Privacy Policy

1. Information We Collect

Personal and Profile Information

When you create an account or use Enlistar, we may collect:

• Name, email address, phone number, and contact information
• Professional profile details including work experience, education, skills, certifications, and preferences
• Uploaded and generated documents such as resumes, cover letters, portfolios, and application drafts
• Job preferences, industry interests, and metadata used to personalize recommendations
• Subscription plan, coin balance, transaction history, and purchase details

Gmail Connection (Quick Mail)

If you choose to connect your Gmail account to use our Quick Mail feature, we request only the narrow permissions required to send a job application email you review and approve. We request:

• https://www.googleapis.com/auth/gmail.send — to send the approved email and CV attachment from your Gmail account.
• https://www.googleapis.com/auth/userinfo.email — to identify the Gmail address you connected, so the app can display "Connected as user@gmail.com".

Specifically:

• What we access: Send-only Gmail permission, used only when you click Send in Quick Mail. We also read your Google account email address so we can show which Gmail account is connected.
• What we do NOT access: We do not read your inbox, drafts, sent mail, email metadata, contacts, labels, or any other Gmail data. We do not delete, modify, search, or list emails. We do not request gmail.readonly, gmail.modify, or gmail.compose.
• What we store: An encrypted OAuth refresh token so Enlistar can send on your behalf after you connect, and the connected Gmail address for display in the app.
• What we send: Only the email content and tailored CV you generate, review, and approve in Quick Mail, to the employer email address you provide.
• AI and Gmail: Enlistar's AI generates the Quick Mail draft and CV from your Enlistar profile and uploaded resume, not from your Gmail inbox or other Google Workspace data. We do not send Gmail or Workspace user data to AI/ML models to train or improve those models.
• Your control: You can disconnect Gmail in Enlistar or by revoking access in your Google Account permissions. You may also contact us at support@enlistar.com to request deletion of your stored Gmail connection data.

Usage and Technical Information

We also collect technical and usage information to operate and improve the platform:

• Device identifiers, IP address, browser, operating system, and connection information
• Pages visited, features used, session duration, and interaction history
• Extension usage and form detection data for supported ATS platforms
• Performance, error, diagnostic, and application tracking data

This usage information does not include Gmail message content or other Google Workspace API user data.

AI features (Enlistar data only)

Enlistar uses AI to generate job-specific CVs, cover letters, application answers, and interview guidance from information you provide in Enlistar (your profile, uploaded CV, and the job details you enter). That is separate from Gmail.

We may use anonymized Enlistar product analytics (for example, feature usage and application success metrics) to operate and improve Enlistar. We do not use Gmail content, Gmail tokens, connected Gmail addresses, or any other data received from Google Workspace APIs to create, train, or improve AI or machine learning models.

2. How We Use Your Information

We use your information to provide Enlistar's functionality:

• Provide Services: Enable AI-powered resume, cover letter, application, and interview support using data you submit to Enlistar.
• Quick Mail (Gmail Send): When you connect Gmail, we use Google APIs solely to (1) identify the connected Gmail address and (2) send job application emails and CV attachments that you create and approve in Quick Mail to employer addresses you specify.
• Personalization: Deliver tailored job recommendations, profile guidance, and application insights from your Enlistar profile. This does not use Gmail inbox or Workspace API data.
• Authentication and Security: Manage accounts, login access, and protect against abuse.
• Payments and Coins: Process coin package purchases and usage tracking.
• Product analytics: Understand how Enlistar features are used so we can operate and improve the service. Google Workspace / Gmail user data is excluded from this analytics use.
• Communication: Send service updates, notifications, support responses, and legal notices.
• Compliance: Meet legal obligations and enforce our Terms of Service.

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your data only in these limited cases:

With Your Consent

When you explicitly authorize sharing with employers, job boards, or other third parties as part of the application process, including when you send a Quick Mail message to an employer you specify.

Service Providers

We work with trusted third parties to deliver the platform:

• Cloud hosting and secure data storage
• Payment processors and billing services
• Email delivery and notification services for Enlistar account messages (separate from user Gmail Quick Mail)
• Google Gmail API: When you connect Gmail for Quick Mail, sending is performed through Google's Gmail API on your behalf. Google's handling of data is governed by Google's Privacy Policy.
• Analytics, monitoring, and performance tools for Enlistar product usage. These tools do not receive Gmail message content or other Google Workspace API user data.

Legal Requirements

We may disclose information when required by law, court order, or to protect our rights, safety, or property.

Anonymized Enlistar Data

We may use anonymized, aggregated Enlistar product data (not Google Workspace or Gmail API data) to operate and improve Enlistar. We do not share raw or derived Google user data for research, advertising, or AI model training.

4. Data Security

We take security seriously and use multiple safeguards to protect your information:

• Encryption in transit and at rest for sensitive data, including Gmail OAuth refresh tokens
• Secure account access controls and authentication
• Regular security assessments and penetration testing
• Incident response processes for identifying and addressing breaches
• Employee training, policy enforcement, and data access restrictions

5. Your Rights and Choices

You have rights over your personal information, including:

• Access: Request a copy of your data.
• Correction: Update inaccurate or incomplete information.
• Deletion: Request removal of personal data, subject to legal retention requirements.
• Portability: Export your data in a machine-readable format.
• Opt-out: Unsubscribe from marketing communications.
• Restrictions: Limit how we process your information.
• Gmail Disconnect: Disconnect Gmail in Enlistar, or revoke Enlistar's Gmail access at any time via your Google Account settings at myaccount.google.com/permissions.

6. Data Retention

We retain your information only as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained until you delete your account or request deletion.
• Gmail Connection Data: Encrypted OAuth tokens and connected Gmail address are retained until you disconnect Gmail, revoke access in Google Account settings, or delete your Enlistar account. After disconnect, we delete the stored token and connected address.
• Usage Data: Enlistar product usage data may be retained for up to 2 years to operate the service. This does not include Gmail message content.
• Payment Data: Retained as required by financial regulations, typically up to 7 years.
• Support Data: Retained for up to 3 years for customer service and troubleshooting purposes.

7. International Data Transfers

Your information may be transferred to and processed in countries outside your own. When this happens, we protect your data using:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions by relevant authorities
• Appropriate technical and organizational safeguards

8. Children's Privacy

Enlistar is not intended for children under 16 years of age. We do not knowingly collect or maintain personal information from children under 16.

9. Changes to This Policy

We may update this Privacy Policy as our products and legal obligations evolve. We will notify you of significant changes by:

• Email notification to registered users
• Prominent notice on our website
• In-app notifications