gives us a lawful basis. The table shows each purpose and the basis we rely on. Where we rely on legitimate interests, you can object at any time (see section 11).
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account; storing and exporting your CVs and cover letters | Account data, CV and cover letter content | Contract (GDPR art. 6(1)(b)) |
| AI writing, CV analysis and the other AI features you use | CV and cover letter content, text you enter, job descriptions | Contract (art. 6(1)(b)) |
| Job search, AI job matching and the job alerts you set up | Searches, job-alert preferences, job listings | Contract (art. 6(1)(b)) |
| Auto Apply (Premium Plus, only if you turn it on): our team applies on your behalf to jobs that match your preferences, skipping any companies you exclude | Name, contact details, the resume and any cover letter you choose for Auto Apply, your job preferences and excluded companies | Contract (art. 6(1)(b)) |
| Taking payments and managing subscriptions and refunds | Payment and subscription data | Contract (art. 6(1)(b)) |
| Keeping accounting records | Invoices and payment records | Legal obligation under the Swedish Bookkeeping Act (bokföringslagen) (art. 6(1)(c)) |
| Service emails: email verification, password resets, receipts, subscription and security notices, important changes to the service | Account data | Contract (art. 6(1)(b)); legitimate interests (art. 6(1)(f)) |
| Marketing emails: tips, product news and offers (see section 6) | Name, email address, email preferences | Consent (art. 6(1)(a)) |
| Security: preventing fraud and abuse, rate limiting, activity and security logs | Activity and security data | Legitimate interests (art. 6(1)(f)): keeping accounts and the service secure |
| Error monitoring, and monitoring the cost and reliability of AI calls without the content of prompts or answers | Error reports, technical data, IP address, user ID, AI usage metadata | Legitimate interests (art. 6(1)(f)): keeping the service working |
| Product analytics, and Sentry performance monitoring and Session Replay | Usage and device data | Consent (art. 6(1)(a)), given in the cookie banner |
| Measuring our advertising with the Meta Pixel and Google Ads | Cookie identifiers, pages visited, and events such as sign-ups | Consent (art. 6(1)(a)), given in the cookie banner |
| Complying with the law, responding to authorities, and establishing or defending legal claims | The data relevant to the matter | Legal obligation (art. 6(1)(c)); legitimate interests (art. 6(1)(f)) |
We need the data that runs your account in order to provide the service. Consent to marketing emails, analytics and advertising cookies is optional and doesn't affect your access to Woberry.
Several Woberry features use AI models from external providers. When you use one, we send the content the task needs to the provider and show you the result.
| Provider | What it's used for | What we send |
|---|---|---|
| OpenAI | Writing and improving CV sections and cover letters, importing a CV, skills and job-match analysis, interview and salary tools | The text you enter, the relevant parts of your CV or cover letter, and the job description where relevant |
| Anthropic | Analysing a CV you upload and creating its summary and scores | The content of your uploaded CV |
| Google (Gemini) | Matching job listings to your search or job-alert preferences | Your search text or job-alert preferences, and the job listings |
When AI runs: most AI features run only when you choose to use them, for example by clicking an AI button. When you upload a CV file, we analyse it automatically to create a summary and scores. If you don't want your CV processed by AI, you can build it in the editor without the AI features and without uploading a CV file.
How providers may use your content: we use these providers' business API services, under terms that restrict their use of your content. Those terms allow a provider to keep inputs and outputs for a limited time, for example to detect abuse. We don't sell your content, and we don't use it to train AI models of our own.
AI output can be wrong or incomplete. Always check AI-generated text before you use it.
To monitor reliability and cost, we send AI usage metadata, such as the model used, response time and cost, to PostHog. We do this in privacy mode, so the prompts and answers, and therefore your CV content, aren't sent to PostHog.
The job board shows job ads from external sources, including Arbetsförmedlingen's JobTech API. When you apply for one of these jobs, you do so on the other site, and its terms and privacy notice apply. We don't send your data to Arbetsförmedlingen.
If you use AI job search or job alerts with an AI prompt, we send your search text or alert preferences, together with the job listings, to Google Gemini to find matching ads (see section 4).
We send marketing emails, such as job-search tips, product news and offers, only if you opt in when you sign up or later in your settings.
Every marketing email has a one-click unsubscribe link. You can also change your email preferences at any time in Settings → Profile. Withdrawing consent doesn't affect emails we've already sent.
Service emails, such as email verification, password resets, receipts, subscription notices and security alerts, aren't marketing. We send them when we need to in order to run your account. Job alerts are sent only if you set them up, and you can turn them off in Settings → Notifications.
We use strictly necessary cookies and local storage to keep you signed in, remember your cookie choices and interface preferences, and protect payments. We load analytics (PostHog, Vercel Web Analytics, and Sentry performance monitoring and Session Replay) and marketing technologies (the Meta Pixel and Google Ads, with Google Consent Mode v2 set to "denied" by default) only if you consent in our cookie banner. The Meta Pixel never runs on account, login or dashboard pages. Sentry error monitoring runs without consent, because we need it to keep the service working, and it sets no cookies.
You can change or withdraw your consent at any time with the "Cookie settings" link in the footer of every page. If you withdraw consent, we delete the PostHog, Meta and Google cookies set on woberry.com. Our Cookie Policy at woberry.com/cookies lists each cookie with its purpose and how long it lasts.
We don't sell your personal data. We share it only with the recipients described below.
Service providers (processors) handle data on our behalf, only on our instructions and under data processing agreements:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Hosting the website and app, storing CV photos (Vercel Blob), cookieless web analytics (with consent) | All data handled by the app | USA and a global network |
| Neon | Database (PostgreSQL) | Account, content, application, subscription and log data | Database region chosen by us; US-based provider |
| Redis hosting provider | Rate limiting to protect sign-in and other forms | IP addresses and email addresses entered, kept for at most 15 minutes | EU or USA, depending on the region chosen |
| Stripe | Payments, subscriptions, invoices, refunds and fraud prevention | Name, email address, payment and subscription data, IP address | EU and USA |
| OpenAI | AI features (see section 4) | Content you send to AI features | USA |
| Anthropic | AI analysis of uploaded CVs (see section 4) | Content of uploaded CVs | USA |
| Google (Gemini API) | AI job matching (see sections 4 and 5) | Search text, job-alert preferences, job listings | USA and other countries |
| Google (Places API) | Suggesting places when you type a location | The text you type in location fields | USA and other countries |
| Inngest | Running background jobs such as emails and CV analysis | Event data, including user IDs and email addresses | USA |
| PostHog | Product analytics (with consent) and AI call monitoring in privacy mode | Usage and device data, user ID, AI usage metadata | EU (PostHog EU Cloud) |
| Sentry | Error monitoring, plus performance monitoring and Session Replay only with consent | Error reports, technical data, IP address, user ID; masked session recordings | EU (Germany) data region; US-based provider |
| Resend | Sending service and marketing emails | Name, email address, email content | USA |
| Discord | Receiving the problem reports you send us | Your report, the page address, browser and screen size, and your account email if you're signed in | USA |
| UploadThing | Uploading and storing CV files | Uploaded files | USA |
Other recipients use the data for their own purposes, under their own privacy policies:
| Recipient | When | What |
|---|---|---|
| Google and LinkedIn | If you choose to sign in with them | They confirm your identity and send us your name, email address and, where available, profile picture |
| Meta (Meta Pixel) and Google (Google Ads) | Only if you accept marketing cookies | Cookie identifiers, pages visited and events such as sign-ups, used to measure our ads. We may be jointly responsible with Meta or Google for collecting and sending this data |
| Employers we apply to for you | Only if you turn on Auto Apply (Premium Plus) | The resume and any cover letter you chose for Auto Apply, with your name and contact details. Each employer handles your application under its own privacy notice |
| Authorities, courts, and our legal and accounting advisers | When the law requires it, or to establish or defend legal claims | Only the data needed |
| A buyer or successor of our business | If we sell or restructure our business | The data needed to continue the service, under this policy |
Several of our providers are based in the USA or process data outside the EU/EEA and the UK (see the Location column in section 8). When we transfer personal data to a country without an adequacy decision, we use one of these safeguards, where applicable:
● the EU-U.S. Data Privacy Framework and its UK Extension, for providers certified under it;
● the European Commission's Standard Contractual Clauses (SCCs);
● for users in the UK, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs.
We also use technical measures such as encryption in transit. To ask for a copy of the relevant safeguards, contact us (see section 16).
We keep personal data only as long as we need it for the purposes in section 3.
| Data | How long we keep it |
|---|---|
| Account data, CVs, cover letters, uploaded files, job applications and other content | As long as your account exists. When you delete your account, we erase your personal data within 30 days, apart from the records below that we must keep |
| Accounts that were never verified and have no content | Deleted 30 days after sign-up |
| Activity and security logs, including IP addresses | 12 months, then deleted |
| Rate-limiting data (IP and email addresses) | Deleted automatically after at most 15 minutes |
| Billing records (invoices and payment records) | 7 years, as Swedish accounting law requires. Stripe also keeps its own records as the law requires of it |
| Records of your marketing consent and of any withdrawal | As long as your account exists |
| Analytics and error-monitoring data | Deleted after the retention period set in our PostHog and Sentry accounts |
| Applications our team sends for you through Auto Apply | The record in your Woberry application tracker is deleted with your account. The copy the employer receives follows that employer's own privacy notice and retention rules |
If you delete your account while you have an active subscription, we cancel the subscription immediately and you won't be charged again.
If the law requires us to keep data for longer, for example because of a legal claim, we keep only what is needed, for as long as it's needed.
The GDPR and the UK GDPR give you the rights below. You can use most of them yourself in the app. For the others, email support@woberry.com.
| Right | What it means | How to use it |
|---|---|---|
| Access | Get a copy of the personal data we hold about you and information about how we use it | "Download my data" in Settings → Security, or email us |
| Data portability | Receive the data you gave us in a structured, machine-readable format, or have us send it to another provider where that's technically possible | "Download my data" in Settings → Security, or email us |
| Rectification | Have inaccurate or incomplete data corrected | Edit your profile and documents in the app, or email us |
| Erasure | Have your data deleted | Delete your account in Settings → Security, or email us |
| Restriction | Have us limit how we use your data, for example while we look into a complaint | Email us |
| Objection | Object to processing based on legitimate interests. You can always object to direct marketing | Email us; unsubscribe from marketing with one click |
| Withdrawing consent | Withdraw consent at any time. Withdrawal doesn't affect processing that happened before it | The unsubscribe link in every marketing email, email preferences in Settings → Profile, and "Cookie settings" in the footer |
We respond within one month. If a request is complex, or we receive many requests, we may extend this by up to two further months and will tell you why. We may ask you to confirm your identity first. Exercising your rights is free unless a request is clearly unfounded or excessive.
Woberry doesn't make decisions about you that are based solely on automated processing and that have legal or similarly significant effects on you.
Woberry is only for people aged 18 and over. We don't knowingly collect personal data from anyone under 18. If we learn that someone under 18 has created an account, we will delete the account and its data. If you think this has happened, please contact us.
We protect personal data with measures suited to the risk. These include encryption in transit (HTTPS), passwords stored only as salted hashes, access controls on our systems and provider accounts, rate limiting against brute-force attacks, and data processing agreements with our providers.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify IMY and, where the law requires it, you.
If you're unhappy with how we handle your data, please contact us first at support@woberry.com so that we can try to put it right.
You also have the right to complain to a data protection authority. Our lead authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se. If you live elsewhere in the EU/EEA, you can also complain to the authority in your country. If you're in the UK, you can complain to the Information Commissioner's Office (ICO), ico.org.uk.
We update this policy when our services or the law change, and the date at the top shows the latest change. Before a material change takes effect, we'll tell you by email or with a notice in the app. If a change needs your consent, we'll ask for it.