1. Introduction and Scope
This Privacy Policy explains how CVtoMatch (also referred to as cvtomatch, "we", "us", or "our"), operating at the verified domain https://www.cvtomatch.com, accesses, collects, uses, stores, protects, retains, deletes, and discloses personal information and Google user data when you access or use our web application and services.
CVtoMatch is an AI-assisted career intelligence, ATS resume-to-job matching, cover letter generation, and job application tracking web application. We are committed to full transparency regarding our handling of user data and strictly comply with the Google API Services User Data Policy.
2. What Google User Data Is Accessed by CVtoMatch
CVtoMatch accesses only the minimum Google user data necessary to provide our user-facing authentication and optional user-initiated email outreach features. Specifically, depending on the features you choose to use, CVtoMatch accesses the following Google OAuth 2.0 scopes and data:
2.1 Basic Google Sign-In Data (Scopes: openid, email, profile)
- Email Address: Your primary Google account email address, used to uniquely identify your CVtoMatch account and sign you in.
- Basic Profile Information: Your display name (first and last name) and Google unique account identifier (
sub), used to personalize your workspace profile and pre-fill your sender name on job application documents.
2.2 Optional Gmail Send Integration (Scope: https://www.googleapis.com/auth/gmail.send)
- Send-Only Email Permission: If you explicitly click "Connect Gmail" inside your CVtoMatch Settings page, CVtoMatch requests the
https://www.googleapis.com/auth/gmail.send scope. This scope allows CVtoMatch only to send job application and follow-up emails that you explicitly compose, review, and click to send.
- No Inbox Reading via Google OAuth: CVtoMatch does not request OAuth scopes to read, modify, or delete your personal Gmail messages or contacts via Google OAuth.
2.3 User-Provided Application Data (Non-Google Data)
- Uploaded Resumes / CVs: PDF, DOCX, or TXT resume files that you upload to calculate ATS match scores, generate tailored resumes/cover letters, and attach to job applications.
- Job Application Tracker Records: Job titles, company names, application statuses, and notes you save to your personal Kanban board.
3. How CVtoMatch Uses Google User Data
CVtoMatch uses the Google user data accessed via Google OAuth exclusively to provide and improve the user-facing functionality of the CVtoMatch application requested by you:
- Account Authentication and Session Management: We use your Google email address, name, and unique identifier (
openid, email, profile) to create your CVtoMatch account, authenticate your login sessions, and display your name in the application interface and on your generated cover letters.
- User-Initiated Job Application Dispatch: When you opt in to connect your Gmail account (
gmail.send), we use the OAuth token solely to transmit job application emails and resume attachments to specific recruiters or employers when you click "Send" or "Auto-Apply".
- No Unrelated or Secondary Use: CVtoMatch does not use Google user data for targeted advertising, profiling, market research, creditworthiness evaluation, or any purpose other than providing and improving the core functionality of the CVtoMatch application.
- No AI Model Training on Google User Data: CVtoMatch does not use your Google user data or OAuth tokens to train, fine-tune, or improve generalized artificial intelligence or machine learning foundation models.
4. With Whom CVtoMatch Shares, Transfers, or Discloses Google User Data
CVtoMatch does not sell, rent, license, trade, or transfer your Google user data to any third parties, advertisers, or data brokers. Google user data is only disclosed or transferred under the following strictly limited circumstances necessary to provide the application's functionality or comply with law:
- User-Directed Email Recipients: When you explicitly instruct CVtoMatch to send a job application email using your connected Gmail account, the email message, your sender name, your email address, and your attached resume are transmitted via the Gmail API directly to the recipient email address(es) you selected.
- Essential Hosting Infrastructure Providers: Our web application and database are hosted on secure cloud infrastructure (Google Cloud Platform and Vercel) that process data strictly as service providers on our behalf under confidentiality and security obligations.
- Legal Compliance and Safety: We may disclose information if required to do so by applicable law, regulation, valid subpoena, or court order, or to protect the security and integrity of our service.
We never transfer Google user data to third parties for reasons other than providing or improving CVtoMatch's user-facing functionality.
5. Google API Services User Data Policy & Limited Use Disclosure
CVtoMatch's use and transfer to any other app of information received from Google APIs will adhere to the
Google API Services User Data Policy, including the Limited Use requirements.
- We limit our use of Google user data to providing or improving user-facing features that are prominent in the CVtoMatch application's user interface.
- We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features visible in our interface, as necessary to comply with applicable law, or as part of a merger, acquisition, or sale of assets with explicit notice to users.
- We do not use or transfer Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
- We do not allow humans to read your Google user data unless we first obtain your affirmative agreement to view specific data for support or troubleshooting, it is necessary for security purposes (such as investigating abuse), or it is required to comply with applicable law.
6. Data Protection Mechanisms for Sensitive Data
CVtoMatch implements industry-standard technical, administrative, and physical security controls to protect your personal data and sensitive Google user data against unauthorized access, alteration, disclosure, or destruction:
- Encryption in Transit: All data transmitted between your web browser, CVtoMatch servers, and Google APIs is encrypted in transit using HTTPS / TLS 1.2+ cryptographic protocols.
- Encryption & Credential Protection at Rest: Account passwords are never stored in plain text and are hashed using salted
bcrypt cryptographic hashing. Google OAuth tokens and session tokens are signed using HMAC-SHA256 (HS256) and stored in access-controlled server databases isolated from public network access.
- Principle of Least Privilege & Access Control: Every API endpoint requires a cryptographically verified Bearer JWT token scoped strictly to the authenticated user's account ID. Users can only access their own uploaded resumes, settings, and application records.
- Short-Lived Access Token Caching: Google OAuth access tokens are held only in volatile server memory for their short validity window and are immediately cleared when you disconnect your account.
7. Data Retention and Deletion Policy
7.1 Data Retention
We retain your account profile information (name and email address), uploaded resume documents, and application tracking records only for as long as your CVtoMatch account remains active and as necessary to provide you with our services. Google OAuth refresh tokens for Gmail outreach are retained only while you keep the integration connected in Settings.
7.2 How to Revoke Google Access and Delete Your Data
You have full control over your data and may revoke access or delete your data at any time through any of the following methods:
- In-App One-Click Disconnection: Navigate to Settings → Email / Gmail Setup inside CVtoMatch and click Disconnect. This immediately revokes your Google OAuth token via Google's revocation endpoint (
https://oauth2.googleapis.com/revoke) and permanently deletes the stored token from our database.
- Google Account Security Settings: You can revoke CVtoMatch's access at any time directly from your Google Account at https://myaccount.google.com/permissions.
- Complete Account & Data Deletion Request: You can request complete and permanent deletion of your CVtoMatch user account, Google user data, uploaded resumes, and application history by emailing yassineyoussefwx@gmail.com from your registered email address. We permanently erase all associated records from our database within 48 hours of receiving your request.
8. Changes to This Privacy Policy and User Notification
We keep this Privacy Policy current and will notify users before making any material changes to how CVtoMatch accesses, uses, stores, or shares Google user data. When updates are made, we will revise the "Last Updated & Effective Date" at the top of this page and provide prominent notice within the application interface or via email to registered users.