Privacy Policy

This Privacy Policy explains how the Job Portal application at jobs.tands.co.ke ("the Application", "we", "us") collects, uses, stores, and protects information. The Application is a private job-application management tool operated by Tands (Nairobi, Kenya). It is not a public job board; access requires an administrator account.

1. Information we access

The Application requests access to a single Gmail account through Google's OAuth 2.0 flow, with the following permissions:

• Gmail send (gmail.send): to send job application emails from the connected account.
• Gmail compose (gmail.compose): to create and update email drafts of job applications for review before sending.
• Gmail read-only (gmail.readonly): to read messages and drafts in the connected account for application tracking and verification.

The Application also stores: uploaded CV files (PDF, DOCX, DOC, TXT, HTML), job posting URLs and descriptions scraped from public job websites, generated cover letters, recipient email addresses extracted from job postings, and administrator account credentials (usernames and salted password hashes).

2. How we use information

• To generate personalized job applications (cover letters and CV submissions) using an AI model.
• To create drafts in and send emails from the connected Gmail account.
• To track whether sent application emails were opened, via a 1x1 tracking pixel embedded in outbound messages.
• To manage and operate the Application itself.

We do not use Gmail data for advertising, do not sell it to third parties, and do not allow human employees or contractors to read it except with the account owner's explicit consent or where required by law. The Application does not transfer Gmail data to AI training. AI-generated drafts are produced by an external AI service solely to compose the application content requested by the administrator.

3. Where data is stored

All data is stored in a private SQLite database and filesystem on a secured virtual private server controlled by the operator. OAuth tokens for the Gmail account are stored in the same private database and are never disclosed publicly. Access to the admin interface is protected by password authentication, session controls, and rate limiting.

4. Data sharing

We do not sell, rent, or share personal data with third parties, except:

• Emails are sent to the intended job-application recipients, as directed by the administrator.
• AI processing of CV text and job descriptions is sent to an external AI service to generate cover letters; this is limited to the content needed for that purpose.
• Where disclosure is required by applicable law.

5. Data retention and deletion

Data is retained only as long as needed for job-application management. You can request deletion of stored data or revoke the Application's Gmail access at any time:

• Revoke Google access from your Google Account at myaccount.google.com/permissions, or disconnect the account in the Application's Gmail settings, which deletes stored OAuth tokens.
• To request deletion of all other stored data, contact us using the details below.

6. Security

We protect data with transport encryption (HTTPS), hashed passwords, access controls, and server-level firewalling. No method of storage or transmission is completely secure, but we take reasonable measures commensurate with the sensitivity of the data.

7. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be available at this URL with an updated date.

8. Contact

For privacy questions or data-deletion requests, contact: sctarus@gmail.com