Privacy Policy

Account and sign-in data. When you sign in with Google, Google shares your name, email address and profile picture with us (the openid, profile and email scopes). Our sign-in system also keeps the OAuth tokens Google issues for that sign-in so your session works. Signing in gives us no access to your Gmail. If you sign in with an email link or a passkey instead, we store your email address and the passkey’s public key.

Content you give us. Your CV and other documents, your job preferences, and the applications you track on your Pipeline board (company, role, status, notes, dates, links).

Sharing and usage data. When someone opens a link you share, we record the view (pages seen, time spent, approximate location and device, and an email address if you required one) so you can see who opened your document. We also keep basic logs and product analytics to run and secure the service.

Gmail data, only if you connect it. Connecting Gmail is a separate, optional step. Section 3 explains exactly what we read and why.

• To create your account, keep you signed in and keep it secure.
• To provide the features you use: parse your CV, find and score roles, track applications, and show you who opens your documents.
• To send service emails (verification, security notices, messages you have asked for).
• To prevent abuse, fix problems and meet legal obligations.

We do not sell your data, we do not use it for advertising, and we do not use your content to train AI models.

Connecting Gmail is optional and always started by you, through its own Google consent screen. It is not part of signing in.

What we request. One read-only Gmail permission, https://www.googleapis.com/auth/gmail.readonly, plus openid and email so we can show which address is connected. This permission cannot send, delete, label or change any email. Soosly does not send email from your Gmail account.

What we do with it. We use Gmail data for one purpose: to show you updates on the applications you already track.

• Soosly looks at your recent unread inbox messages (not Promotions, Social or Forums; the last 14 days the first time, then only new mail) and keeps only those that match a company or role on your Pipeline. Every other message is ignored and nothing from it is stored.
• For each matching message we read the sender, subject and the newest part of the text (quoted history removed, capped at 6,000 characters) and ask an AI model whether it signals an interview, an offer or a rejection.
• The result is a suggestion that you approve or dismiss. Nothing on your board changes until you decide. We store the sender, subject, receive time, message ID and a short quote that justified the suggestion. We do not store the full email.

AI processing. To classify a message we send its sender, subject and text excerpt to the OpenAI API. This is the only place Gmail content leaves Soosly, and only for that classification. We use the API under its standard business terms, under which API inputs are not used to train OpenAI’s models.

• Encrypted in transit. All traffic between you, Soosly and Google uses HTTPS (TLS).
• Encrypted at rest. Gmail access and refresh tokens are additionally encrypted by Soosly with AES-256-GCM before they reach the database, each bound to your account so they cannot be reused for another user. The database and file storage encrypt data at rest.
• Isolated per user. Every query is scoped to the signed-in account, and our connection to Google uses signed, expiring state values so a mailbox cannot be attached to the wrong account.
• Not sold, leased or shared for marketing. We never sell, rent or lease personal data, never share it with third parties for their marketing, and never use it to train AI models.

No system is perfectly secure. If a breach affects your data we will notify you and the authorities as the law requires.

We share data only with service providers that run Soosly for us, under contract and only as needed:

• Hosting (Vercel), database (Neon) and file storage.
• Email delivery for service messages, and product analytics.
• AI providers for features you use, for example CV parsing and, if you connect Gmail, classifying a matching message with OpenAI.

We may also disclose data when the law requires it or to protect the rights and safety of users and Soosly.

• Disconnect Gmail. On your Pipeline board choose Disconnect Gmail. We revoke the grant at Google and delete the stored tokens immediately. You can also remove Soosly at any time at myaccount.google.com/permissions; Soosly can no longer read your mail from that moment.
• Delete your data. In Settings → General choose Delete Account to remove your account and everything in it, including any email-derived suggestions. Or email contact@soosly.com from your account address and we will delete it for you.
• Access and correction. You can view and edit your profile and Pipeline in the app, and ask us for a copy of your data.

Retention. We keep your data while your account is open. Gmail tokens are kept only while Gmail is connected. After you delete your account we remove your data from live systems within 30 days, and encrypted backups age out shortly after. We may keep limited records we are legally required to keep.

We use cookies that are needed to keep you signed in and secure, and basic analytics. Soosly is not for children under 16 and we do not knowingly collect their data. If we change this policy materially we will update the date above and tell signed-in users. Depending on where you live you may have additional rights (access, correction, deletion, objection, portability); contact us to use them.

Privacy contact: contact@soosly.com. We reply to privacy requests within 30 days.