Version 1.1 • effective 10 September 2026
JOBisto • support@jobisto.app
This Privacy Policy explains how personal data are processed when using the JOBisto mobile application, the jobisto.app website, cloud services and related features (the “Service”).
For personal data relating to the JOBisto account, security, subscription, support and operation of the Service, the JOBisto operator acts as controller to the extent determined by applicable law.
Where a business user uses JOBisto to process personal data of customers, employees, subcontractors, suppliers or other persons and JOBisto processes those data on the user's behalf through cloud or server features, JOBisto may act as processor. This relationship is further governed by the Data Processing Addendum (DPA).
We may process, depending on the features used:
account and sign-in data, in particular email address, Firebase UID and authentication data needed for sign-in or verification;
work data entered or imported by the user, such as customers, jobs, notes, calendar, planning, diary, materials, expenses, reminders and related records;
device and installation technical data, including an internal installation/device ID, app version and data needed for security and active-device control;
subscription and entitlement data, such as status, validity, product or offer, identifiers and technical data needed to verify a Google Play purchase;
AI usage data needed to apply the relevant limit, prevent abuse and operate the Service;
crash and error diagnostic data through Firebase Crashlytics, such as app version, device type, operating system, stack trace and related technical data;
data expressly submitted by the user to an AI feature, such as a photo, image, PDF or a text extract from a processed Excel file;
communications data needed for service, security or retention notices and support.
A significant part of JOBisto work data is stored locally on the device. Photos attached to jobs are local files. Removing the app, clearing device data, or losing or damaging the device may result in loss of local data or files not included in a supported backup.
JOBisto may provide a separate full backup or export created by the user. Its content and protection depend on the function presented in the app at the time it is created.
If the user uses cloud backup, supported structured data are sent to the JOBisto backend and stored in Google/Firebase cloud infrastructure. Cloud backup does not include photos, user files or data located among deleted items.
The user may delete the cloud backup separately. Deleting the cloud backup alone does not delete the entire JOBisto account.
AI analysis is performed only following a user action. A supported document or content is sent through the JOBisto backend to the AI provider needed to perform the analysis. The OpenAI API key is stored on the server and not in the app APK.
The JOBisto backend intentionally does not retain a copy of the user's AI document as a permanent server file solely for AI analysis. For Excel files, the app may process the file and send the text extract needed to recognize its structure.
Requests to the OpenAI API are sent with store=false. This does not mean absolute zero retention by the provider: certain data may be retained temporarily in security or abuse-monitoring logs under the provider's current terms and applicable law. API data are not used for model training by default unless the API customer expressly opts into sharing for that purpose.
Depending on the processing, legal bases include:
performance of the contract and provision of JOBisto functions, the account, cloud features, AI features and subscription management;
legitimate interests in securing the Service, preventing abuse, protecting infrastructure, diagnosing errors and enforcing technical limits;
compliance with legal obligations where applicable to the operator;
consent only where consent is required as the relevant legal basis under applicable law.
František Rózsa
Business ID (IČO): 46658602
Trade Register No.: 220-28372, District Office Galanta
Veľká Mača 894, 925 32 Veľká Mača, Slovakia
Email: support@jobisto.app
Depending on the feature used, the Service may involve:
Google/Firebase – authentication, cloud database, backend infrastructure and Firebase Crashlytics;
Google and Google Play – sign-in, app distribution, subscriptions, purchases and entitlement verification;
OpenAI – AI processing of content expressly submitted by the user for analysis;
Resend or another currently used transactional-email provider – delivery of service, security and retention notices;
other necessary technical providers if properly engaged in operation of the Service.
A current list of processors and subprocessors, where relevant, may be published separately on jobisto.app. JOBisto does not sell users' personal data to advertisers.
Some providers may, depending on their infrastructure, process data outside the European Economic Area. Where GDPR transfer rules apply, an appropriate legal mechanism is used, such as an adequacy decision, Standard Contractual Clauses or another mechanism permitted by law.
JOBisto processes technical data needed to verify whether an account has a valid entitlement, determine the relevant billing or trial period and apply feature limits. Payment is processed by Google Play; JOBisto does not need to obtain the user's full payment-card details.
We retain data only for as long as needed to provide the Service, fulfil the relevant purpose, protect the Service or comply with legal obligations.
If a paid subscription ends and is not renewed, the account and JOBisto server or cloud data may be retained for up to 150 days after the entitlement ends so that the user has a reasonable opportunity to renew, access supported data, export data or delete the account. Before planned automatic deletion, JOBisto aims to send notices to the registered email address approximately 30 days and 7 days in advance.
If entitlement is restored during the retention period, automatic deletion due to subscription expiry will not take place unless a new retention and deletion basis later arises. An active paid subscription is not deleted merely due to inactivity.
The retention period does not prevent the user from using the account-deletion function earlier. Limited records may be retained longer where required by law, for the establishment or protection of legal claims, or due to a provider's security obligation.
The account-deletion function is intended to remove the JOBisto account and data JOBisto retains for that account in its server or cloud infrastructure, including the supported cloud backup, server-side AI usage data, device data, entitlement/subscription data and authentication account, within the implemented process. The app then removes local JOBisto data according to the implemented process.
Separate functions, such as deleting the cloud backup or clearing data only from a particular device, do not necessarily delete the entire account.
JOBisto uses appropriate technical and organizational measures to protect data. Server operations are tied to the authenticated user and selected sensitive data or entitlements are managed by the server. No electronic service can guarantee absolute security.
To the extent provided by GDPR, a data subject may have rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent where processing is based on consent. The data subject also has the right to lodge a complaint with the competent supervisory authority.
Where a request concerns data entered into JOBisto by a business user about its customer or another person and JOBisto acts only as processor, the request may need to be handled through that business user as controller.
JOBisto is a work application intended mainly for business and professional use and is not intended for children.
jobisto.app serves as an informational website for JOBisto, support and legal documents. While the website does not use advertising trackers, analytics tools, a newsletter or marketing cookies, JOBisto does not process such data through the website. If the website's operation changes, this Policy and any required cookie information will be updated as appropriate before new technologies are used.
We may update this Policy due to changes in the Service, providers, legal requirements or processing practices. The current version and effective date will be available on jobisto.app and, where appropriate, in the app. Where law or the nature of a change requires additional notice or user action, JOBisto will provide it as appropriate.
Privacy questions or requests may be sent to support@jobisto.app.
JOBisto processes technical data needed to verify entitlement, determine billing or trial periods and enforce feature limits. Payment itself is processed by Google Play; JOBisto does not store your full payment-card details. The Google Sign-In identity used for a JOBisto account and the Google Play account used for payment may be different, and JOBisto may not know the payer’s email address.
For subscription integrity, one-time trial enforcement and AI allowances, JOBisto may retain minimized technical links and purchase-lineage history. This may include an internal billingAccountId, hashed identity aliases, a purchase-token hash or lineage, subscription phase and expiry, trialUsed status, and AI usage period/count. Raw purchase tokens are not intended to be retained as permanent archive identifiers.
Deleting a JOBisto account removes ordinary account, user, work and cloud data covered by the implemented deletion process, including the supported cloud backup and authentication account. However, minimum server-side records may remain where necessary for billing/purchase lineage, subscription history, one-time trial enforcement, AI allowance integrity, fraud and abuse prevention, security, legal or accounting obligations, or legal claims. Such records are limited to what is necessary and use minimized or hashed identifiers where appropriate. Deleting and recreating an account therefore does not reset preserved billing or anti-abuse history.
After a paid entitlement expires without renewal, JOBisto account and server/cloud data may be retained for up to 150 days. JOBisto will use reasonable efforts to send warnings to the registered email address approximately 30 and 7 days before planned automatic deletion. Active paid subscriptions are not deleted merely for inactivity.
AI analysis occurs only following a user action. Supported photos, images, PDFs, Excel-derived content or other supported content may be sent through the JOBisto backend to the AI provider. The OpenAI API key is stored on the server, not in the APK. Requests are sent with store=false. That setting does not itself mean absolute zero provider retention; any temporary retention for security, abuse monitoring or legal reasons is governed by the provider’s current terms and settings.
Where applicable law requires consent for a particular processing activity, JOBisto will request consent in the manner required by that law. If processing is based on consent, it may be withdrawn prospectively. Merely using the Service is not treated as a substitute for separate, express or otherwise specific consent where the law requires it.
JOBisto is a professional work application and is not intended for children. JOBisto does not knowingly ask children to create accounts or provide personal data. Where applicable law sets a minimum age or requires parental or guardian consent, JOBisto will respect the applicable age threshold and legal requirements. If we learn that a child’s personal data was obtained without the required authorization, we will take appropriate steps in accordance with applicable law.
Where the GDPR applies, you have the right to lodge a complaint with a competent supervisory authority. In Slovakia, the supervisory authority is the Office for Personal Data Protection of the Slovak Republic. Current contact details and procedures should be verified at www.dataprotection.gov.sk.
If JOBisto is permanently discontinued, the operator will use reasonable efforts to give advance notice and a reasonable opportunity to export or back up supported data. After the announced shutdown date, cloud accounts and data may be deleted without a further 150-day hosting commitment solely because of the ordinary post-subscription retention period. Data that must remain for legal, accounting, security or claims-related reasons may be retained to the necessary extent.