Privacy Policy

1. Introduction

Welcome to ZapplyX ("we", "our", or "us"). ZapplyX provides an automated job search intelligence and founder outreach workstation accessible at https://www.zapplyx.com. We are committed to protecting your personal information and respecting your privacy rights.

This Privacy Policy explains how we collect, use, store, protect, and disclose information when you use our platform, services, and Google OAuth integrations.

2. Information We Collect

We collect information that you directly provide to us or authorize third-party platforms to share with us:

• Account Registration Details: Username, email address, password hashes, and profile settings.
• Google User Data (via Google OAuth 2.0):
  • Identity Profile Data: When you use "Sign in with Google", we receive your Google user ID, verified email address, full name, and avatar picture.
  • Gmail Integration (User-Initiated Outreach): If you explicitly choose to connect your personal Gmail account via our Settings drawer to send job applications and outreach emails, we request OAuth permission (https://mail.google.com/) to transmit emails on your behalf and track replies directly within your dashboard.
• Candidate Profile Data: Resume files (PDFs), extracted skills, contact information, education, and tailored cover letters or LaTeX documents uploaded to your workstation.
• Technical & Usage Data: IP addresses, browser user-agent, session timestamps, and system logs necessary for debugging and security auditing.

3. How We Use Your Information

We use your collected information strictly to deliver, secure, and improve ZapplyX services:

• To authenticate your identity and facilitate frictionless single sign-on (SSO) with Google.
• To orchestrate automated outreach and deliver job applications to verified founders using your designated email sender account.
• To deliver our optional Startup Intelligence Radar daily 8:00 AM curated morning briefings if you have subscribed to receive updates.
• To maintain account security, monitor credit usage, and prevent fraudulent access.

4. Google User Data Protection & Limited Use

We treat all Google user data with the highest degree of security and confidentiality. In full compliance with Google's Limited Use policy:

• No Advertising: We never use Google user data to serve, optimize, or target advertisements.
• No Sale of Data: We never sell, rent, or trade Google user data or contact dossiers to data brokers or third parties under any circumstances.
• No Generalized AI Training: We never use Google user data (including email contents or profile information) to train, retrain, or improve generalized or public Artificial Intelligence (AI) / Machine Learning (ML) models.
• Human Access Restrictions: Human employees or contractors are strictly prohibited from viewing or reading your private Google account or email data, unless:
  • You have given explicit permission to investigate a specific technical support issue;
  • It is strictly necessary for security purposes (such as investigating system abuse or malware); or
  • Required by applicable legal process or subpoena.

5. Data Storage, Security & Encryption

We employ industry-leading technical and organizational security measures to protect your information:

• Encryption in Transit: All data transmitted between your browser, our servers, and Google APIs is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
• Encryption at Rest: All OAuth tokens (access tokens and refresh tokens) and external API keys are encrypted at rest using industry-standard AES-256 encryption before being stored in our database.
• Token Revocation: Access tokens are automatically refreshed and securely discarded when no longer valid.

6. User Control, Data Retention & Deletion Rights

You retain full control over your personal information and Google integrations:

• Disconnect Google Integration: You can disconnect your Google account and revoke access tokens at any time directly within the ZapplyX Settings drawer by clicking "Disconnect Google Account".
• Revoke Permissions via Google: You can independently revoke ZapplyX's access to your Google account at any time through the Google Account Permissions Manager.
• Account & Data Deletion: You may request complete erasure of your account, candidate dossiers, and stored tokens by contacting our data privacy officer at devansh@zapplyx.com. We will process and purge your data within 7 business days.

7. Third-Party Disclosures

We do not share your personal information with third parties, except:

• With trusted cloud infrastructure providers (such as hosting and database providers) bound by strict confidentiality agreements to operate the application.
• When required by law, regulation, or court order.

8. Contact Us

If you have questions, feedback, or concerns regarding this Privacy Policy or our data protection practices, please contact us:

• Developer & Data Privacy Officer: Devansh Shukla
• Email: devansh@zapplyx.com
• Website: https://www.zapplyx.com