← Careerz

Privacy policy

Last updated 26 October 2026. This explains what Careerz collects, why, who handles it, and the choices you have. It applies to the website, the app and the autofill browser extension.

Who we are

Careerz is run by Ayush Tandon, India (the “operator”, “we”). For the purposes of India’s Digital Personal Data Protection Act, 2023, we decide why and how your data is processed. You must be 18 or older to use the service.

What we collect, and why

• Your resume and profile (text, name, city, LinkedIn link, application details you enter such as phone, notice period and expected pay). Used to match you to roles, write CVs, cover letters and emails, practise interviews, and fill forms. Stored in your browser. If you choose “Sync across devices” and sign in with Google, a copy of your resume, profile and applications is also stored in our database so you can use them on other devices.
• Your applications and drafts. Stored in your browser so you can track them.
• Google account details, only if you connect Google: your name, email address and permission to send email on your behalf. Used only to sign you in and to send emails you approve.
• Technical data such as IP address, browser type and request counts. Used to keep the service secure, apply rate limits and fix errors. Kept in server logs for a limited time.
• Usage counts (for example how many searches or drafts were made), without the content, to understand load and costs.

We use this information only to run the features you ask for. We do not sell your data and we do not show advertising.

Your consent

We ask for your consent before you upload a resume. You can withdraw it at any time by deleting your data (see “Your rights”). Withdrawing consent means the features that need your data will stop working.

Who else handles your data

• AI provider (Groq, United States). When you search, tailor a CV, write a letter or email, or practise an interview, the relevant parts of your resume, profile and the job text are sent to our server and then to the AI provider to produce the result. We do not use your content to train models, and we do not keep it after the request completes. This is a transfer of your data outside India.
• Hosting (Vercel). Runs the website and servers.
• Database (Supabase). Stores the synced copy of your data, only if you turn on sync. Access is limited so that only you can read your own rows.
• Google. Sign-in and sending email through your Gmail account.
• Job data providers. Your search terms (role and city) are sent to job listing services to fetch results. Your resume is not sent to them.
• The people you email. When you approve an email, it is sent from your Gmail to the recipient you chose, with your CV and LinkedIn link if you attached them.

We share data with others only when the law requires it.

Google user data

This section covers data we receive from Google when you connect your Google account. Careerz’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access. Your name, email address and profile picture (to sign you in), and permission to send email from your account (the gmail.send scope). We do not access your inbox, sent folder, drafts, labels, contacts, calendar or any other Google data, and we cannot read your email. We hold no raw or aggregated Gmail content.
• How we use it. Only to sign you in and to send an email you wrote or approved, to a recipient you chose, when you press the confirm button. One email is sent per confirmation. We do not send anything on a schedule, in bulk, or without that confirmation. We do not use Google data for advertising, profiling, lending decisions or any purpose other than providing this feature.
• Who we share it with. Nobody. Google data is not sold, rented or transferred to third parties, data brokers or advertisers. The message you send is delivered by Google to the recipient you chose. Data from your Gmail account is never sent to any AI provider and is never used to train any AI or machine-learning model. (Our AI features use only the resume text, job description and notes you give us, as described above.)
• How we protect it. The access token is kept in an encrypted, HTTP-only session cookie. It is never exposed to scripts in your browser, never written to a database, and sent only to Google when you confirm a send. All traffic uses HTTPS. Sending is limited to 40 emails a day per account.
• How long we keep it, and deleting it. We store no Google data on our servers. The session cookie ends when you sign out or it expires. You can revoke access at any time at myaccount.google.com/permissions, which stops all further sending immediately, and you can email us to confirm that no Google data is held.

Humans at Careerz do not read your emails. We would only access your messages with your explicit consent or where the law requires it.

Cookies and local storage

See our cookie notice. We use only what is needed to keep you signed in and to remember your work in your browser.

How long we keep data

Your resume, profile and applications stay in your browser until you delete them. If you use sync, the stored copy is kept until you delete it with “Delete my data” or ask us to. Server-side we keep nothing from AI requests after they complete. Security logs are kept for up to 30 days.

Your rights

Under the Digital Personal Data Protection Act you can ask to access information about the data we process, correct or erase it, withdraw consent, nominate someone to exercise your rights if you die or become incapable, and complain about how your data is handled.

The quickest way to exercise most of these is the Your data section of the app (Autofill tab): you can download everything stored in your browser and delete it, including the synced copy. For anything else, or if you want server-side records removed, email the contact form on our Grievance page. We aim to reply within 7 days.

Security

We use HTTPS, keep access tokens off your browser, limit sending to 40 emails a day per account, and restrict who can reach our servers. No system is perfectly secure. If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.

Complaints

Raise a complaint with our Grievance Officer using the Grievance page. If you are not satisfied, you may approach the Data Protection Board of India.

Changes

If we change this policy in a way that affects you, we will update the date above and, where needed, ask for your consent again.