Privacy Policy

Softaar Technologies UG (haftungsbeschränkt) ("zeroApply", "we", "our", "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services. Please read it carefully. By using zeroApply.ai you agree to the practices described here.

Our Terms of Service govern your use of the platform and are available at zeroapply.ai/terms.

1. What We Collect (and Where It Comes From)

We collect the following categories of data:

• Account details: name, email, password, billing info — provided by you.
• Content you give us: CV data, job descriptions, uploaded documents, photos — provided by you.
• Usage & device data: IP address, browser type, clicks, pages viewed — from your browser/device.
• Payment & purchase logs: last four of card, transaction totals — from our payment processor (Stripe).
• Email marketing data: email open rates, campaign interactions — from Brevo.
• Auto-apply data: job search queries, company emails found, application status — from Hunter.io and job scraping services.
• Gmail OAuth token (optional): if you choose to connect your Gmail account, we store an OAuth refresh token to compose and send job application emails from your Gmail address. We do not read, store, index, or analyse any of your existing Gmail messages.
• Security data: abuse flags, error reports — from automated systems.

2. Why We Use It

• Run the service & answer your questions — contract with you.
• Generate AI-tailored CVs, motivation letters, and job emails on your behalf — core service.
• Auto-apply to jobs on your behalf when you enable that feature — with your explicit consent.
• Improve features & protect against abuse — our legitimate interest in running a safe, reliable platform.
• Send product updates & offers — your consent (you can unsubscribe any time).
• Comply with laws, fight fraud, handle disputes — legal obligations & legitimate interest.

3. Who We Share It With

We share data with the following third-party providers:

• AI Services (OpenAI): generate CV content, cover letters, job emails, and interview feedback; processes prompts and uploaded documents.
• Email Marketing (Brevo): send transactional and promotional emails; processes name, email, delivery metadata.
• Payments (Stripe): process subscriptions and credit purchases; processes billing details and transaction data.
• Email Finding (Hunter.io): find company contact emails for auto-apply; processes company domain names from job listings.
• Job Scraping (JobSpy VPS / OrgUpdate): search for matching jobs; processes job title and location queries.
• Database & Auth (Firebase / Google Cloud): store user data, documents, and session cookies; processes all application data.
• File Storage (Firebase Storage): store CV photos and uploaded files.
• Gmail API (Google): when you connect your Gmail account, we use the Gmail API solely to compose drafts and send job application emails from your address. Your Gmail data is never shared with any third party, sold, or used for advertising.

We do not sell your personal data.

4. Gmail Integration & Google API Data

zeroApply.ai offers an optional Gmail integration that lets your auto-apply emails arrive in recipients' inboxes from your own Gmail address rather than a third-party sender. This section explains exactly how we use the Google API.

What we access

We request only the gmail.compose OAuth scope. This scope allows us to create email drafts and send new messages on your behalf. It does not grant us access to read, search, delete, or modify any of your existing emails or Gmail data.

What we do with it

• Create a draft or send a job application email from your Gmail account when you trigger the auto-apply feature.
• Store your Gmail OAuth refresh token securely in our database (Firebase Firestore, encrypted at rest) so you do not have to re-authorise on every use.
• Display your connected Gmail address in your dashboard so you know which account is linked.

What we do not do

• We do not read, index, store, or process any of your existing Gmail messages, contacts, or labels.
• We do not share your Gmail OAuth token or any Gmail data with third parties.
• We do not use Gmail data to train AI models or for advertising.
• We do not access your Gmail when the auto-apply feature is disabled or when you have disconnected your account.

Google API Services User Data Policy

zeroApply.ai's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

You can disconnect your Gmail account at any time from Dashboard → Application Suite → Disconnect Gmail. We will immediately delete your stored refresh token. You can also revoke access independently at myaccount.google.com/permissions.

5. How Long We Keep It

We keep information only as long as needed for the purposes described above. Account data is deleted or anonymised within 30 days of account closure, unless required for legal or regulatory compliance. Auto-apply logs are retained for up to 12 months to support dispute resolution.

6. Your Choices & Rights

Depending on where you live (e.g., EU/UK under GDPR), you can:

• Access or download the data we hold about you
• Correct inaccurate details
• Delete your account and data
• Object to marketing or certain uses
• Transfer your data to another service
• Withdraw consent for auto-apply at any time (toggle in your dashboard)
• Disconnect your Gmail account at any time (Dashboard → Application Suite → Disconnect Gmail), which immediately deletes your stored OAuth token
• Complain to a data-protection authority

Email support@zeroapply.ai to exercise any of these rights. We'll respond within 30 days.

7. Security

We use encryption in transit (TLS) and at rest, industry-standard Firebase security rules, and HTTP-only session cookies. Stripe handles all payment data — we never store raw card numbers. No system is perfect, so please use a strong password and don't share sensitive info in prompts.

8. International Transfers

We are Germany-based but rely on trusted providers worldwide (Google Cloud, OpenAI, Stripe, Brevo). Where EU/UK data leaves the region, we rely on Standard Contractual Clauses or providers' approved adequacy decisions.

9. Third-Party Services Details

OpenAI

Our Services use OpenAI's API to generate CV content, motivation letters, job emails, and interview questions. By using our Services, you acknowledge that your inputs and outputs are processed per OpenAI's API data usage policies. OpenAI does not use API data to train models by default. You retain all rights to your content.

Firebase / Google Cloud

User accounts, documents, subscriptions, and session data are stored in Firebase Firestore and Firebase Storage (Google Cloud infrastructure, EU regions where available). Authentication uses Firebase Auth with HTTP-only session cookies. Google's data processing terms apply.

Stripe

All payments are processed by Stripe Inc. We store only the Stripe customer ID and subscription status — never raw card numbers. Stripe is PCI-DSS Level 1 certified.

Brevo (formerly Sendinblue)

We use Brevo for transactional emails (OTP, application confirmations) and marketing emails. By providing your email address you consent to Brevo processing it. You can unsubscribe from marketing emails at any time via the unsubscribe link.

Hunter.io

When you use auto-apply, we query Hunter.io to find publicly available company contact emails using the company domain from the job listing. We share only the domain name — not your personal data — with Hunter.io.

Job Scraping (JobSpy / OrgUpdate)

Job searches are performed via our Hostinger VPS running JobSpy (LinkedIn, Indeed, Glassdoor) and the OrgUpdate Google Jobs API. We share only your job title and location preferences.

Gmail API (Google)

When you optionally connect your Gmail account, we use the Gmail API with thegmail.compose scope to compose drafts and send job application emails on your behalf. We access only the ability to create and send new messages — we never read, store, or process your existing email content. Your OAuth refresh token is stored securely in Firebase Firestore and used solely to authenticate email sends. You may revoke this access at any time from your dashboard or via Google Account permissions. Our use of Gmail API data complies with the Google API Services User Data Policy, including the Limited Use requirements.

10. Changes to This Policy

We may update this Privacy Policy by posting the new version on our website or notifying you by email. Changes take effect upon posting or as indicated in the notification. Continued use of the Services after changes are posted constitutes your acceptance of the revised Policy.

11. Contact Information

Softaar Technologies UG (haftungsbeschränkt)

Blasewitzer Straße 41, ABAKUS Business Center
01307 Dresden, Germany

Managing Director: Al Mamun

Registration: Amtsgericht Dresden, HRB 47645

VAT ID: DE460666450