Privacy Policy

1. Who we are

SabiJorb is an online job marketplace for Nigeria that connects job seekers and employers directly. SabiJorb (“we”, “us”) is the controller of the personal data described here. SabiJorb is operated by SabiJorb Technologies Limited, a company registered in Nigeria with the Corporate Affairs Commission (RC 9919953). Our address is Plot No. 56, Emerald Garden Extension, Emmanuel Mbaka Boulevard, Lugbe, FCT, Nigeria. We have not yet published a named data protection officer on this page; we will add one here when one is designated. You can reach us through the contact form or at contact@sabijorb.com.

2. Personal data we collect

We collect the following, depending on how you use the platform:

• Account data: your name, email address, password (stored only as a hash by our authentication provider), and whether you use SabiJorb to find work, to hire, or both.
• Contact information: a phone number and other contact details you add to your profile or choose to share inside a conversation (for example a WhatsApp number or alternative email).
• Job seeker profile data: your CV / resume files and the information in them, work experience, education, skills, location, salary expectations, availability, and whether your profile is discoverable by employers.
• Employer and company data: your job title and work email, and your company’s name, description, industry, size, website, location, and logo.
• Verification documents: business registration or licence documents that employers upload so we can verify the company before it can post jobs; identity documents or other evidence that a person uploads where we ask for identity verification; and licence and authorisation documents that recruitment agencies upload.
• Job and application activity: jobs you post, jobs you save, searches you choose to save and the job alerts we send for them, conversations and messages between job seekers and employers, interview proposals, and reports you submit about a conversation.
• Community activity: the posts, comments, likes and saves you make in the SabiJorb community.
• Payments and subscriptions: what you bought (for example a job promotion, a profile boost or a subscription), the amount, its status and the payment reference. For renewals we keep a reusable payment token issued by Paystack and the last four digits of the card. We do not store full card numbers.
• Referrals: if you use a referral link or share your own referral code, the code, which account referred which, and any reward.
• Messages to us: your name, email address, the category and the message you send through the contact form.
• Interaction data: a count of how many times your public job-seeker profile has been viewed by employers, and the jobs you mark as not interested, which we leave out of your recommendations. We also use the preferences and details you set in your profile to order search results and recommendations.
• Device location (only if you choose): if you use the “Closest” job search, your browser, with your permission, sends your approximate device coordinates to our server so we can work out distances. We use them for that request and do not save them to your profile or database.
• Personalisation activity (only if you turn it on): the jobs you are shown, open, save, hide or start a conversation about, and the job categories, skills and filters you search with (not the words you type). See how personalisation works.
• Technical and security data: your IP address and request metadata, used for rate limiting, abuse prevention, and, where it is switched on, the bot-protection challenge on sign-up and sign-in. For rate limiting we keep a keyed, pseudonymous form of the IP address, not the address itself. It is derived with a secret key that is held outside our database, so it cannot be turned back into an address without that key, but it is not anonymous: someone who holds the key could recompute it for an address they already know. We do not use third-party advertising or analytics trackers.
• Bot-protection check (only while it is switched on): Cloudflare Turnstile receives your IP address, your browser’s TLS fingerprint and User-Agent header, and our site key and website address. We use it on the basis of our legitimate interest in keeping SabiJorb and its users safe from automated abuse; because it is a security measure we do not ask for your consent, and you can object to it as described in section 10 (Your rights). Cloudflare acts on our behalf when it decides whether a visitor is a bot, and acts on its own account when it uses the same signals to improve its bot detection (see Cloudflare’s Turnstile Privacy Addendum). Cloudflare may process this data outside Nigeria.
• Performance measurements: to monitor, diagnose and improve how fast and reliable SabiJorb is, we collect limited technical timing measurements. In your browser, for about one in four page loads (chosen at random each time on your device, and not remembered), one small report is sent when you leave or hide the page. It holds the standard page-speed measurements (TTFB, LCP, INP and CLS: how quickly the page responded, loaded, reacted and stayed steady), the address of the page without anything after a “?”, how the page was reached (for example a normal visit or a reload), whether your screen is phone, tablet or desktop sized and, if your browser reports it, a rough connection type such as 4g. On our servers, which are not sampled, we record for each page the type of page shown (not the address you typed), how long it took and how many calls it made to our database provider and how long they took. We also record each database call that is slow or fails (which table or function, how long and the result code) and each server error (the page type and address, the kind of error and a reference code, but not the error message). Where an address is recorded, ids and long codes in it are replaced with placeholders, but a short readable word typed directly into a web address could still appear. These records are not designed to include your messages, CV, search words, name, email address, account identifier, sign-in tokens or cookies, or your IP address or browser details, and we do not add any of these to them. They use no cookies or browser storage. They are written to the logs of our hosting provider (Vercel, see section 5), which also keeps its own request records, so we do not describe these measurements as anonymous. We have not set a separate retention period for them.

3. Why we process your data and our legal bases

• To provide the marketplace — creating your account, showing job listings, letting job seekers and employers message each other, arranging interviews, and processing paid job promotions and subscriptions. Processing here is necessary to perform our agreement with you.
• To order results and recommendations from your profile — using the preferences and details you have given us (such as location, skills and job types you want) and the jobs you have hidden. This is part of providing the marketplace to you.
• To put more relevant jobs first, using the jobs you saved, hid or messaged about — this relies on our legitimate interests (section 25(1)(b)(v) of the Nigeria Data Protection Act, 2023): our interest in showing you relevant jobs first. We weighed it against your rights: it uses only your own deliberate choices, it is worked out when you open the page and is not stored, it does not record what you view or search, employers do not see it, and you can switch it off at any time (see section 7). This is a form of profiling; it only changes the order of jobs and has no legal or similarly significant effect on you.
• To verify employers, agencies and identities — reviewing uploaded documents so job seekers can trust who they are talking to. This is necessary for the service and in the legitimate interest of preventing fraud.
• To keep the platform safe — rate limiting, bot protection, investigating reports, and suspending accounts that break the Terms. This is in our legitimate interest and that of other users.
• To send service communications — email about conversations, interview reminders, verification decisions, and account matters. You can adjust notification preferences in your account settings; some essential account emails cannot be turned off.
• To answer your messages to us — replying to what you send through the contact form.
• To meet legal obligations — for example retaining transaction records for paid promotions.

We rely on consent for your acceptance of these terms at sign-up and, where it applies, for making your job-seeker profile discoverable by employers. You can withdraw discoverability at any time in your profile settings.

4. How your data is shared

SabiJorb is a marketplace, so some information is shared with other users by design:

• Approved companies’ public details and their job listings are visible to everyone.
• If you make your job-seeker profile discoverable, a limited profile card (not your CV files or contact details) can be seen by verified employers searching for candidates.
• When you start or reply to a conversation, the other party sees your name and the messages, CV, or contact details you choose to share in that thread.
• Platform administrators can access account, company, conversation, and report data as needed to review verifications, investigate reports, and operate the service. This includes opening the verification documents and CVs you upload when they review a verification or a report. Each such access is recorded in an audit log that does not contain the document, and those records are kept for 730 days. Administrators may use this access only for those purposes. We keep the audit records for that period so that misuse of administrator access can be detected and investigated, and then delete them. You can ask us what is recorded about access to your documents.

We do not sell your personal data. We do not share it with advertisers.

5. Service providers (sub-processors)

We use the following providers to run SabiJorb. They may store or process personal data outside Nigeria:

• Supabase — Database, authentication, and file storage hosting. Our project is hosted in Singapore (AWS ap-southeast-1).
• Vercel — Application hosting and content delivery. Our server functions run in the United States (Washington, D.C. region).
• Resend — Transactional and notification email delivery.
• Paystack — Payment processing for paid job promotions, profile boosts and subscriptions.
• Cloudflare — Turnstile bot-protection challenge on sign-up and sign-in, only while it is switched on.
• Google — Optional sign-in with your Google account.
• LinkedIn — Optional sign-in with your LinkedIn account.

We have only recorded the hosting locations stated above; for the other providers we have not recorded where they process data. Using these providers means your personal data is transferred outside Nigeria; Part VIII of the Nigeria Data Protection Act, 2023 sets the conditions for such transfers. This list will be kept current as providers change.

6. Cookies and similar technologies

Cookies are small text files that a website stores in your browser. SabiJorb sets only its own (first-party) cookies, in two groups. The full list, with what each does and how long it lasts, is on the Cookie settings page.

Necessary cookies are always on. They keep you signed in and secure and remember your cookie choice; SabiJorb cannot work securely without them, so no choice is asked about them:

• Sign-in cookies. When you sign in, our authentication provider sets cookies (their names start with “sb-”) that keep you signed in as you move around the site. They can last up to about 13 months unless you sign out or clear them.
• Short-lived security cookies (nj_oauth_consent, nj_recovery, nj_del_pending, nj_del_authorized). During Google or LinkedIn sign-in, password reset, and account-deletion confirmation for accounts that have no password (Google or LinkedIn sign-in only), we set brief cookies that carry a step of that process (for example, that you accepted the Terms, or that you followed a valid reset link). They expire within five to fifteen minutes.
• Cookie choice (sj_cookie_consent). Records whether you accepted or declined the optional cookies below, for 180 days, so we do not ask on every page.

Optional cookies are set only if you accept them. We do not treat them as exempt just because they are useful. Declining does not limit any feature of SabiJorb:

• Language preference cookie (sj_lang). Remembers your chosen language on this device for up to one year, so the site opens in your language. If you are signed in, we also save your choice to your account, and the cookie may be set on a new device to match it (only if you accepted optional cookies). If it is missing we use your account setting, then your browser’s language, then English.
• Referral cookie (sj_ref). If you open a SabiJorb referral link, this cookie holds the referral code for up to 30 days, so the person who referred you can be credited if you then sign up. It is not readable by scripts on the page, and it is removed once the referral has been processed. If you have not chosen yet, the code is kept only in the sign-up web address and is stored only if you then accept; if you decline, the person who referred you will not be credited.

You are asked on your first visit, in a notice in the middle of the page, and until you choose no optional cookie is set. You can change your mind at any time under Cookie settings (also linked in the footer); declining or withdrawing removes the optional cookies from your device.

SabiJorb does not currently use advertising cookies, analytics cookies, or other tracking technologies, and does not use your browser’s local storage, session storage, or IndexedDB for its own features. If that changes, we will update this policy first. The performance measurements described in section 2 are technical timing records, not advertising or behavioural analytics: they set no cookies, use no browser storage, and carry no account, cookie or device identifier of their own.

Some services are run by other companies, which are responsible for what they set and which SabiJorb does not control. If you sign in with Google or LinkedIn, or pay through Paystack, you are sent to their sites, where they may set their own cookies under their own policies. On the sign-up and sign-in pages only, SabiJorb can load Cloudflare’s bot-protection check (Turnstile) from challenges.cloudflare.com; it does so only while that check is switched on. In our test it set no cookie but stored one small item in your browser storage under Cloudflare’s own address (named cf.turnstile.u); we have not measured what the live configuration stores beyond that. It is part of the bot protection and is not controlled by the cookie choice. You can delete or block cookies in your browser settings, but blocking the necessary sign-in cookies will stop you from staying signed in.

7. Personalised recommendations

Always on, from your profile. The “Recommended” and “Nearby” job lists use details you have put in your profile, such as your location, the states you would work in, your skills, experience and the job types and pay you want. Jobs you have hidden, and jobs you already have a conversation about, are left out. This does not involve watching what you view or search.

Also from jobs you saved, hid or messaged about. The same lists also use the jobs you have saved, hidden or started a conversation about: their category, location, type, level, skills and the employer’s industry. Older choices count for less, and the result is worked out when you open the page, not stored. This uses information we already hold; it does not record what you view or search. You can turn it off at any time under “Personalised job ordering” in your account settings; your Recommended jobs are then ordered from your profile only. This is your right to object: we stop using these choices for ordering as soon as you turn it off, and you can also contact us (section 15). When this started we showed existing job seekers a one-time notice in the app.

Optional, from your activity. If you choose to, SabiJorb can also learn from how you use the site to improve your recommendations. It is off unless you turn it on in your account settings, you can turn it off or reset it at any time, and leaving it off does not limit any feature. Read how it works for what is recorded, how long it is kept and your choices.

Recommendations are suggestions only. SabiJorb does not use them to make hiring or rejection decisions, and employers are not shown them.

8. How long we keep your data

We keep personal data for as long as your account is active and for as long as needed for the purposes above. In general:

• Profile, CV, and company data are kept while your account exists and removed when you delete your account.
• Conversations and messages are kept while either participant’s account exists; when one party deletes their account, their identity is removed from the thread but the messages the other party received remain visible to that other party.
• Business, identity and recruitment agency verification documents are kept while the account exists (agency documents: while the agency’s verification is in force) and are removed when you delete your account. For rejected, withdrawn or lapsed agency applications they may be removed earlier, but we have not set an automatic schedule for this.
• Records needed for legal, accounting, or fraud-prevention reasons (such as payment records for promotions and subscriptions) may be kept longer; when you delete your account they are separated from you and the amounts and products are kept without your identity.
• Messages you send through the contact form are kept until we delete them. Deleting your account does not delete them automatically (it only removes the link to your account). You can ask us to delete them, and we do that by hand.
• Short-lived counters used for rate limiting (a keyed, pseudonymous form of your IP address, or of your account) are removed by a daily cleanup. We keep them for up to two days, and a little longer if a cleanup run is delayed.
• Personalisation activity is kept for a limited time and deleted when you turn personalisation off, reset it, or delete your account; see the notice for the periods.

9. Account deletion

You can permanently delete your account from your account settings. This removes your profile and job-seeker and employer profiles, your CV, profile photo and company logo, the business, identity and recruitment agency verification documents you uploaded, your saved jobs and saved searches, your community posts, comments, likes and saves, and your company’s data. If a file cannot be removed, the deletion stops and you can try again. Your messages to other people are not deleted from their view, but your name is removed and the thread is shown as being with a “deleted user”. Deletion is immediate and cannot be undone. Payment records and contact-form messages are handled as described in section 8.

10. Your rights

Subject to the Nigeria Data Protection Act, 2023, you have the right to be told whether we hold personal data about you and to receive a copy of it, to ask us to correct it, to ask us to delete it, to ask us to restrict or to stop (object to) certain processing, to withdraw consent where we rely on it, and not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. We do not make decisions of that kind: recommendations only order and suggest jobs.

You can exercise many of these directly in the app (edit your profile, change notification preferences, turn off discoverability, delete your account). We do not yet have a self-service data export. To ask for a copy of your data, to ask us to delete or correct something you cannot change yourself, to object, or to raise a concern, use the contact form (choose the “Account” category and say what you are asking for). We may need to confirm that the request comes from you, and we will respond without undue delay. If you are not satisfied, you have the right to lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).

11. How we protect your data

Access to personal data is controlled by row-level database security so that users can reach only their own records and the data the marketplace is designed to show. Uploaded files (CVs, logos, verification documents) are kept in private storage and served only through short-lived links to authorised users. Passwords are handled only by our authentication provider and stored as hashes. We apply rate limiting and bot protection to sensitive actions and transmit data over encrypted connections. No system is perfectly secure, but we work to protect your data and to limit who can see it.

12. Data breaches

If a personal-data breach occurs that is likely to affect your rights, we will notify the Nigeria Data Protection Commission (within 72 hours of becoming aware of it, as the Nigeria Data Protection Act, 2023 requires) and affected users without undue delay, and describe what happened and what we are doing about it.

13. Children

SabiJorb is not intended for anyone under 18. We do not knowingly collect data from children. Optional activity-based personalisation is only for people aged 18 or over, and turning it on requires you to confirm that you are. You also confirm that you are 18 or older when you create an account (we do not verify your age beyond that confirmation). If we learn that someone under 18 has registered, we may close the account.

14. Changes to this policy

We may update this policy as the service develops or the law changes. If we make a material change we will update the effective date and version above and, where appropriate, notify you or ask you to accept the updated terms.

15. Contact

Questions about this policy or your data: use the contact form or write to contact@sabijorb.com. Our address: Plot No. 56, Emerald Garden Extension, Emmanuel Mbaka Boulevard, Lugbe, FCT, Nigeria. A named data protection officer will be added when one is designated.