Privacy Policy

YoCareerAI is operated by Videmak, Inc., a Delaware corporation (“we”, “us”). We are the controller of the personal information described in this policy. For employers' job postings that we index, the employer remains responsible for its own postings.

Privacy contact (including our Data Protection Officer function and, for India, our Grievance Officer): admin@videmak.org, 1111B S Governors Ave STE 26609, Dover, DE 19904, United States. We aim to answer within 30 days, or sooner where the law requires.

Information you give us:

• Account details: name, email address, password (stored only as a hash), phone number, sign-in method, multi-factor and passkey settings.
• Career profile: CVs and résumés (the files and their text), work history, education, skills, certificates and licences, references, portfolio links, target roles, locations, salary expectations and job preferences.
• Application answers: answers you save for application forms, such as notice period, availability, relocation, and, only if you choose to provide them, right-to-work and visa details for a country, and equal-opportunity answers (for example gender, ethnicity, disability or veteran status).
• Messages and support: what you send us through support, WhatsApp or email, and the approvals or answers you give the “Needs you” checklist.
• Payment details: handled by Stripe. We never see or store your full card number; we keep the plan, status, invoices and the Stripe customer reference.

Information created when you use YoCareerAI:

• Job matches, saved and passed jobs, applications, their status and confirmation numbers, and the documents and answers submitted for each.
• Automation records: what the application assistant did, screenshots and traces of the browser session used to fill a form, and any blocker it hit.
• Technical data: IP address, browser and device type, session records, security and audit logs, and error logs.

Information from services you connect (only after you connect them):

• Email: job-related messages in the mailbox you connect (Gmail, Outlook or Microsoft 365, or Zoho Mail), such as recruiter replies, interview and assessment invitations, verification codes and application confirmations, and emails sent on your behalf.
• Managed application mailbox: if you use an application address we provide, the emails that employers and job sites send to it.
• Calendar: the interview or assessment events we create for you.
• WhatsApp: your number and the messages you exchange with the YoCareerAI WhatsApp service.

Information from other sources: public job postings and company information from job boards, employer career sites and job-data providers, and, if someone referred you, the referral code.

Connecting Google, Microsoft or Zoho is optional and needs your explicit consent on the provider's own consent screen. We request only the access needed for the features you use:

• Google: sign-in (your name, email address and profile picture); Gmail read-only access (gmail.readonly) to find job-related replies, verification codes and confirmations; Gmail send access (gmail.send) to send application emails and follow-ups you approve or that your automation settings allow; and Google Calendar events access (calendar.events) to create interview and assessment events.
• Microsoft: Mail.Read, Mail.Send, Calendars.ReadWrite, User.Read and offline access, for the same purposes in Outlook or Microsoft 365.
• Zoho: Zoho Mail message and account access, for the same purposes in Zoho Mail.

We do not request permission to delete or archive your messages, change your mailbox settings or labels, share your calendars, or administer your account.

YoCareerAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the user-facing features described above; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you; we do not use it for advertising; we do not sell it; and no person reads it unless you ask us to (for example for support), it is needed for security or to comply with law, or it has been aggregated and anonymised for internal operations. We do not use Google user data or any mailbox content to train generalised AI or machine-learning models.

Only messages that look job-related are processed. Unrelated personal email is not stored. You can disconnect a mailbox at any time in Settings → Connections; for Google we also revoke our access with Google, for Zoho we revoke the token with Zoho, and for Microsoft we delete the stored tokens (you can also remove the app at account.live.com/consent/Manage or myapps.microsoft.com).

Where laws such as the GDPR or UK GDPR apply, we rely on the legal basis shown for each purpose.

• Provide the service you signed up for (contract): build your profile, match and rank jobs, draft CVs and cover letters, fill and submit applications, track replies, schedule interviews, and send notifications.
• Act on the connections and automation you turn on (contract and your consent): read job-related email, send email, create calendar events, and apply on your behalf within your settings.
• Sensitive information you choose to provide (your explicit consent): right-to-work and visa details and equal-opportunity answers are used only to answer the application questions that ask for them. You can delete them at any time.
• Payments, tax and accounting (contract and legal obligation).
• Security, fraud and abuse prevention, and service reliability (legitimate interests, and legal obligation where it applies).
• Improving the product (legitimate interests): for example measuring which job sources produce good matches and fixing failed applications. We use aggregated or de-identified data for this where we can.
• Service and account messages (contract). We send marketing email only with your consent or where the law allows, and every marketing email lets you opt out.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not show ads.

YoCareerAI uses AI models (Azure OpenAI Service from Microsoft) to read job descriptions, rank jobs against your profile, draft documents, classify emails and fill application forms. The model provider processes the data only to return results to us and does not use it to train its models.

Match scores and rankings are automated suggestions. They do not decide anything with a legal or similarly significant effect on you: employers make hiring decisions. The application assistant only applies within the settings you choose, never invents facts about your qualifications, legal status or beliefs, and asks you through the “Needs you” checklist when it does not know an answer. Copilot mode lets you review an application before it is submitted. See AI and automation for details.

• Employers, recruiters, job boards and applicant-tracking systems, when you apply or ask us to apply for you. They receive the application you send and handle it under their own privacy policies.
• Service providers (subprocessors) that host, secure and operate YoCareerAI under contracts that limit their use of the data. See the subprocessor list.
• Providers you connect, such as Google, Microsoft, Zoho and WhatsApp, to carry out the actions you ask for.
• Authorities and others where the law requires it, or where needed to protect the rights, safety or property of users, the public or us.
• A buyer or successor if we are involved in a merger, acquisition or sale of assets. We will tell you before your information becomes subject to a different privacy policy.

Job-data providers we search receive search terms such as job titles and locations, never your name or contact details.

Our servers and database are hosted with Microsoft Azure in the European Union (the Netherlands). AI processing takes place in Microsoft Azure data centres in the United States, encrypted backups are stored in the United States, and some providers, including Browser Use, Stripe, Cloudflare and Resend, process data in the United States and other countries.

When we transfer personal information out of the EEA, the UK, Switzerland or another country with transfer rules, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum), adequacy decisions or the EU-U.S. Data Privacy Framework where a provider is certified, together with additional measures such as encryption. You can ask us for a copy of the relevant safeguards.

• Account, profile, documents and applications: while your account is open. When you delete your account they are deleted, including uploaded files.
• Browser session traces and screenshots from applications: 30 days.
• Notifications: 90 days.
• Job-related email threads: 12 months after the last activity, or sooner if you disconnect the mailbox or delete your account.
• Mailbox and calendar access tokens: until you disconnect the provider, delete your account, or the provider revokes them.
• Billing and tax records: as long as tax and accounting law requires, usually up to 7 years.
• Consent, security and audit records: as long as needed to show compliance and protect the service, usually up to 2 years after account closure.
• Encrypted backups: deleted data can remain in backups until they are rotated out, for up to 90 days.

Data is encrypted in transit (TLS). Mailbox and calendar tokens and sensitive settings are encrypted at rest, and backups are encrypted before they leave our servers. Access is limited by role and logged. Uploaded documents are checked before use. You can protect your account with multi-factor authentication or a passkey.

No service can be perfectly secure. If a breach affects your personal information we will notify you and the relevant authorities as the law requires.

Wherever you live, you can: see and update your profile; download or delete documents; turn automation, email and WhatsApp notifications on or off; disconnect any connected service; and delete your account in Settings. You can also email us to ask for a copy of your data, a correction, deletion, or to object to or restrict a use of it, or to withdraw a consent (this does not affect processing that already happened). We will verify your identity before acting on a request and will not treat you differently for using your rights.

Additional rights depending on where you live:

• EEA, UK and Switzerland: access, rectification, erasure, restriction, portability and objection (including to processing based on legitimate interests), and the right to complain to your data protection authority, for example the Irish Data Protection Commission or the UK Information Commissioner's Office.
• United States (California and other states with privacy laws): the right to know what we collect and why, to access, correct and delete it, to obtain a portable copy, and to limit use of sensitive information. We use sensitive information only to provide the service you request. We do not sell or share personal information, so there is nothing to opt out of. You may use an authorised agent, and you may appeal a decision by replying to our response.
• Canada: access and correction, and withdrawal of consent, under PIPEDA and provincial laws (including Québec's Law 25). You can complain to the Office of the Privacy Commissioner of Canada.
• Australia and New Zealand: access and correction under the Australian Privacy Principles and the New Zealand Privacy Act 2020. You can complain to the OAIC or the New Zealand Privacy Commissioner.
• India: access, correction, completion and erasure, grievance redressal through our Grievance Officer (contact above), and the right to nominate someone to exercise your rights, under the Digital Personal Data Protection Act 2023. You can also approach the Data Protection Board of India.
• Nigeria, South Africa, Kenya, Uganda and Ghana: the rights given by the Nigeria Data Protection Act 2023, the Protection of Personal Information Act (POPIA), the Kenya Data Protection Act 2019, the Uganda Data Protection and Privacy Act 2019 and the Ghana Data Protection Act 2012, including access, correction, deletion and objection, and the right to complain to the Nigeria Data Protection Commission, the Information Regulator (South Africa), the Office of the Data Protection Commissioner (Kenya), the Personal Data Protection Office (Uganda) or the Data Protection Commission (Ghana).
• Singapore, the Philippines and Malaysia: access, correction and withdrawal of consent under the PDPA (Singapore), the Data Privacy Act 2012 (Philippines) and the PDPA 2010 (Malaysia), and the right to complain to the PDPC, the National Privacy Commission or the Personal Data Protection Commissioner.
• Elsewhere: we honour the rights your local law gives you. Contact us and we will help.

We use the cookies needed to run YoCareerAI (sign-in, security and your settings) and a referral cookie. If you accept analytics cookies, we also use Google Analytics and Microsoft Clarity to understand how the site is used; we do not use advertising cookies. See the Cookie Notice.

YoCareerAI is for people aged 18 or over. We do not knowingly collect information from anyone younger. If you believe someone under 18 has an account, contact us and we will delete it.

We will post any change here and update the date above. If a change materially affects how we use your information, we will tell you by email or in the app before it takes effect and, where the law requires, ask for your consent.

Videmak, Inc., 1111B S Governors Ave STE 26609, Dover, DE 19904, United States. Email admin@videmak.org, phone +256 702 270 442.