Privacy Policy

JobWillow is a two-sided hiring marketplace built for college students and local employers, launching in Knoxville, Tennessee. It is operated by JobWillow, Inc., a Tennessee corporation (“we,” “us,” or “our”), which runs jobwillow.com.

Contact: privacy@jobwillow.com

Account information

• Your name, email address, and password (stored as a one-way hash)
• Your date of birth, if you register as a candidate, set up an account from an administrator invitation, or create an account from a competition invitation (for example, as an outside judge). We use it to confirm you are at least 18 at account creation (a requirement under our Terms of Service). Employers and researchers are not asked for one. It is stored on your account, treated as sensitive personal information, and is not shown on your candidate or employer profile.
• For employers: company name, industry, website, a business address (street, suite or unit, city, state, and ZIP code) that our team uses to review a request to join, and the first name, last name, work email, and phone number of an internal contact person at the company. The city and state of the business address are shown as your company’s location; the street, unit, and ZIP code are not shown to candidates.
• Two-factor authentication is available on every account. If you enroll, we store an encrypted TOTP secret and one-time recovery codes (hashed).

Candidate profile information

• University, the college within it (for example, your school’s college of business or engineering), major, and (optionally) graduation year and GPA. When your school email is verified, we fill in your university from that school; to show a different name, you can ask us to change it and give a reason, which our administrators review. We may also fill in your college from your verified school and the major you enter. You can change or clear the college at any time. It appears on your resume, so employers and your competition teammates see it; faculty researchers never do.
• Work authorization status
• Skills selected from our curated vocabulary, plus any custom skills you type yourself on a tailored resume profile
• Phone number, LinkedIn URL, and an optional contact email to display on your resume
• Your school affiliation for reporting purposes, which we derive only from your verified school email domain to place you in your school’s cohort for the aggregate reporting described in Section 4. The university you type on your profile is display-only and never places you in a cohort; without a verified domain match you are not counted in any school’s reporting.
• Resume content (work experience, projects, clubs, volunteering, writing samples), avatar, and resume PDF uploads. When you upload a resume PDF, we parse it on our own servers to suggest fields (skills, education, contact info) for you to confirm. The parsing is in-process and the PDF contents are not sent to any third party for parsing.
• Demographic information (optional, voluntary, used only in aggregate; see Section 5)

Graduate outcome survey (optional)

• Candidates may fill out a short first-destination survey about where they landed after graduating: outcome (for example, employed full-time or part-time, continuing education, military service, still seeking, or not seeking), employer name, job title, start date, self-reported salary, location, and graduating year.
• The survey is voluntary and you can update your response at any time. Employers never see it. Your school sees only the privacy-protected aggregate statistics described in Section 4. Your response is included in your data export and removed with your account.

Employer profile information

• Company logo, description, and industry
• Posted listings, custom questions, scorecard templates, talent pools
• Contact details (name, email, phone) for the hiring manager and recruiter listed on a posting, which may describe teammates other than the account holder

Researcher profile information

• Academic title, department, institution, a short bio, a description of your research, and links to your publications. Candidates see this profile when viewing your research listings.

Employer-submitted intern testimonials

• Employers may publish testimonials on their profile that include intern names, role titles, the season or dates of the internship, an optional photo, and a quoted description of the experience. This content is submitted by the employer and is not verified by JobWillow. Testimonial sections are labeled “Shared by the employer” so candidates understand the source.
• If you are named or pictured in a testimonial on JobWillow, even if you do not have a JobWillow account, you can request removal by emailing privacy@jobwillow.com. We will remove the testimonial promptly and without requiring you to explain why. We do not arbitrate factual disputes between you and the employer about what was said; the removal path is unconditional. A JobWillow administrator takes the testimonial down directly, using the testimonial itself as the reference. You do not need a JobWillow account, and you do not need to file a report first.

Application and messaging data

• Which listings you applied to and their status over time
• Messages exchanged between candidates and employers
• Interview scheduling, scorecard data, notes an employer’s interviewers write about an interview, and offer terms
• If an employer initiates a background check through the platform, we store the status the employer records (pending, in progress, completed), which provider was selected, an optional short note the employer may type (up to 500 characters), and the employer’s own case number at that provider, all visible to that employer’s team. We do not run the check itself and do not receive the underlying report, and the platform does not record a pass/fail adjudication. See §13 of the Terms of Service.

Career fairs

• Schools can run career fairs on JobWillow. If you register for a fair, we store your registration, the fair it is for, and the name, major, and graduation year shown on your registration.
• Walk-up kiosk. At the door of a fair there may be a kiosk, a tablet or laptop that anyone can use without signing in. If you check in there, we store the name and email address you type, even if you do not have a JobWillow account and never create one. That is all the kiosk collects.
• When you scan the door code or an exhibitor’s booth code, we store a check-in record (the time and whether it came from the door or a booth) and a booth-visit record for each booth you scan. If you drop your resume at a booth, we store a copy of that resume attached to the drop, so a later edit to your profile does not change what the exhibitor received.

Competitions

• Faculty can host student competitions on JobWillow. If you host or help organize one, we store the details you enter about it and your role as an organizer, and the host’s name is shown to the students who can see the competition.
• If you take part as a student, we store your team membership: the team, your role on it (lead, co-lead, or member), when you joined or left, whether your team has been verified, the notice you accepted and when, and any eligibility statement the competition asked you to confirm, with the time you confirmed it.
• If you ask to join a team, we store your request, the open spot you picked, your note, any answers, writing samples, and a copy of your confirmed references that the spot asks for, and a snapshot taken from your profile at that moment: your name, school, major, graduation year, and skills. The snapshot is what the team’s lead and co-leads see (Section 4). Messages you exchange with them about the request, or with your teammates, are stored like any other message.
• For each team we store the links it adds, the files it submits for each deliverable (PDFs, videos, and audio, including a video recorded in your browser and the length your browser reports for it), its project log entries, who submitted each item and when, and whether the team has chosen to share its work and links with other teams (Section 4 says who sees them).
• We store the stage results organizers record and publish. If you judge, we store the stage you judge, the teams assigned to you, and the scores, comments, private notes, and team feedback you write.
• Competition invitations. When an organizer invites someone to help organize or to judge, or a team’s lead or co-lead invites someone to join their team, we store the invited email address, the role or team offered, who sent the invitation, and its status, even if that person does not have a JobWillow account. We email the invitation to that address (unless the address is on our do-not-email list, for example because its owner asked us to remove their invitations), and the person who sent it also receives a link they can pass on themselves. A team invitation email names the student who sent it, the team, and the competition.
• Roster lists from organizers. A competition’s organizers may give us a list of the students registered for their competition, with email addresses and team names. We use it only to verify teams on JobWillow, and we do not store it.

Reports and enforcement records

• If you report a listing, an application question, a testimonial, or a conversation, we store the report, its reason, and any comment you add, along with our resolution notes and any reply we send you. We also keep records of moderation actions taken on accounts (for example, a suspension and its reason) and an audit log of administrative actions. Moderation records and the administrative audit log are retained for platform safety even after accounts are deleted. Reports you filed are deleted with your account, except conversation reports, which are kept without your identity.
• Accounts you block are stored so the block can be enforced.

References you provide

• Candidates may add references to their profile. For each reference we collect the name, email, phone (optional), title, organization, and relationship that the candidate enters.
• We send each reference a confirmation email so they can confirm (or decline) being listed. Unconfirmed references are automatically deleted after a fixed retention window.
• When a candidate submits an application, a snapshot of their confirmed references is attached to that application so the employer can contact them. Subsequent edits to the live reference do not change the snapshot already attached to a prior application.
• If you have been listed as a reference and want your record removed, email privacy@jobwillow.com. We will remove it without requiring a reason. Removal erases your name, email address, phone number, title and organization from the live reference record and from the snapshot attached to every application the candidate has already submitted. The fact that the candidate listed a reference remains in the employer’s hiring record, without your details.

Business contacts and relationship records

• JobWillow keeps internal records about the people we work with while building the platform: employer and university contacts, advisors, investors, and other professional contacts, whether or not they have a JobWillow account. A record can include a name, role and organization, email address and phone number, a LinkedIn URL, how we met or who introduced us, and notes about our interactions.
• JobWillow staff may connect their own JobWillow work mailbox and contacts (Microsoft 365) to help maintain these records. That connection is metadata-only: the mail permission we use cannot read message bodies, and we record only the correspondent, subject line, direction, time, and the provider’s internal message identifier (used to avoid duplicate records), and only for people already in our records. Subject lines can be excluded per connection, and correspondents who are not already in our records are not stored at all.
• Partner universities can keep their own employer-outreach records in a CRM we host: the name, title, email, phone, and interaction notes of employer representatives they work with. If an invitation email is ever sent to such a contact through the platform, it will include a working unsubscribe, and opted-out addresses are kept on a suppression list solely to honor the opt-out.
• These records are internal tools: they are not shown to platform users and are used only for partnership, sales, and operations work. If you believe you are in these records and want to be removed, email privacy@jobwillow.com and we will remove you promptly, without requiring a reason.

Connected calendar and video accounts

• Employers (and, where applicable, candidates) can connect a Google, Microsoft, or Zoom account to schedule interviews.
• When you connect an account, we store the OAuth access and refresh tokens issued by the provider and the provider account identifier. The permissions we request cover calendar events and free or busy times on the account you connect (for Google, calendar events and free or busy; for Microsoft, calendar read and write plus online meetings; for Zoom, creating and removing meeting rooms). For a scheduling connection we do not request access to your email, your files, or your contacts; the only staff-side exception is described under Business contacts and relationship records above.
• We use those tokens to push interview events to your calendar, create or remove meeting rooms tied to a specific interview, and read free or busy times to suggest interview slots. If you open the calendar view inside JobWillow, we also fetch the events already on your connected calendar for the date range you are looking at, so your interviews appear alongside the rest of your schedule. That fetch returns the title, start and end time, all-day flag, and location of those events. We show them back to you only, we do not store them on our servers, and we do not use them for any other purpose. Through a scheduling connection we do not read your email, your files, or your contacts.
• You can disconnect a provider at any time from your account settings. We delete the stored tokens on disconnect.

Location data

• We collect the city and (for candidates) hometown you pick on your profile from a built-in list of US cities. We convert those cities into approximate coordinates (latitude and longitude) on our own servers, without sending them to any third party, to power proximity search and the Discover Talent map. We do not collect precise device location.
• When the map view loads in your browser, your browser fetches tiles directly from Mapbox, which means Mapbox sees your IP address as part of that request. A few free-text location fields (such as the first-destination survey, and the business street address on the employer sign-up form) also fetch typing suggestions in your browser directly from Mapbox, which sees the text you type and your IP address. We do not keep anything Mapbox returns; only the address you submit is saved with your account. The map library additionally sends anonymous usage-telemetry events to Mapbox from your browser while the map is open. We do not share your account information with Mapbox.

Usage data

• Pages visited, listings viewed, searches performed
• Login timestamps and session info
• Browser, device, and IP address
• Clicks on JobWillow short links that schools share through their own channels. We log the time of the click, the referring page, and a truncated, hashed form of the network the click came from (used only to avoid double-counting; it cannot identify you or follow you across links), and we report aggregate click counts to the sponsoring school. This applies to anyone who clicks such a link, with or without a JobWillow account.

Cookies and similar technology

• Essential cookies only. We use a session cookie to keep you logged in and a short-lived state cookie to protect the flow that connects a calendar or video account against cross-site request forgery. The session cookie cannot be disabled without breaking login; the state cookie cannot be disabled without breaking account connections.
• We do not use analytics, advertising, retargeting, or other third-party tracking cookies. We do not run cross-site behavioral profiling.
• Our promise here is not about cookies. Tracking no longer needs one, so the commitment is keyed to the thing that matters: if we ever add a flow that sends data from your browser to a third party, with or without a cookie, we will update this policy first, and where consent is required we will ask before that flow starts. Section 4 lists every destination that receives data today and every one that is built but switched off.

• Operate the marketplace: matching, search, messaging, scheduling
• Enforce platform rules: weekly application caps, response deadlines, employer approval
• Send transactional emails: account verification, application status, deadline alerts, interview confirmations
• Improve the product using aggregate usage patterns
• Provide your school with aggregate, privacy-protected reporting about its student cohort (see Section 4)
• Detect and prevent fraud, abuse, and policy violations
• Comply with legal obligations

We do not sell your personal information.

Legal bases for processing

Where applicable law requires us to identify a legal basis for processing your information, we rely on one or more of the following:

• Performance of a contract: to provide the services you signed up for (operating your account, processing your applications, delivering messages).
• Legitimate interests: to operate, secure, and improve the platform, prevent fraud, and enforce platform rules, where these interests are not overridden by your rights.
• Legal obligation: to comply with applicable laws and respond to lawful requests.
• Consent: where you have provided it for optional data collection or sharing (for example, demographic data for EEO reporting, the per-application consent to share academic details that applying to a research listing requires, or marketing emails).

Other users on the platform

• Your candidate profile is visible to approved employers when you apply to their listings, when you appear in candidate search, or when you accept an interest signal.
• Employer profiles and listings are visible to candidates browsing.
• Messages and application data are visible to the specific candidate and employer involved. JobWillow staff can additionally read a conversation a participant has reported; that access requires an existing report and is logged.
• University research listings are posted by faculty researchers. Applying to a research listing requires your per-application consent to share your academic details (GPA, majors and minors, graduation year) and your resume with the faculty poster; you cannot submit that application without consenting, and the consent covers only that application. Without live consent, those fields are withheld from the poster.

Career fairs

• What an exhibitor sees. An exhibiting employer sees the students who scanned that employer’s own booth code or dropped a resume at that booth, and nobody else. For each one they see the name, account email address, university, major, graduation year, and skills, the time of the booth visit, whether a resume was dropped, and the rating, note, and next step their own team recorded. They can download that as a lead list. GPA, work-authorization status, and demographic information are never included. A walk-up who has no JobWillow account never becomes a lead, so an exhibitor does not receive the address typed at the kiosk.
• What the host school sees. The school running the fair sees the attendance figures for its own event: how many registered, how many checked in, how many were walk-ups, the mix of majors and graduation years among people who checked in, and how much traffic each booth saw. It also sees the attendee list for that one fair, showing the name, major, and graduation year on the registration, whether the person checked in and from where, and whether they were a walk-up. It does not see email addresses, profiles, application history, or anything about any other fair. This is separate from the cohort reporting described below, which stays aggregate-only.
• Exhibitors may use what they collect at a fair only to recruit for their own roles, as §5 of our Terms of Service requires.

Competitions

• What other students see. Each competition’s organizers decide which students may take part, for example students with a verified email address at one school. Those students see the competition’s verified teams: each team’s name and description, its members’ names and team roles, its open spots, and the results the organizers have published. A team’s submissions and links are visible only to its members, the competition’s organizers, and the judges assigned to it, unless the team’s lead or a co-lead chooses to share them with other teams. Then those students also see the team’s links and the current version of each of its submissions. If the organizers release judges’ feedback to the whole competition, those students see that feedback too.
• What a team’s leads see. When you ask to join a team, its lead and co-leads see your name, school, major, graduation year, skills, and your note, your resume as employers see it when you apply for a job, and any answers, writing samples, and references the spot asks for, and they can message you while your request is open. Nothing else from your profile is shared with them. Other members of the team and other students never see your request. Once you are on a team, your teammates can see your profile, resume, and contact details.
• What organizers and judges see. A competition’s organizers see each team’s members with their names, account email addresses, team roles, and any eligibility statement they confirmed, and they see every submission and the scores, comments, and notes judges write. Judges see only the teams assigned to them: each team’s name, its members’ names, its links, and its submissions for the stage they are judging. Organizers and judges also see when a team used an alternative format for a submission. Competitions never show organizers or judges your GPA, majors or minors, graduation year, or resume. Teams never see judges’ scores, and feedback a judge writes reaches a team only if the organizers release it, without the judge’s name.
• What employers see. Employers see nothing from competitions. Company employer accounts cannot organize, judge, or view a competition, and nothing from a competition appears on your candidate profile, in candidate search, or among any listing’s applicants. Competitions are also not part of your school’s reporting, and school administrator accounts cannot view them.
• Organizers and judges may use what they see only to run the competition, as §7 of our Terms of Service requires.

Service providers we use

• Supabase: database hosting (PostgreSQL) and file storage (S3-compatible) for resumes, avatars, company logos, writing samples, offer-letter PDFs, and files submitted to competitions.
• Vercel: hosting for the website (www.jobwillow.com). Vercel serves the site through its own global edge network, so your IP address and request metadata pass through that network on the way to us.
• Render: hosting for the API (api.jobwillow.com). Render serves the API through its own edge network, which uses Cloudflare as Render’s sub-processor, so your IP address and request metadata pass through it on the way to us. JobWillow has no Cloudflare account or configuration of its own.
• Resend: transactional email delivery (verification, application status, deadlines, references, 2FA, password reset, and competition notices and invitations).
• Mapbox: map rendering for the Discover Talent view, plus in-browser typing suggestions on a few free-text location fields (such as the first-destination survey). Profile city and hometown are picked from a built-in list and are not sent to Mapbox.
• Google: when an employer or candidate connects a Google account, we use the Google Calendar API to create interview events on the connected calendar, to read free or busy times, and to list the events in the date range you are viewing inside JobWillow so they can be shown back to you.
• Microsoft: when a Microsoft account is connected, we use Microsoft Graph to create interview events in Outlook and meeting links in Microsoft Teams, to read free or busy times, and to list the events in the date range you are viewing inside JobWillow so they can be shown back to you. JobWillow staff may also connect JobWillow’s own work mailboxes through Microsoft Graph for the internal relationship records described in Section 2; that use is metadata-only and cannot read message bodies.
• Zoom: when a Zoom account is connected, we use the Zoom API to create and remove interview meeting rooms on the connected account.
• Sentry: error monitoring. This is live on both the website and the API. When something breaks, Sentry receives the error, where in the code it happened, the page or API route it happened on, your browser and operating system version, and, for a sample of about one in ten page loads, timing measurements. Before an event is sent we strip the parts that would carry personal data or credentials: request bodies are never collected, and query strings, cookies, the Referer header and authorization headers are removed. Any part of a web address that carries a single-use token, such as a password-reset, email-verification or career-fair link, is replaced with [redacted] before it leaves your browser or our servers. Your name and email address are not sent. A server-side error may carry your internal account identifier so we can tell how many people a fault affected. Session replay and screen recording are turned off.
• PostHog: product analytics for counting page visits. Not active. The code and the browser-security rules that would allow it are built into the site, but no account key is set, so nothing is loaded and no request is ever made to PostHog. If we activate it, we will update this policy first, before the key is set.
• Stripe: payment processing for paid employer plans. Stripe is not yet wired into the live product; this entry is forward-looking for when paid plans become active.

These providers process your data on our behalf under their own terms and security commitments.

We keep this list current. When we add a destination that receives your data, or activate one that is listed here as inactive, we update this policy before that destination starts receiving anything.

Aggregated, non-identifying data

We may publish aggregate hiring trends (for example, a “Knoxville Hiring Index”) using anonymized data that cannot identify any individual user.

On individual employer profiles and listings we also surface privacy-protected aggregates of past hires: for example, the median GPA, typical graduation year, most common majors, and median profile depth (projects, experiences, clubs) among candidates the employer has hired. These aggregates are governed by hard floors designed to prevent any single past hire from being identifiable:

• The panel is hidden entirely unless the relevant scope has at least five past hires. Below that threshold no aggregate is shown.
• Any specific value (for example, a particular major) is shown only when it appears in at least five of the past hires. Less frequent values are dropped before display.
• GPA statistics are omitted whenever fewer than half of past hires have a GPA on their profile, so a small sample with sparse data does not produce a misleading median.
• We never display the identity, profile, photo, or any other distinguishing detail of any specific past hire in these aggregates.

Your school (aggregate reporting)

If your verified email domain matches a partner school, you are counted in that school’s cohort, and career-services staff at the school see aggregate, privacy-protected statistics about the cohort: engagement (for example, how many students are active or applying), hiring outcomes including typical pay among captured offers, graduate outcome survey results, and click counts on links the school shared. These aggregates are governed by hard floors, in the same spirit as the past-hires aggregates above:

• Statistics are suppressed below a floor of five and guarded against tease-apart comparisons between differently filtered views, so no number can be traced to one student.
• Your school never sees your name, your profile, your application history, or any other individual record through these dashboards. If we ever offer schools an identified placement export, we will update this policy first, and it will require a signed data-sharing agreement.

Legal disclosures

We may disclose information when required by law, in response to valid legal process, or to protect rights, safety, or property.

Demographic information (race, gender, veteran status, disability status) is optional and voluntary. It is used only in aggregate reporting protected by k-anonymity: we never display demographic breakdowns for groups smaller than five respondents. Individual employers never see your demographic information attached to your identity.

• Active accounts: as long as your account is active
• Deactivated accounts: retained for a reasonable period to allow restoration and to satisfy legal obligations, then deleted or anonymized
• Application records: may be retained for audit and legal-compliance purposes even after account deletion
• Career fair records: fair registrations, walk-up kiosk entries, check-in records, and booth-visit records are removed 12 months after the fair ends. If you checked in at a kiosk and want your entry removed sooner, email privacy@jobwillow.com from the address you typed, or name it in your message, and we will erase it. You do not need a JobWillow account and you do not have to give a reason.
• Competition records: everything about a competition, including its teams and their members, join requests, links, submissions and their files, results, scores, and feedback, is removed 12 months after the competition closes. Organizers close a competition when it is over. If they do not, it closes automatically 60 days after it ends (its end date, or the end of its last stage if that is later), and its organizers are notified 14 days before that happens.
• Join-request details: 14 days after a request to join a team is declined, withdrawn, or cancelled, we delete the note and the school, major, graduation year, and skills that were shared with the team, and any answers, writing samples, and references sent with it. We keep the applicant’s name, the request’s status, and its dates.
• Team work after you delete your account: submissions and project log entries are your team’s shared work, so the ones you made stay with your team after you delete your account, until the competition’s records are removed. You can ask for any of them to be removed sooner by emailing privacy@jobwillow.com, and a recording you made of yourself, such as a video, is always removed on request.
• Competition invitations: an invitation to help organize or judge a competition, or to join a team in one, including the invited email address, is removed 30 days after it is accepted, revoked, or expires. Invitations expire after 7 days, so an address is held for at most 38 days after the invitation is created. If you were invited and want your address removed sooner, email privacy@jobwillow.com from that address, or name it in your message, and we will erase it. You do not need a JobWillow account and you do not have to give a reason. After that we will not email that address an invitation again: we then keep it on our do-not-email list, which holds only the address, the reason, and the date. An organizer can still invite that address and pass the link on themselves; that invitation is kept and removed as described above. Email us from that address if you want to be taken off the list.

You can:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account. Candidates, and anyone whose account was created from a competition invitation, can do this directly from account settings; employers, researchers, and school administrators can request deletion by emailing privacy@jobwillow.com. A JobWillow administrator then runs the same deletion on your behalf, and has to pass a second identity check before it will run. The action is recorded in our administrative log, which names the administrator who performed it. Deletion cascades to your profile and your application history, subject to limited retention for legal or fraud-prevention purposes.
• Export your data as a JSON file from Settings → Privacy → Export my data (candidates), Settings → Export my data (employers), Settings → Account in the school portal (school administrators), or Settings (accounts created from a competition invitation). Researchers can request an export at privacy@jobwillow.com. The export includes your account, profile, applications or listings, messages you have sent, and other records we hold about you.
• Opt out of non-essential marketing emails (transactional emails about your applications cannot be disabled while your account is active)
• Withdraw consent for optional data collection, including demographic data

We honor the Global Privacy Control (GPC) signal where it applies to a JobWillow data flow. JobWillow does not currently run analytics, advertising, retargeting, or sale-of-data pipelines, so the GPC signal has nothing to opt out of today; the handler is in place so that the moment any of those launch, GPC-on visitors will be excluded from them. The product analytics described in Section 4 is built but switched off, and if your browser sends GPC it stays switched off for your visit even after we activate it. Error monitoring keeps running when GPC is on, because it is how we find and fix a broken page rather than a way of tracking you: it is tied to the fault, not to a person, it sets nothing on your device, and what it receives is described in Section 4.

Depending on where you live (for example, California or the EU), additional rights may apply under CCPA, GDPR, or similar laws. Contact privacy@jobwillow.com to exercise any of these rights. We aim to respond to verifiable requests within 30 days, or as required by applicable law.

California residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights with respect to personal information we collect:

• Right to know: the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete: request deletion of personal information we have collected, subject to legal exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to limit use of sensitive personal information: we only use sensitive personal information (such as EEO demographics) for the purposes you consented to.
• Right to non-discrimination: we will not deny you service, charge you a different price, or provide a different quality of service because you exercised your CCPA rights.

You may also use an authorized agent to exercise these rights on your behalf. We will require reasonable verification of the agent’s authority and your identity.

JobWillow is for users 18 and older. Candidate registration, and creating an account from a competition invitation, require a date of birth and will not complete for anyone under 18; employers and researchers confirm their age by accepting our Terms of Service. We do not knowingly collect personal information from minors. If we learn that we have, we will delete it.

• All data is encrypted in transit (HTTPS / TLS)
• Passwords are stored using one-way cryptographic hashing (bcrypt)
• Two-factor authentication is available on every account
• Access to production systems is limited and audited

No system is completely secure. We encourage you to use a unique, strong password and enable two-factor authentication.

Security incidents

If we discover a security incident that affects your personal information, we will notify affected users without unreasonable delay and in accordance with applicable law. State and federal laws may require specific notification timelines, methods, and content; we will follow those requirements. You can report suspected security issues to security@jobwillow.com.

JobWillow is operated from the United States. Some of our service providers may process data in other jurisdictions. If you access JobWillow from outside the United States, you consent to the transfer of your information to the United States for processing.

We may update this policy from time to time. When we make a material change, we post the updated policy with a new effective date and describe the change in the list below. Your continued use of JobWillow after the new effective date indicates acceptance of the updated policy. For significant changes we may also notify you by email or in the product, but the posted policy and its effective date are the authoritative record.

Recent material changes

• October 14, 2026: Candidate profiles: added the college within your university, which we may fill in from your verified school and your major and which appears on your resume for employers and teammates but never for faculty researchers; your university now comes from your verified school email, and you can ask us to show a different name, with a reason our administrators review (§2). Employer profiles: we collect the company’s business address and show only its city and state as the company’s location (§2).
• September 28, 2026: Named JobWillow, Inc., a Tennessee corporation, as the company that operates JobWillow (§1, §12). Nothing else in this policy changed.
• September 27, 2026: Competitions: a team’s lead or a co-lead can invite someone to join the team by email. We store the invited address and email the invitation, which names the student who sent it, and remove it on the same schedule as other competition invitations (§2, §6).
• September 27, 2026: Competitions: a team’s submissions and links are visible only to its members, the competition’s organizers, and the judges assigned to it, unless the team’s lead or a co-lead chooses to share them with other teams; organizers no longer make a deliverable visible to the whole competition (§2, §4).
• September 27, 2026: Competitions: a request to join a team now shares your resume with the team’s lead and co-leads, with any answers, writing samples, and references the spot asks for, which we store with the request and delete on the same schedule as the rest of its details; and teammates can see each other’s profile, resume, and contact details; and a team’s links are visible only to its members and the competition’s organizers (§2, §4, §6).
• September 25, 2026: Disclosed competitions, which faculty can host for students on JobWillow. Described what we collect: team membership with the notice and eligibility statement a student confirms, join requests and the profile snapshot shared with a team’s leads, team links, files and project log entries, results, and the scores and feedback judges write; invitations to help organize or judge, which hold the email address of someone who may have no account; and roster lists organizers give us to verify teams, which we do not store (§2). Said who sees what: other students, a team’s leads, organizers, and judges, that employers see nothing, and that competitions never show organizers or judges academic details (§4). Set out retention: competition records are removed 12 months after a competition closes, and competitions close automatically after they end; invitations are removed within 38 days of being created; join-request details are cut back 14 days after a request is declined, withdrawn, or cancelled; team submissions stay with the team after a member deletes their account; and invitees have an unconditional removal path, after which the address stays on our do-not-email list so invitations are not emailed to it again (§6). Accounts created from a competition invitation give a date of birth (§2, §8) and can export their data and delete the account from settings (§7). Also named competition files and emails in the Supabase and Resend entries (§4), and updated the Terms of Service section cited for background checks, which a new Terms section renumbered (§2).
• September 22, 2026: Corrected what this policy says about where your data goes, and disclosed career fairs. Sentry, our error monitoring service, is live on both the website and the API; this policy previously said it received nothing, and it now describes what an error report contains and what we strip out before it is sent (§4). Removed Cloudflare as a provider we use directly, which was never true: Vercel and Render host the site and the API, and each serves traffic through its own edge network, with Cloudflare appearing only as Render’s sub-processor (§4). Added PostHog, a product analytics service that is built into the site but switched off, and committed to updating this policy before activating it (§4). Added a standing promise to keep the provider list current, and re-keyed the promise in §2 from “non-essential cookies” to any flow that sends data from your browser to a third party, because tracking no longer requires a cookie (§2, §4). Disclosed career fairs end to end: registration, walk-up kiosk capture of a name and email from people with no account, check-in and booth-visit records and resume drops (§2); what an exhibitor sees and what the host school sees (§4); and a 12-month retention window after a fair ends, with an unconditional removal path for a walk-up (§6). Said how the two unconditional privacy@jobwillow.com promises are actually carried out: an administrator performs the account deletion behind a second identity check and it is logged (§7), and an administrator takes a testimonial down directly without needing a report first (§2). Stated that error monitoring continues when Global Privacy Control is on, while product analytics does not (§7).
• August 23, 2026: Disclosed three processing activities that were live but missing from this policy: the aggregate reporting partner schools receive about their own student cohort, including how the cohort is derived from a verified email domain and the click counting on school short links (§2, §3, §4); the optional graduate outcome survey and the fields it collects, including self-reported salary (§2); and the internal business-contact and relationship records JobWillow and partner universities keep, including planned metadata-only staff mailbox connections, with an unconditional removal path (§2). Added a category for researcher profiles (§2), the consent gate on academic details for research listings (§3, §4), staff review of reported conversations (§2, §4), and fields that were collected but unlisted: candidate phone, LinkedIn URL, alternate resume email, custom skills, hiring-manager and recruiter contacts on listings, interviewer notes, and the background-check case number (§2). Narrowed the email-files-contacts statement to the scheduling connection it describes (§2), corrected the description of the second essential cookie (§2), disclosed the map library’s telemetry beacon (§2), and stated the export and deletion paths for every role (§7). Also changed what this section itself promises, to match practice: the authoritative record of a change is the posted policy, its effective date, and this list.
• August 4, 2026: Corrected the background-check description (§2). The platform stopped recording “clear” and “flagged” adjudications in May 2026, but this policy still listed them; it also did not mention the optional short note an employer may type. Both are now described accurately. Also stated exactly what removal does for someone listed as a reference (§2): their contact details are erased from the live record and from the snapshot attached to applications already submitted.
• May 31, 2026: Added new disclosures covering references that candidates submit (§2), resume parsing (§2), connected calendar and video accounts via Google, Microsoft, and Zoom (§2 and §4), location data sent to Mapbox (§2 and §4), date of birth captured at signup to confirm age (§2), and an expanded service provider list adding Cloudflare, Mapbox, Google, Microsoft, and Zoom and correcting the file-storage provider to Supabase Storage (§4). Also clarified that JobWillow uses only essential cookies (session and sign-in CSRF protection) and does not use functional, analytics, advertising, or third-party tracking cookies (§2). Added a self-service data export at Settings → Privacy → Export my data for candidates and Settings → Export my data for employers, and documented our Global Privacy Control (GPC) handler (§7).
• May 18, 2026: Added handling for employer-submitted intern testimonials (§2) and described the privacy guards on per-employer aggregate hiring data shown on listings (§4).

Questions, requests, or concerns about your privacy:

• Email: privacy@jobwillow.com
• JobWillow, Inc., Knoxville, TN