Applyvana privacy notice
This notice explains how Applyvana, Inc. uses information while providing Applyvana. The current version is dated 2026-09-23.
Information you provide
We use your profile, job criteria, application answers, and connected service details to provide the features you request and show your application history. We also use your account email to verify a new password account and to send a password-reset link when you request one.
Connected mail and Google data
Automated applications use your verified account email unless the hiring system requires an emailed security code, activation link, or password-reset message. Those applications use a private address on an Applyvana-controlled subdomain. Cloudflare receives messages sent to that private address and sends the original message to Applyvana on Microsoft Azure. The address identifies your account, profile, and—where the hiring system permits it—the exact application. Account-based hiring sites can reuse one private address for that site and profile.
The original message is stored privately in Microsoft Azure and appears in your Recruiting inbox. A currently reserved application worker can read a matching security code or verification link immediately. Other recruiting messages are grouped into a Gmail-delivered summary after at least 24 hours. Because delivery checks run every six hours, the summary normally arrives 24 to 30 hours after receipt. Cloudflare, Microsoft Azure, and Google process only the email needed for receipt, private storage, application verification, and summary delivery.
Connecting Gmail or Outlook is optional. When you connect Gmail,Applyvana requests read-only Gmail access. It searches at most 20 recent Inbox messages received after an application task or the last mailbox check. It reads only the candidate messages needed to find a one-time security code, verification link, application receipt, interview request, assessment, recruiter reply, scheduling request, offer, or onboarding update. Attachments are not downloaded. The service cannot send, edit, label, archive, or delete your Gmail messages.
Message bodies are required because security codes, verification links, and recruiting details are contained in the body. Google's metadata-only permission does not provide message bodies and does not permit the Gmail search used to limit the check by time. Read-only Gmail access is therefore the narrowest permission that supports these features.
Sharing and disclosure
We do not sell, rent, or use Google user data for advertising. We do not share it with data brokers. Google user data is processed by Microsoft Azure solely as the infrastructure provider that hosts and secures Applyvana. When you ask the service to complete a job application, only the matched one-time code or verification link is provided to that specific hiring website as needed to perform your requested action. We may disclose information when legally required, but we do not otherwise transfer Gmail content or mailbox metadata to third parties.
Data protection
Messages sent to a private application address are encrypted while they travel between Cloudflare, Microsoft Azure, Gmail for summary delivery, and your browser. The full messages are encrypted at rest in Microsoft Azure as described below.
Data read from an optionally connected Google or Microsoft mailbox is encrypted while it travels. Long-term mailbox authorization tokens are protected at rest with 256-bit authenticated encryption. During a connected mailbox check, short-lived access tokens and message bodies are kept only in process memory. Databases and file storage use private network access, managed identities, and role-based access controls. A worker can request a code or link only for its currently reserved customer application task. Message bodies, access tokens, and refresh tokens are excluded from application logs and history.
Retention and deletion
Full messages received through a private Applyvana application address are stored as private email files in Microsoft Azure so a waiting application can read its code or link and you can review the message in the Recruiting inbox. Message bodies are not stored in the application database. The database stores the private route, provider message ID, sender, recipients, subject, received time, classification, matching result, summary delivery attempts, and action details. Relay files and records remain until you delete your account.
For optional Gmail or Outlook checks, full message bodies are discarded when the check finishes and are never stored in the application database or file storage. One-time code values are not stored in the database.
Disconnecting Gmail immediately deletes the stored authorization token and stops future Gmail access; minimal existing application history remains until account deletion. Deleting your account from Settings removes the mailbox connection, authorization, message metadata, links, and other account data from active systems. Encrypted database backups expire within seven days. Deleted private email files can remain in Azure Blob Storage's 30-day recovery period before permanent removal.
Artificial intelligence and machine learning
Raw or derived Google Workspace data is not sent to Azure OpenAI, GitHub Copilot, or any other artificial intelligence or machine learning provider. It is not used to create, train, test, fine-tune, or improve a general-purpose or foundational model.
Google API Limited Use
Applyvana's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Questions
Contact support@applyvana.com with privacy questions.