Data Retention Policy
Last updated: February 12, 2026
This Data Retention Policy explains how long JobJolt retains your personal data, when data is deleted, and how you can request early deletion. This policy supplements our Privacy Policy.
1. Retention Periods
Account & Profile Data
| Data Category | Retention Period | Trigger for Deletion |
|---|---|---|
| Account credentials (email, hashed password) | Duration of account | Account deletion |
| Profile data (name, title, contact info) | Duration of account | Account deletion |
| Career data (experience, education, skills) | Duration of account | Account deletion |
| OAuth tokens (Google, LinkedIn) | Until revoked or account deleted | Account deletion or token revocation |
Content & Documents
| Data Category | Retention Period | Trigger for Deletion |
|---|---|---|
| Uploaded resumes & documents | Duration of account | User deletion or account deletion |
| AI-generated resumes & cover letters | Duration of account | User deletion or account deletion |
| Job descriptions & applications | Duration of account | User deletion or account deletion |
| Fit analyses & follow-up emails | Duration of account | User deletion or account deletion |
Technical & Security Data
| Data Category | Retention Period |
|---|---|
| Access & refresh tokens | Access: 1 hour; Refresh: 30 days (auto-expired) |
| Email verification tokens | 24 hours (auto-expired) |
| Password reset tokens | 1 hour (auto-expired) |
| Server logs | 90 days |
| Database backups | 90 days (rolling) |
2. Inactive Accounts
If your account has been inactive (no login or API activity) for 24 consecutive months, we will:
- Send a notification email 30 days before scheduled deletion.
- Send a final reminder 7 days before deletion.
- Permanently delete the account and all associated data if no action is taken.
Logging in or using any feature resets the inactivity timer.
3. Account Deletion Process
When you request account deletion (via Settings or GDPR endpoint):
- Immediate: your account is deactivated and all active sessions are revoked.
- Within 24 hours: all personal data, uploaded files, and generated content are permanently removed from our primary database and file storage.
- Within 30 days: data is purged from all caches and search indexes.
- Within 90 days: data is removed from encrypted database backups as they are rotated.
4. Data Export Before Deletion
Before deleting your account, you can export all your data in JSON format via the Settings > Privacy > Export Data option or the GET /api/v1/gdpr/export API endpoint. We recommend exporting your data before requesting deletion.
5. Exceptions
We may retain certain data beyond the standard retention periods when:
- Required by law, regulation, or legal proceedings.
- Needed to resolve disputes or enforce our agreements.
- Necessary to prevent fraud or abuse.
In these cases, we retain only the minimum data necessary and delete it as soon as the legal obligation is fulfilled.
6. Third-Party Data Retention
Data shared with third-party processors (AI providers, payment processors, email services) is subject to their own retention policies. We select providers that comply with applicable data protection regulations and limit data retention.
7. Contact
Questions about data retention? Contact us at privacy@jobjolt.xyz.