← Back to JSAS

Privacy Policy

Last updated: October 9, 2026

1. Introduction

Vedteq ("we," "us," or "our") operates JSAS (Job Search Automation System). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our service.

2. Information We Collect

2.1 Information You Provide

  • Account information (name, email address, password)
  • Candidate profiles (name, contact details, work history)
  • Resumes and professional documents
  • Job descriptions and application details
  • Contact information for outreach recipients
  • Email content (subject lines, email bodies) created through the service

2.2 Information from Third-Party Services

When you authorize a Gmail connection via OAuth, we receive:

  • Your email address (to identify the connected account)
  • OAuth tokens (access token and refresh token) for sending emails

We do not read, index, or store the contents of your inbox, sent folder, or any emails not created through JSAS. The one exception is mail you choose to forward to us with optional reply tracking (section 5).

2.3 Automatically Collected Information

  • Usage logs (pages visited, features used)
  • Browser type and device information
  • IP address

3. How We Use Your Information

We use your information to:

  • Provide and operate the JSAS service
  • Generate tailored resumes using AI
  • Generate personalized outreach emails using AI
  • Send emails on your behalf via your authorized email account, once you or your coach has approved them
  • Show your coach replies and delivery failures for your outreach, if you turn on reply tracking
  • Store sent resume PDFs as historical snapshots
  • Improve the service and fix issues
  • Communicate with you about the service

4. Google API Services Usage

JSAS uses Google API Services for email sending. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only use Gmail API access to send emails that you or your coach have explicitly composed and approved within the JSAS platform
  • Every email traces back to that approval. An email you or your coach sends by hand goes out straight away. An email approved for later, such as an application email approved on the review screen or a follow-up approved in advance, is sent by JSAS from your Gmail during business hours, a few a day, so it may go out days after it was approved. JSAS never sends an email nobody approved
  • An administrator can pause all of these scheduled emails at once. JSAS also pauses them on its own if Gmail limits your account, and never resends an email automatically when it can't tell whether it was sent
  • We do not use Gmail data for advertising, market research, or email tracking (such as tracking whether recipients open your emails). Optional reply tracking (section 5) does not use Gmail data: it works from copies your own Gmail filters forward to us and from a hidden copy of each email
  • We do not allow humans to read your email data unless you have given affirmative consent, it is needed for security purposes, or it is required by law
  • OAuth tokens are encrypted at rest using AES-256-GCM encryption
  • You can revoke JSAS access at any time through your Google Account permissions

5. Reply Tracking (Optional)

Reply tracking lets your coach see when a contact replies to your outreach, or when an email could not be delivered. It is off unless you turn it on, and it needs no additional Google permission: JSAS still holds only the permission to send, and still cannot read, list, label, modify or delete anything in your mailbox.

5.1 How it works

  • JSAS gives you a private address of its own. You add it in Gmail as a forwarding address and create two filters that forward to it: one forwards replies sent to your "+jobs" address (for example, you+jobs@gmail.com), the other forwards Gmail's delivery-failure (bounce) notices. Gmail forwards only messages that match those filters. The rest of your mailbox never reaches JSAS.
  • While reply tracking is on, emails JSAS sends for you ask for replies to go to your "+jobs" address. Replies still arrive in your own inbox; your filter forwards a copy to JSAS.
  • To check the setup, JSAS sends a test email from its own address to your "+jobs" address and, when you click to run the test, sends one email from your Gmail to an address that does not exist, so that Gmail returns a bounce notice. While you have outreach awaiting a reply, JSAS sends a weekly test email from its own address (never from your Gmail) to check that the filters still work. Test emails are recognised and dropped; their content is not stored.

5.2 The hidden copy on every send

Whether or not reply tracking is on, every email JSAS sends from your Gmail includes a hidden copy (BCC) to a one-time JSAS address. The recipient cannot see it; you will see it in the copy in your Sent folder. JSAS uses it only to learn the identifier Gmail gave the email, so that a reply can be matched to it, and to confirm the email was sent. From the hidden copy JSAS keeps the message's headers (such as its identifier, sender and subject), not its body.

5.3 What we keep

  • Replies: the headers needed to match the reply to your email (sender, subject, date and message identifiers), the new text of the reply with the earlier emails quoted below it removed, and the names of any attachments. Never the attachments themselves, and never the whole message as it arrived.
  • Bounce notices: read once when they arrive. JSAS keeps the address that failed, the error code and the notice's headers (such as its subject and message identifiers), never its body.
  • Gmail's forwarding confirmation: JSAS keeps its confirmation link to show you, and never opens the link itself.
  • Anything else that reaches your private JSAS address but does not pass our checks: JSAS keeps only its sender and message identifier, for security review, and deletes them after 30 days.

To sort a reply (for example interested, not interested or out of office), JSAS sends its new text, its subject and a few automatic-reply headers to our AI provider. It never sends the sender's address or the earlier emails.

5.4 How long, and who can see it

  • Reply text and attachment names are removed 12 months after the last activity on that outreach. The reply's category, dates, sender, subject and the headers used to match it remain.
  • Replies that could not be matched to one of your emails are deleted after 30 days.
  • The headers kept from hidden copies, bounce notices and confirmations stay with your email history, like the emails themselves.
  • Only JSAS staff (coaches and administrators) can read reply text.

5.5 Who processes it

Brevo, the email service JSAS already uses, receives the forwarded replies, bounce notices and hidden copies on our behalf and passes them to JSAS. Brevo may keep a copy for a limited period under its own retention rules; we are working with Brevo to keep that period as short as it allows.

5.6 Turning it off

You can stop reply tracking at any time: delete the filters or the forwarding address in Gmail, or ask us to turn it off in JSAS. Turning it off retires your private JSAS address at once, so anything still forwarded to it is rejected. Reply text already stored stays under the rule above unless you ask for it to be deleted, which you can do at any time by contacting us.

Forwarded replies are not data JSAS receives from Google APIs; they arrive because your own Gmail filter forwards them. We hold them to the same limits all the same: they are used only to manage your outreach, never for advertising or market research. Matching a reply to your email uses the identifier from the hidden copy, not data from Google APIs. JSAS does not track whether recipients open your emails or click their links.

6. Data Storage and Security

We protect your data through:

  • Encryption at rest: OAuth tokens are encrypted using AES-256-GCM before database storage
  • Encryption in transit: All data is transmitted over TLS/HTTPS
  • Access controls: Role-based access control limits data access to authorized users
  • Secure infrastructure: Data is hosted on secured cloud infrastructure with regular backups

Resume files and email attachments are stored in private, encrypted cloud object storage (Vercel Blob), accessible only through short-lived signed URLs.

7. Data Sharing

We do not sell, rent, or trade your personal information. We may share data only in the following circumstances:

  • With your consent: When you authorize email sending, your email content is transmitted to the recipient via Gmail API
  • Service providers: We use third-party services (cloud hosting, AI providers, and Brevo for email delivery and for receiving reply-tracking mail) that process data on our behalf under strict contractual obligations
  • Legal requirements: If required by law, regulation, or legal process

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. Email history and sent resume snapshots are retained for your reference. You may request deletion of your data at any time by contacting us. Section 5.4 sets out how long reply-tracking data is kept.

9. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Revoke OAuth authorizations at any time
  • Export your data in a portable format
  • Withdraw consent for data processing

10. Cookies

JSAS uses essential cookies for authentication and session management. We do not use third-party advertising or tracking cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via the service or email. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at roshan.soni@vedteq.com

© 2026 Vedteq. All rights reserved.