Privacy notice

1. Information we handle

• Account and authentication: name, email, password authentication records, optional phone, session identifiers, IP address and browser/device information. If you choose Google sign-in, we receive the identity and authorisation information needed for that sign-in, not permission to read your Google mailbox.
• Your candidate information: details you enter manually, or an original CV and its extracted text, together with your profile, experience, education, skills, links, job preferences, salary expectations, notice period, work authorisation and answers you choose to provide. Before creating an account, you can review and correct this information in a temporary setup draft. We also record the draft’s privacy permission, version and time, and a network-address digest for rate limiting. Optional demographic or disability responses may be included only if you provide them.
• Documents and applications: supporting files, their readable text, preparation notes, application answers, cover letters, employer/job details, timestamps, submission evidence and screenshots.
• Your job-search inbox: inbox address, recruiter messages and attachments, reviewed replies, delivery information and next-action classifications.
• Billing and service records: subscription and payment references, payment-provider events, referrals, bonus access, acceptance version and time, support correspondence and technical usage/error records. Payment credentials are handled by the payment provider; do not send them to support.

Provide only information needed for your job search. Avoid uploading Aadhaar, PAN, passport scans, bank information, medical records, confidential employer material or other people’s data unless genuinely required and specifically supported. Removing unnecessary data before uploading reduces its exposure.

2. Why we use it

We use setup drafts to let you review your details and preferences before sign-up and carry the saved information into your new account. Entering details manually does not itself run CV parsing. Saving or confirming a setup draft does not authorise employer applications or start a subscription; a real CV and separate Autopilot authorisation are required before automatic applications can begin.

We use account information to authenticate you, maintain your workspace and communicate about the service. We use your CV, facts and preferences to parse your profile, suggest factual preparation, match roles, prepare answers and, following your separate activation, submit supported applications. Inbox information lets us receive, organise and classify recruiter messages, forward important updates to your account email, and send replies you review.

Billing, referral and acceptance records support payment reconciliation, access entitlements, abuse prevention, dispute handling and compliance. Technical records help keep the service secure and diagnose failures. We do not sell candidate data or use uploaded CVs for third-party advertising. We do not seek marketing consent through the mandatory service checkboxes.

3. AI processing and its limits

Google Cloud (Gemini through Vertex AI) or Anthropic, according to the configured AI provider, processes the information needed for CV reading, job analysis, application preparation and recruiter message classification. CV reading extracts a candidate profile and stated facts. A PDF CV may be transmitted as a document; DOCX content is transmitted as extracted text. Application preparation may include your confirmed profile, facts, custom answers and relevant CV text. Email classification may include recruiter message content and application context. Do not include an optional sensitive answer unless you want it used for its stated application purpose.

AI output can be inaccurate. Review the parsed profile before confirming it, and inspect application history and important messages. Supporting documents are stored and extracted for your candidate workspace; they are not automatically attached to employer applications. We do not promise that outside providers have zero retention or processing only in India; their contractual and legal obligations also apply.

4. Who receives information

• Employers and their application systems: your main CV, application email, relevant confirmed answers and any authorised application materials. Their privacy notices govern what they do with received information.
• Service providers: Google Cloud (Gemini through Vertex AI) and Anthropic, as configured, for CV reading, job analysis, application preparation and recruiter message classification, AgentMail for inbox provisioning and mail processing, Razorpay for subscription payments, Google if you choose its sign-in, and hosting, storage or configured email providers necessary to operate the service.
• Employer discovery: where enabled, Google Search through Gemini on Vertex AI, or a configured search provider such as Brave, receives queries based only on target roles and preferred locations. We do not include your name, contact details, CV text or supporting documents in these search queries. Discovered employer pages are checked before they enter the job catalogue.
• Authorised personnel: limited administrative and support access for operating, securing and troubleshooting the service. Your workspace is not public simply because an administrator can support it.
• Legal recipients: regulators, courts or other recipients where disclosure is legally required, or reasonably necessary to establish or defend a lawful claim. A business transfer may involve relevant records, subject to applicable safeguards and notice.

Providers and employer systems may process information outside India. Transfers remain subject to applicable law and restrictions. We do not claim all data stays in India or that employer processing remains under our control.

5. Sharing and referrals

Share cards are optional. Creating a share link makes the selected first name, employer, role and interview/offer outcome available to anyone with that link, along with a referral link. Revoking it stops access through our link; it cannot delete screenshots or copies someone already made. Never create a share card for a confidential offer or outcome you do not want disclosed.

An invite link may show the inviter’s first name. Referral reporting shows aggregate join, activation and subscription counts and earned bonus access. It does not give the inviter your CV or inbox. Do not post private account URLs, document links or message content publicly.

6. Retention and deletion

Before sign-up, we store an uploaded CV and parsed details, or the manual details and preferences you save, as a temporary setup draft on our servers. A private browser cookie holds the identifier and secret needed to access the draft, rather than the CV or answers themselves. Draft access expires 24 hours after creation; reviewing or saving changes does not extend that period. Expired drafts and any stored CV files are removed by scheduled cleanup, so deletion may occur after access ends. Using the setup’s discard or start-over control requests earlier removal; clearing the browser cookie alone does not delete the server-held draft.

After account sign-up or sign-in with the required account permissions, an eligible new account can receive the draft’s saved profile, facts and preferences, together with the original CV if one was uploaded. Once that transfer succeeds, we remove the temporary draft and clear its cookie; failed cleanup may be retried by scheduled maintenance. The transferred information then follows the account retention rules below. A manual draft does not create a CV file.

Your account information, CV, documents, applications and inbox history are kept while needed for the account and service. Locally queued AI prompt/result payloads are scheduled to be scrubbed after 30 days; cost, status and error metadata may remain. Provider retention is separate. Acceptance receipts contain the policy version, purpose, server time, source and relevant billing/permission details. A keyed digest identifies the account email without storing the plain email in the receipt. These minimal receipts are kept while your account is active and may remain for three calendar years after account deletion, after which scheduled cleanup removes them. Evidence retention does not itself end a current permission; you can withdraw it through the controls described below. They do not contain your CV or inbox. Limited billing, complaint or security evidence may also remain where needed for a legal duty or a documented dispute, with retention limited to that purpose.

Account deletion first confirms cancellation of the subscription, pauses applications and requests deletion of the service inbox. It removes account files and related workspace records. If cancellation or provider cleanup fails, deletion may be incomplete; the interface reports the failure so you can retry or contact us. Payment-provider records, legally required records, backup copies awaiting their retention cycle, and information already sent to employers may remain. Our deletion process cannot erase another organisation’s independently held copy.

7. Your controls and privacy requests

Use your candidate workspace and Settings to inspect and correct your profile, preferences and facts, manage documents, pause Autopilot, cancel renewal or delete your account. You can download originals and inspect sent applications. Our permissions and account controls let you pause, cancel or delete without accepting revised terms. To request access, a portable copy, correction, erasure, information about recipients or help withdrawing a specific permission, use the company privacy email from your account address. We verify identity proportionately before releasing or changing private information.

Pausing withdraws authority for new automatic application work; it does not recall a submission already in progress. To withdraw consent for the underlying account processing, use account deletion or contact us. Some functions cannot operate without the information necessary for them. Withdrawal does not undo processing already lawfully carried out, and it does not itself erase a legal record or cancel a payment mandate unless you also cancel or complete account deletion.

We respect rights and response periods under the law applicable to your request. Indian data protection provisions have phased commencement; this notice does not represent that every statutory mechanism is already operational. Where available, you may approach the competent regulator or Data Protection Board after using the applicable grievance process. Statutory rights remain available regardless of contract wording.

8. Security, children and updates

We use authentication, access controls and other reasonable measures appropriate to the service. Authorised staff may access information for necessary operations. No internet service can guarantee absolute security, and we do not claim end-to-end encryption of employer submissions. Keep your account and devices secure, and report suspicious access to our contact channel.

The service is for adults aged 18 and over. Do not upload a child’s CV or create an account for a child. If you believe a child’s information has been provided, contact us so we can investigate and take appropriate action.

We will update this notice when the service or processing changes. We give notice and obtain additional consent where required for a new purpose. Questions and grievances go to the published operator and grievance contact. See our Cookie Notice for browser storage.