Privacy policy

What we collect

• Account: your name, email address, profile picture and Google account ID, from Google sign-in.
• Résumé: the file you upload and the text we extract from it.
• Profile and preferences: work history, education, skills, roles, locations, salary expectations, work authorisation, links and the settings you choose (minimum fit, limits).
• Answers: your answers to application questions, including answers you ask us to remember for later applications.
• Job applications: the jobs we matched and applied to for you, what was sent, its status, verification codes you enter in the app, and outcomes you report.
• Device information: device model, operating system and app version, push-notification token and IP address, used for sign-in security, rate limiting and notifications.
• Usage and crash data: which screens and features are used, with no personal content, and crash reports with contact details and tokens removed.
• Payments: order and payment IDs, amounts, credit balance and history. Card and UPI details go directly to Razorpay; we never see or store them.

Why we use it

We do not sell your data, show ads, or use your résumé or answers to train AI models.

• To run the service you asked for: read your résumé, build your profile, find and score matching jobs, and prepare and submit applications you have authorised.
• To tell you what happened: notifications about applications, questions that need you, and verification codes.
• To keep accounts and the service safe: sign-in, abuse prevention, rate limits, audit logs and fixing crashes.
• To improve the product using aggregated usage numbers (never the content of your résumé or answers).
• To process payments and keep records the law requires.

Google sign-in

Sign-in asks Google only for the scopes openid, email and profile: your Google account ID, your email address and whether it is verified, your name and your profile picture. We do not request access to Gmail, Google Drive, Contacts or any other Google data, and we do not keep Google access tokens or offline access.

Job Co-Pilot’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Job Co-Pilot’s access at any time from your Google Account (Security → Third-party connections).

Who processes your data

We use these service providers (processors) under contract, only to run Job Co-Pilot:

Supabase

Database and private file storage for your account, profile, résumé and applications. Hosted in Mumbai, India.

Render

Runs the website, API and background workers. Servers in Singapore.

Google Gemini

AI that reads résumé text (contact details are masked first) and job descriptions to extract your profile and score matches. [LEGAL: confirm the data-use terms of the Gemini API plan in use.]

Razorpay

Payment processing for credits (card and UPI). India.

Firebase (Google)

Delivers push notifications to your phone.

Google Sign-In

Authenticates your account.

Sentry

Crash reports, with emails, phone numbers, tokens and résumé content removed before sending.

Employers

When an application is submitted for you, the information that application needs (for example your name, contact details, résumé and answers) is sent to the employer through the employer’s hiring system (such as Greenhouse). The employer then handles it under its own privacy policy.

How long we keep it

Account, profile, résumé, answers

While your account is open. Deleted within 30 days after you delete your account.

Applications history

While your account is open, so you can see what was sent. Deleted with your account.

Verification codes

Used for the one application they belong to, then deleted after [CODE RETENTION].

Payments records

As long as tax and accounting law requires ([PAYMENT RECORD RETENTION, e.g. 8 years]), without your résumé or answers.

Usage analytics, logs and crash reports

[LOG RETENTION, e.g. 90 days] in identifiable form, then aggregated.

Backups

Roll off within [BACKUP RETENTION, e.g. 7 days].

Export, deletion and your other rights

• Export: download a copy of your data from You › Account & privacy › Export my data.
• Delete: delete your account from You › Account & privacy. Your data is removed as described above, and Google access is no longer used.
• Correct: edit your profile, preferences and saved answers at any time.
• Withdraw consent: pause or stop automated applications at any time from Home; delete saved answers you no longer want used.
• Ask us: write to [CONTACT EMAIL] for access, correction, deletion or a complaint. Grievance officer: [GRIEVANCE OFFICER NAME], [CONTACT EMAIL]. We reply within [RESPONSE TIME, e.g. 30 days].

Security

Data is encrypted in transit and at rest; sensitive values such as saved codes are encrypted again by the application. Staff access is limited, logged in an append-only audit log, and the admin tools cannot show résumé text, answers or codes.

Age

Job Co-Pilot is for people aged 18 or over.

Changes

If we change this policy in a way that matters, we will tell you in the app before the change applies.