On this page
1. Who we are
Justneed (the "Company", "we", "us") is a Swedish-registered company that operates the website justneed.ai and the Justneed mobile application (collectively, the "Service"). We are the data controller for the personal data described in this policy under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (Dataskyddslagen).
If you have any questions about this policy or about how we handle your data, contact us at info@justneed.ai.
2. What we collect
We collect only what we need to make the Service work for you. Here's the full list:
Account information
- Your name and email address (always)
- A password (only if you sign up with email; we never store the plain-text password — only a one-way hash)
- Your Digital Skill ID code (auto-generated, e.g.
DSI-XXXXXX) - Profile photo (optional, if you upload one)
Career data
- Skills, work experience, education, certifications you add to your profile
- Resume / CV file (if you upload one — PDF or Word)
- Cover letter (if you upload one or generate one with our AI)
- Preferred locations, job types, salary expectations
Activity data
- Jobs you swipe on (like / skip / superlike) and jobs you save
- Applications you submit through the Service and their status
- Searches you run and filters you apply
- Messages you exchange with recruiters through the Service (when that feature is live)
Technical data (automatic)
- IP address (used for security and to detect abuse)
- Device type, operating system, browser type
- App version, crash reports (anonymous unless you opt in to detailed reports)
- Approximate location based on IP (city/country level only — we do not access GPS unless you grant permission for a specific feature)
What we do not collect
3. Why we collect it (legal basis)
Under GDPR, every piece of personal data we process must have a lawful basis. Ours are:
- To perform the contract with you (Art. 6(1)(b)) — your name, email, password, Skill ID, profile content, swipes, and applications are all needed to deliver the Service you signed up for.
- Your consent (Art. 6(1)(a)) — for things like profile photo, optional features such as AI cover letter generation, and any marketing emails. You can withdraw this consent at any time without affecting your account.
- Our legitimate interest (Art. 6(1)(f)) — for technical/security data like IP and device info, used to detect abuse and keep the Service safe. We have weighed this against your rights and believe the impact on your privacy is minimal.
- Legal obligation (Art. 6(1)(c)) — to comply with Swedish accounting law, tax law, and lawful requests from authorities.
4. Automated matching & profiling
Justneed uses algorithms to score how well each job matches your Digital Skill ID, to rank jobs you see, and to help the AI draft cover letters tailored to a role. Under GDPR Art. 22 you have the right to know this is happening and what it means.
What we do automatically
- Match scoring: we compare your skills, experience, and preferences against each job's requirements and produce a percentage score (e.g. "88%").
- Ranking: we show you jobs in order of best match first.
- Cover-letter generation: if you choose to use the AI feature, we send the job description and the relevant parts of your Skill ID to our AI provider (see §5) to draft a letter you review before sending.
- Fraud and abuse detection: we look at account signals (IP patterns, signup velocity, duplicate content) to catch fake accounts and spam. This is required to keep the Service usable.
What we do NOT do automatically
- We do not make hiring decisions. The recruiter or employer decides whether to interview or hire you. We are not an employment agency (see Terms §6).
- We do not use your data to produce "credit-score"-style ratings about you.
- We do not share match scores or rankings with third parties except the employer you choose to apply to.
- We do not train external AI models on your personal data (see §5).
Your rights around automated processing
- Explanation: for any match score, you can ask us to explain which skills and criteria produced it. Email info@justneed.ai.
- Human review: if an automated decision materially affects you (we are not aware of any at launch — this is for future features), you can request human review.
- Objection: you can turn off AI cover letter generation in Settings and still use the rest of the Service.
- Correction: if we got your skills or experience wrong, update your Skill ID — the match score recalculates.
6. How long we keep it
We keep each piece of data only as long as we need it for the stated purpose. The full retention schedule:
| Data category | Retention period | Legal basis |
|---|---|---|
| Account profile (name, email, Skill ID content) | As long as account is open | Art. 6(1)(b) contract |
| Resume / CV file you uploaded | As long as account is open; deleted on request | Art. 6(1)(b) contract |
| Profile photo | As long as account is open; delete anytime in Settings | Art. 6(1)(a) consent |
| Swipes, saved jobs, applied-to records | As long as account is open | Art. 6(1)(b) contract |
| Deleted account data (profile, resume, activity) | Erased within 30 days | Art. 17 right to erasure |
| Inactive account | Email warning after 24 months inactivity; deletion 60 days later | Art. 5(1)(e) storage limitation |
| Encrypted database backups | 35 days, then permanently destroyed | Art. 5(1)(f) integrity, 32 security |
| Security & access logs | 12 months | Art. 6(1)(f) legitimate interest |
| Transactional emails sent to you | 12 months, then purged from provider | Art. 6(1)(b) contract |
| Anonymised product analytics | Indefinite (no personal data retained) | N/A — not personal data |
| Financial / invoice records | 7 years | Swedish Bokföringslagen (1999:1078) |
You can trigger a full deletion of your personal data at any time from Profile → Delete Account, or by emailing info@justneed.ai. The 30-day window above is the operational maximum — most data is removed within hours.
7. Your rights
Under GDPR, you have the following rights regarding your personal data. To exercise any of them, email info@justneed.ai — we respond within 30 days.
- Right of access — get a copy of all the personal data we hold about you.
- Right to rectification — correct anything that's wrong. (For most fields, you can do this yourself in the Profile screen.)
- Right to erasure ("right to be forgotten") — delete your account and all associated personal data. You can also do this directly from the Profile screen → Delete Account.
- Right to data portability — get your data in a machine-readable format (JSON) to take it elsewhere.
- Right to restrict processing — tell us to stop processing your data in specific ways while we sort out a dispute.
- Right to object — object to processing based on our legitimate interest, including profiling and direct marketing.
- Right to withdraw consent — for processing based on consent (like marketing emails), withdraw at any time.
- Right to lodge a complaint — you can complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), at imy.se.
8. How we protect it
Security is built in, not bolted on. Our key controls:
- All data in transit is encrypted with TLS 1.2+ (HTTPS everywhere)
- All data at rest in our database is encrypted
- Passwords are stored as bcrypt hashes — we cannot read them, and neither can anyone else who got hold of our database
- Database access is restricted to a small set of authorised engineers; access is logged
- We require strong, unique passwords for all employee and contractor accounts and enforce multi-factor authentication
- Regular automated security scanning and dependency updates
- EU-only hosting — your data never leaves the EU unless explicitly required for a specific feature (like Gemini AI), and even then only minimal data
If we ever experience a data breach affecting your personal data, we will notify the Swedish authority within 72 hours and notify affected users without undue delay, as required by GDPR Articles 33–34.
9. Cookies & tracking
Full details — every cookie by name — are on our dedicated Cookie Policy. The short version: we use minimal cookies and we tell you upfront. On justneed.ai:
- Essential cookies — for login session, language preference, CSRF protection. No consent needed (legally required for the Service to work).
- Analytics cookies — we may use a privacy-respecting analytics tool (Plausible or Fathom — both EU-hosted, no personal data, no cross-site tracking). We will ask for your consent before setting these.
- We do not use advertising cookies, retargeting cookies, or third-party social media trackers. No Facebook pixel, no Google Ads tag, no LinkedIn Insight Tag.
In the mobile app, we use only Firebase Analytics in anonymous mode for crash reports and app stability. You can opt out in your device settings or in the app's Privacy settings.
10. International transfers
Justneed is hosted in the European Union. Most of your data never leaves the EU. The exceptions are:
- Google services (Firebase Auth, Gemini API, Firebase Cloud Messaging) — when used, may involve data transfers to Google servers in the US. These transfers are protected by the EU-US Data Privacy Framework and Google's Standard Contractual Clauses.
- App store providers (Apple, Google) — handle their own data when you download the app; we do not transfer additional data to them.
We do not transfer your data to any country outside the EU/EEA without an appropriate safeguard in place.
11. Children
The Service is not intended for anyone under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, contact us at info@justneed.ai and we will delete it promptly.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will notify you by email and through an in-app notice at least 30 days before the changes take effect. The "Last updated" date at the top of this page always reflects when this policy was last changed.
13. Contact us
Questions, requests, complaints — we read everything.
- Email: info@justneed.ai
- Postal address: Justneed, Strandvägen 38, 196 39 Kungsängen, Sweden
- Organisation number: [To be added]
- Data Protection Authority: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm — imy.se
14. India users (DPDP Act 2023)
If you reside in India, this section modifies the Privacy Policy above where Indian law differs from EU law. Where this section conflicts with a general provision, this section controls for you.
Legal basis
We process your personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act). The default basis is your consent, which you give at signup by accepting these Terms. Where processing is for a "certain legitimate use" defined in the DPDP Act §7 (e.g. compliance with a legal order, employment, public interest), we may rely on that basis without separate consent.
Who you contact — Grievance Officer
For any question about how we handle your personal data, or to exercise your rights, contact our Grievance Officer:
- Jasneet Singh, Grievance Officer
- Email: info@justneed.ai
- Response time: acknowledged within 48 hours, resolved within 30 days
If unresolved, you may escalate to the Data Protection Board of India (once operational) or appropriate consumer forum.
Children
In India, "child" means anyone under 18 years of age (DPDP Act §2(f)). This is different from the EU threshold of 16 used in the main policy. We do not knowingly process personal data of persons under 18 in India without verifiable parental consent. We will not direct behavioural tracking, advertising, or monitoring at children.
Your rights under DPDP Act
- Right to information — a summary of personal data we hold and processing activities performed.
- Right to correction and erasure of your personal data.
- Right to grievance redressal through the Grievance Officer.
- Right of nomination — appoint another person to exercise your rights in the event of your death or incapacity.
- Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Cross-border transfers
Your data is primarily stored in the European Union (Stockholm / Frankfurt). The DPDP Act currently permits transfers to any country not specifically restricted by the Government of India. We will update this section if applicable restrictions are notified.
Data breach notification
In the event of a personal data breach affecting you, we will notify both the Data Protection Board of India (once operational) and you, without undue delay and in any case within 72 hours of our becoming aware of the breach — alongside the GDPR notifications described in §8.
How Justneed operates in India
Justneed is a Swedish-registered sole proprietorship. We are not currently incorporated in India. We serve Indian users as a cross-border digital service and comply with the DPDP Act's extraterritorial scope under §3(b). If we open an Indian establishment in future, we will update this section.
This India section was added to version 1.1 on 13 October 2026 in preparation for parallel soft launch in India.
Changelog
Material changes to this Privacy Policy, in chronological order. Minor edits (typo fixes, formatting) are not logged.
- Version 1.1 · 13 October 2026 — Added §4 Automated matching & profiling (GDPR Art. 22 disclosure). Expanded §5 Who we share it with — explicit AI providers subsection and "we do not train AI models on your data" commitment. Rewrote §6 How long we keep it as a full retention table with legal bases per data category. Added §14 India users for DPDP Act 2023 compliance (Grievance Officer, child = under 18, DPDP rights, breach notification). Added version number to header.
- Version 1.0 · 11 October 2026 — Initial public version.