Privacy Policy

When you use GradToGold, we collect: • Account information: Email address, name, and profile picture from your OAuth provider (Google or GitHub) • Email connection data: OAuth tokens to access your email (Outlook) for syncing job-related emails only • Application data: Job applications you track, including company names, roles, statuses, and notes • Usage analytics: Anonymous usage patterns to improve the service (no personal data) We do not read or store the content of emails unrelated to job applications.

We believe in privacy by design. Here's what we will never do: • Sell your data to third parties • Share your information with advertisers • Use tracking pixels from Facebook, Google, or other ad networks • Train AI models on your personal data • Access emails unrelated to job applications • Store your email password (we use OAuth tokens only)

Your data is used solely to provide and improve the user-facing features of GradToGold: • Operate the service: Authenticate you, store your applications, sync your emails • Power the tracker: Detect job-related emails and extract application information • Provide support: Respond to your questions and help resolve issues • Improve detection: Enhance our email parsing to better identify applications (using anonymised patterns only) We limit our use of data — including data obtained through email scopes — to providing or improving features that are prominent and visible within GradToGold's interface. We do not use your data for marketing, profiling, advertising, or any purpose beyond operating the service.

GradToGold's use of information received from email APIs adheres to strict limited use requirements: 1. Purpose limitation: We only use your email data to provide and improve the application tracking features you see and interact with in GradToGold. Your data is never used for purposes unrelated to the core product experience. 2. No unauthorised transfers: We do not transfer your email data to third parties, except: • To provide or improve user-facing features within GradToGold, and only with your consent • For security purposes, such as investigating abuse or protecting against fraud • To comply with applicable laws or valid legal processes • As part of a merger, acquisition, or sale of assets — only after obtaining your explicit prior consent 3. No human access: We do not allow humans to read your email data unless (a) you have given us explicit consent, (b) it is necessary for security purposes, (c) it is required to comply with applicable law, or (d) the data has been aggregated and anonymised for internal operations. 4. No advertising: Your email data is never used for serving advertisements, including retargeting, personalised, or interest-based advertising. This applies to the raw data obtained from email scopes as well as any data aggregated, anonymised, or derived from it.

We share your data only when: • Required for core functionality: Email providers (via OAuth) to sync your inbox for the application tracking features you use within GradToGold, and only with your consent • For security purposes: To investigate abuse, protect against fraud, or address security vulnerabilities • Required by law: Court orders, legal processes, or to protect our legal rights • Business transfer: If GradToGold is acquired, we will obtain your explicit prior consent before any transfer of your personal data We do not share, sell, or rent your personal information to any third parties for their marketing or advertising purposes.

We take security seriously: • Encryption in transit: All data transmitted using TLS/HTTPS • Secure authentication: OAuth 2.0 with industry-standard providers • Access controls: Only authorised personnel can access systems • Regular reviews: Security practices reviewed and updated regularly • Data hosting: Supabase (EU data centres) with SOC 2 compliance While no system is 100% secure, we implement industry-standard measures to protect your data.

You have full control over your data: • Access: View all data we hold about you in your account settings • Download: Export your applications and data at any time • Delete: Remove individual applications or delete your entire account • Disconnect: Revoke email access at any time from settings • Portability: Download your data in a standard format To exercise these rights, visit your account settings or contact us at help@gradtogold.com.

If you're in the UK or EU, you have additional rights under GDPR/UK GDPR: • Right to access your personal data • Right to rectification of inaccurate data • Right to erasure ("right to be forgotten") • Right to data portability • Right to restrict processing • Right to object to processing • Right to lodge a complaint with the ICO (UK) or your local data protection authority Our legal basis for processing is: (a) your consent when connecting email, (b) contract performance when providing the service, and (c) legitimate interests for service improvement.

GradToGold is designed for university students and graduates (typically 18+). We do not knowingly collect personal information from anyone under the age of 16. If you believe we have collected data from a child under 16, please contact us immediately and we will delete it.

We retain your data only as long as necessary: • Account data: Until you delete your account • Application data: Until you delete it or your account • Email sync tokens: Until you disconnect or delete your account • Analytics data: Anonymised and aggregated, retained indefinitely When you delete your account, all personal data is permanently removed within 30 days.

We may update this privacy policy from time to time. When we make significant changes: • We'll update the "Last updated" date at the bottom • We'll notify you via email or in-app notification for material changes • Continued use of GradToGold after changes constitutes acceptance We encourage you to review this policy periodically.