Privacy Policy

1. Who we are

CV.click is a service that helps you prepare, review, and send job application emails from your own Gmail account after your explicit approval of each send.

For privacy-related inquiries or data requests, you can contact us at: help@cv.click.

2. Data we may access

We may collect the following data depending on your use of the service:

• Basic Google account data: name, email, and profile picture.
• Optional profile data: display name, phone number, and city.
• The CV and information you upload or enter within the service.
• Application data: the job, employer, application status, send time, and number of credits used.
• The content of application email drafts or the message data required to send, to the extent needed to operate the service.
• Technical and security data such as login logs, system errors, IP address, and browser type, when needed for operation and protection.

3. Gmail data and Google permissions

When you connect a Gmail account, we request permission to send email from your account to the extent needed to operate the application-sending feature.

We use the Gmail permission only to send the application emails you review and approve within the service. We do not send any email on your behalf without your explicit approval of the draft.

We do not use the Gmail permission to read your inbox, we do not sell Gmail data, we do not use it for advertising, and we do not transfer it to parties not necessary to operate the service.

We may store your Google account refresh token encrypted so you can use the sending feature without reconnecting each time. You can disconnect Gmail from your account at any time; upon disconnection we stop using the permission and delete or disable the associated access token in accordance with our technical procedures.

3.1 Google APIs and the Limited Use Policy

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

CV.click connects to your Google account solely for the purpose of helping you send job applications directly through your Gmail account. When you choose to link your Gmail account, we request access to the following scope:

• https://www.googleapis.com/auth/gmail.send — allows CV.click to send emails on your behalf.

3.2 How Gmail data is used and the data processed

This permission is strictly limited to sending application-related emails that you explicitly authorize through our platform, such as your AI-generated or manually written cover letter and attached resume when applying for a job. CV.click never accesses, reads, downloads, or stores the content of your Gmail inbox, sent messages, or any other Gmail data beyond what is necessary to send your specific email.

We use the Gmail API exclusively to deliver your job applications directly to employers. The data handled through this process includes:

• The employer's email address associated with the job posting.
• Your attached resume file.
• Your OAuth credentials, including an access token (stored securely in encrypted form).

3.3 Compliance with Limited Use requirements

CV.click does not use Gmail data for advertising, analytics, profiling, or any purpose other than sending the emails you explicitly request. We also do not share Gmail data with any third parties. All access tokens and credentials are encrypted and securely stored, used only to execute the sending function, and can be revoked at any time through your Google Account Permissions settings.

CV.click's integration with Google APIs complies with all Limited Use policy requirements:

• Data obtained through Google APIs is used solely to provide the functionality you request — sending job application emails.
• Data is never transferred to humans or any external systems except as required to deliver your email to the intended employer.
• Data is never used for advertising, marketing, analytics, or user profiling.
• You can disconnect your Google account from CV.click at any time, which immediately revokes our access.

3.4 Acknowledgement and consent

By authorizing Gmail access through CV.click, you acknowledge and agree that the Gmail connection is used only to send your own job applications efficiently and securely, ensuring that your data remains private, protected, and under your control at all times.

3.5 AI processing and the Limited Use Policy

CV.click uses one third-party AI provider — OpenAI — accessed through the OpenAI API platform (a paid, pay-as-you-go developer account operated by CV.click, not a consumer ChatGPT plan) using the gpt-4o-mini model. It is used only to help draft the wording of your job-application email.

Only the following job-posting fields are sent to the AI provider: job title, company, description, location, and employment type, together with the chosen writing language. These job details come from public job sources (RSS feeds and administrative import), not from any Google API.

No data received from Google APIs is ever sent to the AI provider. This includes both Gmail content (which CV.click cannot read — we hold only the gmail.send permission) and your Google sign-in identity (name, email, profile picture). Your CV, name, email, phone, user ID, and access tokens are never sent to the AI provider. Your name is appended to the email signature locally on our servers after the draft has been generated.

Under OpenAI's API terms, data submitted through the API is not used to train or improve OpenAI's models by default. CV.click does not enable any provider data-sharing option that would allow such training.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. CV.click does not use, transfer, or sell Google user data to create, train, or improve any foundational or generalized machine learning or artificial intelligence model.

4. Why we use your data

We use your data for the following purposes:

• Create your account and enable sign-in.
• Display jobs and manage applications.
• Generate application email drafts from the job posting details only (title, company, description, location, employment type). Your CV, name, email, and contact details are never sent to the AI provider; your signature is added locally on our servers after the draft is generated.
• Send application emails from your Gmail account after your approval.
• Track credits and usage history.
• Improve the service and fix errors.
• Protect the service from abuse or unsolicited sending.
• Comply with legal requirements or requests from competent authorities where applicable.

5. Legal basis for processing

We process your data based on one or more of the following bases, depending on the case:

• Your consent, such as connecting Gmail or uploading a CV.
• Performing the service you requested, such as creating the draft and sending the application.
• Legitimate interest in protecting the service and preventing fraud and abuse.
• Compliance with laws and legal requests where applicable.

6. Mandatory and optional data

Some data is necessary to operate the service, such as email and login data. If you do not connect Gmail, you will not be able to use the send-from-Gmail feature. If you do not add a CV or sufficient data, application drafts may be less personalized.

Data such as phone number and city is optional; you may choose not to add it, or edit or delete it from your profile whenever the feature is available.

7. Data sharing

We do not sell your personal data.

We may share or process your data through service providers who help us operate the service, such as hosting providers, databases, Google services, email-sending providers via the Gmail API, a third-party AI provider (OpenAI, in the United States) used only to draft application email wording from job-posting details as described in section 3.5, payment providers when purchasing credits, and error-monitoring and security tools.

We share your data only to the extent needed to operate the service, or with your consent, or for security reasons, or to comply with laws.

8. Transfer or processing outside the Kingdom

Some data may be stored or processed outside the Kingdom of Saudi Arabia depending on the location of external service providers such as Google, our AI provider (OpenAI, in the United States), hosting providers, or databases. When this happens, we ensure the transfer or processing is limited to what is necessary to provide the service and is subject to appropriate safeguards to protect the data.

9. Data protection

We use reasonable technical and organizational measures to protect your data, such as encryption in transit, encryption of sensitive access tokens at rest, restricting administrative access, and monitoring for abuse.

However, no method of electronic transmission or storage is 100% secure, so absolute protection cannot be guaranteed.

10. Staff access to data

Staff or admins are not permitted to access your data except when needed to operate the service, provide technical support, investigate abuse, or comply with the law. Gmail data or message content may not be used for any purpose independent of the application feature you requested.

11. Data retention and deletion

We retain account data, application history, and credits for as long as needed to operate the service, protect the service, or comply with legal or accounting requirements.

You may request deletion of your CV, disconnect Gmail, or request deletion of your account and personal data by contacting support. We will process deletion requests within a reasonable time, unless retaining some data is required by law, necessary to prevent fraud, resolve a dispute, or keep limited operational records.

When data is deleted, temporary backups may remain for a limited period before being deleted in accordance with the backup cycle.

12. Children

The service is not directed to children or to those below the legal age to use employment and email services. If we learn that we have collected a child's data without an appropriate legal basis, we will take steps to delete or restrict it.

13. Updates to this policy

We may update the Privacy Policy from time to time. We will post the updated version within the service or on the website. If we materially change how we use Google or Gmail data, we will request your consent where necessary before using the data for the new purpose.

14. Contact

For any privacy questions or requests, please contact us at: help@cv.click.