Privacy Policy

This policy explains what JOB-EASY collects when you use JOB-EASY, why we collect it, who else can see it, and what you can ask us to do about it. It is written to be read, not to be survived — if anything here is unclear, write to and we will explain it in plain terms.

JOB-EASY is the data fiduciary (under India's Digital Personal Data Protection Act, 2023) and the data controller (under the UK and EU GDPR) for the information described below.

1. What we collect

1.1 Your account

• Username, email address and password. Passwords are stored only as a bcrypt hash — we cannot read yours, and neither can anyone who obtains a copy of our database.
• Account status and role, because new accounts require administrator approval before they can be used.
• Sign-in history: the time, IP address, browser user-agent and whether each attempt succeeded. This is how account compromise gets noticed.

1.2 Your job-search profile

Collected during onboarding and editable at any time from your profile:

• Display name, phone number, LinkedIn and portfolio URLs
• Location (country, state, city)
• Current job title, employer, years of experience and notice period
• Target roles and skills

You supply this so applications can be addressed and filled in on your behalf. Nothing here is required to have an account, though some of it is required to send an application.

1.3 Files you upload

• Resumes (PDF, DOC, DOCX). Stored with our file-hosting provider, Cloudinary, and reachable only through an unguessable identifier. If you generate a share link for a recruiter, anyone holding that link can open that resume — that is what the link is for.
• Company lists imported from CSV, including the recruiter names, email addresses and phone numbers those files contain.
• Payment screenshots and the UPI reference you enter, if you buy a subscription.
• Support attachments, if you attach a file to a ticket.

1.4 Your applications

The subject and body of every application you send through JOB-EASY, the company it went to, its delivery status, and any replies that come back. This is the product: without it there is no pipeline to track.

1.5 Technical and administrative records

• Session cookie — see our Cookie Policy.
• Audit log of administrative actions taken on your account (approval, suspension, plan changes), including the acting administrator and their IP address.
• Email delivery log: which platform emails we sent you, and whether they were delivered, bounced or were rejected.
• Legal acceptance records: which version of which policy you accepted, when, and from which IP address and browser. We keep these because consent we cannot evidence is not consent.

2. Your Gmail account

This is the most sensitive permission JOB-EASY asks for, so it is worth reading carefully.

JOB-EASY sends job applications from your own Gmail account, not from ours. Recruiters see your address, replies come back to your inbox, and the messages appear in your own Sent folder. To do that, you grant us access through Google's OAuth screen. We request exactly these permissions:

• gmail.send — to send the applications you compose and approve
• gmail.readonly — to detect replies to applications you sent and match them to the right conversation
• userinfo.email and openid — to confirm which Google account was connected

Two commitments about this:

• We never send anything you did not initiate. There is no background sending, and no message goes out that you did not compose and approve.
• Your Google data is used only to provide these features. It is not sold, not used for advertising, not used to train any machine-learning model, and not read by our staff except where you explicitly ask us to investigate a problem with your own account. This follows Google's API Services User Data Policy, including its Limited Use requirements.

Your Google access and refresh tokens are encrypted at rest with AES-256-GCM. You can disconnect Gmail at any time from your profile, or revoke access directly at myaccount.google.com/permissions. Disconnecting stops all sending and reply-syncing immediately; applications you already sent stay in your history because they are a record of something that happened.

Signing in with Google is a separate, narrower permission (openid, email, profile) that only identifies you. Disconnecting Gmail never locks you out of your account.

3. AI company discovery

The discovery tool assembles a prompt from your profile — target roles, location, experience, skills and current employer — for you to run in an external AI service of your choosing. JOB-EASY generates the text; you decide whether to paste it anywhere. We do not transmit your profile to any AI provider on your behalf.

If you do use an external AI service, that service's own privacy policy governs whatever you paste into it. Results are unverified and frequently wrong about who is hiring — see our Disclaimer.

4. The shared company pool

When you import a company list you may opt in, per upload, to contribute those companies to a pool other users can browse. This is off unless you choose it, per upload, every time.

Contributing shares the company record — name, website, role, location and recruiter contact details from your CSV. It never shares your resume, your applications, your messages or your identity beyond an internal contributor reference. You can stop contributing at any time; entries already in the pool may be retained where other users have relied on them, and you can ask us to remove them by writing to .

Please read the Acceptable Use Policy before contributing: uploading contact details you have no lawful basis to share makes you responsible for that decision, not us.

5. Why we are allowed to process this

What	Why	Legal basis (GDPR)
Account, profile, applications	To provide the service you asked for	Performance of a contract
Gmail access	To send from your own address and track replies	Consent (revocable at any time)
Shared pool contributions	Only when you opt in, per upload	Consent
Login history, audit log	Security, fraud prevention, abuse investigation	Legitimate interests
Payment records	To verify payment and meet tax obligations	Contract and legal obligation
Service and security emails	To tell you things you need to know about your account	Contract and legitimate interests
Optional emails and digests	Only if you have not opted out	Consent

Under India's DPDP Act, consent is our primary basis, given through this notice and the acceptance you record when you sign up. You may withdraw it as easily as you gave it — see section 8.

6. Who else can see your data

We do not sell your personal data. We have never sold it, and we do not share it for cross-context behavioural advertising.

We use these service providers, each bound by contract to process data only on our instructions:

Provider	What they handle
Google (Gmail API)	Sending your applications and syncing replies, under your own grant
Cloudinary	Resume files, payment screenshots and support attachments
Resend	Platform email we send you — approvals, receipts, password resets
Vercel	Application hosting and anonymous, cookie-free traffic analytics
Our database host	Everything else described in this policy

We also disclose data where we are legally compelled to — a valid court order or a lawful request from an authority — and where it is necessary to investigate abuse, fraud or a threat to someone's safety. If JOB-EASY is ever acquired or merged, your data may transfer as part of that transaction, and you will be told before it becomes subject to a different policy.

Some of these providers operate outside India. Where personal data leaves the country, we rely on the provider's contractual commitments — including the European Commission's Standard Contractual Clauses where they apply — to keep the same protections attached to it.

7. How long we keep things

Data	Kept
Account, profile, applications, company lists	Until you delete your account
Resumes and attachments	Until you delete them, or your account
Google tokens	Until you disconnect Gmail or revoke access
Login history and audit log	Up to 24 months, for security investigation
Email delivery records	Up to 12 months, for deliverability and dispute handling
Payment records and screenshots	As long as tax and accounting law requires
Legal acceptance records	For as long as your account exists, then deleted with it

Deleting your account removes your profile, resumes, company lists, applications, messages and consent records. A rejected registration is deleted outright. Records we are legally required to keep — chiefly payment and tax records — are retained for their statutory period and nothing else.

8. Your rights

Whoever and wherever you are, you can:

• See what we hold about you
• Correct anything wrong — most of it directly in your profile
• Delete your account and the data attached to it
• Export your data in a portable format
• Withdraw consent for Gmail access or shared-pool contribution, without losing your account
• Opt out of optional email using the unsubscribe link in any such message, or from your notification preferences

Write to and we will respond within 30 days. We never charge for this and never make the service worse because you asked.

8.1 If you are in India

The DPDP Act gives you the right to access, correct, complete, update and erase your personal data, the right to nominate someone to exercise your rights if you cannot, and the right to a grievance redressal mechanism. Write to our Grievance Officer at . If we do not resolve your complaint, you may escalate to the Data Protection Board of India.

8.2 If you are in the EU, EEA, UK or Switzerland

You additionally have the right to restrict or object to processing, the right not to be subject to solely automated decisions with legal effects (we make none), and the right to lodge a complaint with your national supervisory authority. Exercising any of these never requires you to give a reason.

8.3 If you are in California

You may request the categories and specific pieces of personal information we have collected, its sources, our purposes, and the categories of third parties it was disclosed to; request deletion; and request correction. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of — but the right exists, and we will honour a request. We will not discriminate against you for exercising it. An authorised agent may act for you with proof of authorisation.

9. Security

• Passwords are hashed with bcrypt and never stored or transmitted in plain text.
• Google OAuth tokens are encrypted at rest with AES-256-GCM, using keys separated by purpose so a weakness in one cannot be turned against another.
• All traffic is encrypted in transit with TLS.
• Sessions expire automatically, and every sign-in attempt is logged.
• Administrative access is restricted and every administrative action is recorded.

No system is perfectly secure, and anyone claiming otherwise is selling something. If we discover a breach affecting your personal data we will notify you and the relevant authorities within the timeframes the law requires. If you believe you have found a vulnerability, please report it to rather than disclosing it publicly.

10. Children

JOB-EASY is not intended for anyone under 18, and we do not knowingly collect data from children. Under the DPDP Act, processing a child's data requires verifiable parental consent, which this service is not designed to obtain. If you believe a child has created an account, tell us at and we will delete it.

11. Changes to this policy

We keep every version of this document. When we change it materially you will be asked to read and accept the new version before continuing to use JOB-EASY, and the record of which version you accepted is kept. Minor corrections are published without interrupting you.

12. Contact

JOB-EASY

Privacy and data-protection queries, and grievances under the DPDP Act:
General support:
Web: