Privacy Notice

Who to ask

Our Data Protection Officer answers every question, request and complaint about your personal data at dpo@jomnext.com. If you’re not happy with our answer, you can complain to the Personal Data Protection Commissioner (pdp.gov.my).

What we keep

• Your account: your name, email address and password (stored only as a secure hash), and a record of what you agreed to and when. For each signed-in session, the IP address and browser it came from. If you turn on two-step sign-in, its secret and backup codes, encrypted. For each passkey you add, its name, the date you added it, its type and the public key that checks it. Which months you used JomNext, and what running it for you cost us.
• Your Profile and Resumes: what you enter or import: contact details, work history, education, skills, projects, languages, work authorisation, driving licence and own transport, your Job Preferences (including expected salary), your Answer Bank and an optional photo.
• Files you upload: resumes and LinkedIn data exports, kept exactly as uploaded and encrypted, until you remove them.
• Emails you forward to your Hiring Inbox from your Alert Email: the whole email, encrypted, and a copy of its text with IC and bank-account numbers masked, plus your Alert Email and the Gmail address that set up forwarding.
• Your job search: Applications and their history, Interviews, Offers and recruiter contacts you add, Apply Kits, Job Matches, Saved Jobs, jobs you marked Not interested, scam reports you make, notifications and your settings.

We never ask for, or keep in your Profile, your IC number, race, religion, date of birth, gender or marital status. A file or email you send us can still hold them, or other sensitive details such as your health. We keep and read those files and emails only with your explicit consent, which you give when you set up your Hiring Inbox and each time you upload a file, and only to run JomNext for you. We don’t copy those details into your Profile, and IC and bank-account numbers are masked to their last four digits everywhere we show, search or send text.

Your files and emails can hold details of other people, such as recruiters who wrote to you or referees on your resume. Add other people’s details only for your own job search, and delete them when you no longer need them.

Where it comes from

From you: what you type, the files you upload and the emails you forward. Your browser sends us its IP address and type when you use JomNext. Jobs come from the LinkedIn, JobStreet and Indeed job alerts you forward, and the job links you add. We don’t buy data about you or collect it from anywhere else.

What you must give us

Your name, email address and a password are needed to create an account, and your Alert Email (the address your job alerts go to) and Career Stage to start using it; without them you can’t use JomNext. Everything else is your choice, though Resumes and Job Matches can only use what you give.

Why we use it

To run JomNext for you: to build your Resumes, match you with jobs, prepare Apply Kits, read the emails you forward and keep your Tracker up to date, and to email you about your account and the notifications you keep on. Also to keep JomNext secure and working, to check scam reports so other job seekers can be warned (we keep the employer, job title and sender’s domain, never your name), and to do what the law requires.

We never sell your data, use it for advertising, send you marketing or pass it to employers: you apply to every job yourself.

We use it because you agreed to this notice when you signed up (and agreed again when you set up your Hiring Inbox and each time you upload a file), because running the service you asked for needs it, and where the law requires it.

AI

Writing and reading features use Claude AI models through OpenRouter, served only by Google Vertex AI, which neither trains on what we send nor keeps it. IC and bank-account numbers are masked in all text we send, and a PDF whose text holds one goes as that masked text, not as the file. Every AI suggestion is yours to accept or ignore. Your Job Matches are for you alone: no employer or anyone else sees them, and they decide nothing about you.

Who handles it, and where

JomNext runs on these services, which store or process your data for us, outside Malaysia:

• Cloudflare (United States company): the app, your files (kept in Asia-Pacific), receiving email and printing Resume PDFs. Its logs of each visit and email (IP addresses, email addresses) are kept for 7 days.
• Neon (United States company): the database, in Singapore.
• Resend (United States company): sending our emails to you. It keeps a record of each email for 30 days.
• OpenRouter and Google (both United States companies): the AI features.

When you sign up you agree to this transfer outside Malaysia. Each of these services is bound by contract to protect your data and to use it only to provide its service. We share your data with no one else, unless the law requires it. When you send a Resume or Apply Kit to an employer, you share it yourself, on their site.

If you choose Continue with Google or Continue with Apple (both United States companies), that company signs you in under its own privacy policy and gives us your name and email address, or, with Apple’s Hide My Email, an Apple address that forwards to yours.

Cookies

We use only the cookies JomNext needs to work: one that keeps you signed in (and one that lasts while you finish two-step sign-in), and one that remembers whether the side menu is open. There are no analytics, advertising or tracking cookies, and no third-party trackers, so we don’t ask about cookies. If you block them, you can’t sign in.

How long we keep it

• Everything stays until you delete it, or delete your account.
• Forwarded emails are kept whole for 180 days. After that only what we read from them stays (the company, role, stage and dates).
• Deleting your account deletes everything at once, files included; copies in our services’ logs and backups are gone within 30 days. Our records of what running the service cost, and any scam reports you made, are kept without your name.
• If you don’t use JomNext for 5 years, we delete your account; until then we keep it, so it’s ready for your next job search. We email you at least 30 days before, and using JomNext in the meantime keeps it.

Your rights

• See and correct it: everything you gave us is in the app, and you can change it at any time.
• Take it with you: in Settings, download a copy of everything your account holds as one ZIP file, with the files you uploaded and the emails you forwarded, in formats other services can read. Only your password and other sign-in secrets are left out.
• Limit what we do with it: turn off notification emails in Settings, delete anything you added, or stop forwarding to your Hiring Inbox (remove the Gmail filter) and delete its emails. To close your Hiring Inbox, write to dpo@jomnext.com.
• Withdraw your consent: delete your account in Settings, and everything goes, or write to dpo@jomnext.com; we then stop using your data, which closes your account.

You can also write to dpo@jomnext.com to ask for a copy of your data, to correct it, to send your data download to another service you name, where that’s technically possible, or to stop using it in a way that causes you harm or distress. Write from your account email so we know it’s you. It’s free, and we reply within 21 days; if we can’t do what you ask, we say why.

Keeping it safe

The app is served only over HTTPS. Uploaded files, forwarded emails and new profile photos are also encrypted where they’re stored, and you can turn on two-step sign-in. If a breach of your data is likely to cause you significant harm, we tell the Personal Data Protection Commissioner within 72 hours of finding it, and email you within 7 days after that: what happened, and what you can do.

Age

JomNext is for people aged 18 or older. If you think someone under 18 has an account, tell us at dpo@jomnext.com and we delete it.

Changes

If we change this notice in a way that matters, we email you before the change takes effect, and the date at the top changes. If a change needs your consent, we ask for it before it applies to you. This notice is in English and Bahasa Malaysia, and both carry the same weight; if they ever differ, the one better for you applies.