PRIVACY POLICY

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

In short: we collect the information you give us, the information needed to act on your behalf, and technical usage data.

Personal information you disclose to us

• Names, email addresses, usernames, passwords, phone numbers, contact preferences
• Mailing/postal addresses (some employer application systems, such as Workday, require a full postal address)
• Job titles, target role, work history, education history, skills, salary expectations
• Resumes, cover letters, portfolios, and any documents you upload
• Visa / work-authorization status where you provide it (used, for example, to filter for E-Verify-enrolled employers)
• Answers to job-application questions, both answers you type and answers our AI drafts for you
• Voluntary self-identification responses (e.g., gender, veteran status, disability status) only if you choose to provide them for inclusion in applications; we never fabricate these
• Billing information (processed by our payment processors; we do not store full card numbers)

Information created or collected when Talenry acts for you

• Applications we submit: a record of each application, including the employer, role, the exact field values submitted, generated documents, timestamps, and outcome status
• ATS accounts: some employer application systems (e.g., Workday, iCIMS) require an account; with your use of auto-apply you direct us to create one for you, and we store those credentials securely so you can access them
• Gmail data (only if you connect Google): see Section 8A
• AI interview audio: if you use the AI mock-interview feature, your voice audio and transcripts are processed by our voice-AI provider to run the interview and produce feedback
• Recruiter outreach records: which recruiter was contacted for which application, and the message sent from your connected mailbox
• Push notification tokens: if you use our mobile app and allow notifications, a device push token
• Reliability snapshots: when an automated application fails or needs review, we may capture a snapshot (screenshot and page copy) of the filled form to diagnose and fix the issue. It can contain the personal information that was on the form, and is deleted automatically after a short retention period (currently 14 days)

Information automatically collected

Log and usage data, device data, and approximate location (from IP address), as needed to run, secure, and improve the Services. We also use cookies and similar technologies; see our Cookie Notice.

Payment data

Purchases are processed by our payment processors (e.g., Razorpay). We do not store full card numbers. See Razorpay's privacy notice.

2. HOW DO WE PROCESS YOUR INFORMATION?

In short: to run your job search for you, to run and improve the Services, to communicate with you, for security, and to comply with law.

• Account management — create and secure your account, authenticate you (including Google sign-in)
• Job matching — we compute AI representations (embeddings) of your profile and of job listings to rank roles by fit
• Application preparation — tailor your resume and cover letter to a role; draft answers to application questions from your profile and your previously approved answers
• Application submission (auto-apply) — at your direction, fill and submit applications to employers' systems on your behalf. This includes operating secure cloud browser sessions, completing anti-bot challenges via captcha-solving services, creating required ATS accounts for you, and entering verification codes emailed to your connected inbox to finish a submission you initiated
• Application tracking — read job-application-related emails in your connected mailbox (confirmations, interview invitations, rejections) to keep your dashboard current, and detect whether a submission was received
• Recruiter outreach — where you enable it, identify a relevant recruiter at a company you applied to and send an introduction from your connected mailbox (or save it as a draft, per your settings)
• AI mock interviews — run voice interviews and generate feedback and scores
• Recruiter discovery (opt-in) — if you enable discovery, we use your profile to match and suggest you to recruiters and employers using our recruiter products (see Section 8C)
• Aggregated insights — we create aggregated and de-identified data from profiles, applications, and outcomes (for example, market benchmarks and matching-quality statistics) to develop and improve our products; such data no longer identifies you and may be retained and used indefinitely
• Notifications — send you push notifications about your applications (mobile app, if enabled)
• Support, feedback, marketing (with your preferences), security and fraud prevention, legal compliance
• AI improvement and training — we may use resumes and other content you upload and your interactions with the Services (inputs and outputs) to improve and train our AI models, with your explicit consent where the law requires it. Google user data is excluded; see Sections 6 and 8A

3. WHAT LEGAL BASES DO WE RELY ON?

In short: consent, contract, legitimate interests, legal obligations, and vital interests, as applicable in your jurisdiction (GDPR/UK GDPR, Canadian law, and others).

If you are in the EU/UK: we process your information with your consent (which you can withdraw at any time, including for AI training where consent is required), for performance of a contract (most of Talenry's processing exists to deliver the service you asked for: applying to jobs on your behalf), for our legitimate interests (improving and securing the Services, including using non-sensitive content and usage data to improve our AI models where that does not override your rights), to meet legal obligations, and to protect vital interests. If you are in Canada, we process with express or implied consent, with limited legal exceptions.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In short: with the employers you apply to, and with the service providers that make the Services work. We do not sell your data.

• Employers and their applicant-tracking systems (ATS). When you apply, yourself or via auto-apply, your application data (profile fields, resume, cover letter, answers) is transmitted to the employer and its ATS provider (e.g., Greenhouse, Ashby, Workable, SmartRecruiters, Workday, iCIMS). They process it under their own privacy policies. This sharing is the purpose of the product and happens at your direction.
• Recruiters. If you enable recruiter outreach, the message sent from your mailbox identifies you and the role you applied for.
• Recruiters and employers using our recruiter products (opt-in discovery). If you turn on discovery, your candidate profile, such as your name, headline, target role, skills, experience summary, and location, may be shown or suggested to recruiters and employers using our recruiter-side products (such as Daisy Recruiter). This happens only while your discovery setting is on; see Section 8C.
• AI service providers. OpenAI and Microsoft Azure OpenAI (language models and embeddings), Azure AI Document Intelligence (resume/document parsing), and ElevenLabs (voice AI for mock interviews) process relevant inputs and outputs to provide these features, under contractual safeguards. For mock interviews, your microphone audio streams directly from your device to ElevenLabs (with LiveKit as the audio transport on mobile), together with interview context such as your name, profile summary, and the job description, so the interviewer can be relevant; we store the transcript, feedback, and scores, not the audio. We may also use an AI observability provider (e.g., Langfuse), where enabled, to trace AI requests; traces can include the prompt inputs and outputs.
• Contact-data providers. To find a recruiter for outreach we share the employer's company name/domain with business-contact providers (e.g., Hunter.io, Apollo). We do not share your resume or application content with them.
• Automation infrastructure. Secure cloud-browser providers (e.g., Browserbase) operate the browser sessions that fill and submit your applications, so the form contents transit their infrastructure; they may also maintain per-user browser session state (such as cookies) between applications to make subsequent submissions work better, use proxy exit points matched to your country, and solve anti-bot challenges. Captcha-solving services (e.g., 2Captcha, CapSolver, or the browser provider's own solver) receive the challenge and the page URL, never your profile data.
• Google — only if you connect your Google account (Section 8A). Our websites also load fonts from Google Fonts, which involves your browser sending your IP address and browser details to Google.
• AI assistants you connect (MCP). If you connect a third-party AI assistant (such as Claude or Codex) to Talenry via our connector, that assistant can, using your credential and at your direction, read your profile and applications and take the actions you allow (such as starting or approving auto-apply). The assistant provider processes what it accesses under its own privacy policy.
• Push delivery. Mobile push notifications are delivered through Expo's push service (relaying to Apple/Google), which receives your device push token and the notification content (which may name an employer or role).
• Platform service providers — hosting, storage, email delivery, analytics (e.g., Google Analytics), and payment processors (e.g., Razorpay), under written contracts.
• Business transfers and legal obligations, as in any privacy notice: merger/acquisition contexts, and where disclosure is required by law or to protect rights, property, or safety.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

Yes, for security, session management, preferences, and analytics; third-party analytics/advertising technologies may also run on our sites. Where such technologies are a "sale"/"sharing" under applicable US state law, you can opt out (Section 14). Details and controls: Cookie Notice. We honor the Global Privacy Control signal where required by law.

6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In short: yes, AI is the core of our products.

Our AI-powered features ("AI Products") include: job matching and ranking; resume and cover-letter generation and tailoring; application-answer generation; the auto-apply agent that fills and submits applications; email classification for application tracking; recruiter-outreach drafting; AI insights and predictive analytics; and AI mock interviews. We provide AI Products through third-party AI Service Providers, including OpenAI, Microsoft Azure OpenAI, Azure AI Document Intelligence, and ElevenLabs. Your relevant inputs, outputs, and personal information are shared with and processed by these providers to enable the features, as described in this Notice. You must not use the AI Products in ways that violate any AI Service Provider's policies.

AI training and improvement

• We may use resumes and documents you upload, and your interactions with the Services (inputs and outputs), to improve and train our AI models. Where required by applicable law we will request your explicit consent first; elsewhere we rely on our legitimate interest in improving the accuracy, quality, and safety of the Services, balanced against your rights. You may object at any time by contacting us, and where the law requires it we will honor the objection.
• Google user data is excluded. Data obtained through Google APIs (including anything read from your Gmail mailbox) is used only to provide user-facing features and is never used to develop, improve, or train generalized AI or machine-learning models. See Section 8A.
• Where we retain data for AI improvement beyond your use of the Services, we prefer anonymized or de-identified forms that can no longer be linked to you.

7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

You can register or sign in with Google. We receive basic profile information (name, email address, profile picture) from Google and use it only as described in this Notice. Your Google account remains governed by Google's own privacy policy. Connecting Gmail for application tracking and outreach is a separate, optional step covered in Section 8A.

8A. GOOGLE API SERVICES & GMAIL DATA (TALENRY)

Talenry's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you choose to connect your Gmail account (scope: gmail.modify), we access your mailbox only to provide features you can see and control:

• Read job-application-related messages to keep your application dashboard current: confirmations that an application was received, interview invitations, rejections, and recruiter replies
• Read verification codes that an employer's application system emails you, solely to complete a submission you initiated
• Send recruiter-outreach messages from your mailbox, per your outreach setting (send automatically, save as draft, or off)

To classify whether a message is job-application-related, message content may be processed by our AI service providers acting on our behalf (see Section 4); clear-cut messages are classified without any AI call.

We do not: use Gmail data for advertising; sell Gmail data; use Gmail data to train AI models; or allow humans to read your mailbox data except with your explicit consent for support, for security and abuse investigation, or where required by law. Application-outcome references and status derived from your mailbox are stored; we do not warehouse the full contents of your mailbox. You can disconnect Gmail at any time in Settings, which stops all mailbox access; you can also revoke access at myaccount.google.com/permissions.

8B. BROWSER EXTENSIONS

Draft extension

When you explicitly click "Save," the Draft extension extracts the job title, company, location, description, and URL of the active job posting and syncs it to your Draft dashboard for resume tailoring and career insights. It stores a secure access token locally to maintain your session and may collect technical logs for stability. Its broad site access is used solely to detect and extract job listings when you trigger a save; we do not track your browsing history and do not collect data from pages you do not save.

Talenry Copilot extension

Talenry Copilot helps you complete job applications that Talenry's cloud agent could not finish (for example, forms behind strict anti-bot checks). It works on your command:

• What it does: when you invoke it on an application page, it retrieves your own Talenry data (profile fields, generated answers, resume, cover letter) over an encrypted connection to talenry.com and fills the form in front of you. It never clicks Submit for you. You review, complete anything missing, solve any captcha, and submit yourself.
• Page access: reading and filling happens on pages where you invoke the extension. It may check the URL of open tabs to show a badge when a page looks like a job application; that URL check happens locally and browsing history is not collected or transmitted.
• After you submit: with your session, it can detect the ATS confirmation page and update the application's status in your Talenry dashboard.
• Job understanding, on your command: when you ask it to save, match, or answer questions for a job, the posting's text on the page you are viewing is sent to talenry.com so our AI can parse the role, score the match against your profile, and draft answers.
• Authentication: it uses your existing talenry.com session (cookie) or a token you provide; credentials for other sites are never read.
• Data handling: your data flows only between talenry.com and the application page you are on, over HTTPS; the extension keeps no copy of your profile at rest beyond temporary session storage. We do not sell this data, do not use it for advertising, do not use extension data for creditworthiness or lending, and do not transfer it to third parties except the employer page you are actively filling.

8C. RECRUITER DISCOVERY (OPT-IN)

Talenry includes an optional discovery feature that connects job seekers with recruiters and employers who use our recruiter products (such as Daisy Recruiter and early-access recruiter programs).

• Off until you turn it on. Your profile is not shown or suggested to recruiters unless you enable discovery in your settings (or enable it during signup where offered, with clear notice).
• What recruiters see: profile information relevant to hiring, including name, headline, target role, skills, work and education summary, location, and work-authorization status if you provided it. They do not see your login credentials, mailbox contents, private notes, or the record of other applications you have made.
• How suggestions work: our AI matches recruiter searches and open roles against discoverable profiles and may rank or recommend you for relevant roles.
• Your control: turn discovery off at any time in Settings; your profile stops being shown or suggested. Recruiters you already connected with retain what you shared with them.
• Not a sale. Discovery is a disclosure you direct and control to obtain hiring opportunities. We do not sell your personal information.

8D. MOBILE APP

Our mobile app (iOS/Android) uses the same account and backend as the web app. Additionally: push notifications are optional and delivered via Expo's push service; the microphone is used only during AI mock interviews, with your permission, and audio streams to our voice-AI provider as described in Section 4; your session token and preferences are kept in the device's secure storage (Keychain/Keystore). The app requests no access to your contacts, location, camera, or photos, and contains no advertising or tracking SDKs.

8E. INFORMATION ABOUT PEOPLE WHO ARE NOT OUR USERS

• Recruiters. To send outreach for your application, we obtain a relevant recruiter's business-contact details (name, title, work email) from business-contact data providers and store a record of the outreach. We process this business contact information under our legitimate interest in delivering the outreach you requested. A recruiter may contact admin@syphonlabs.com to have their details removed from our records.
• Referrals. If you use referral features and enter a friend's name or email address, those details are used to provide the referral feature. Only refer people you know and who would want to hear from you.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

As long as needed for the purposes above, typically for as long as you have an account. Application records (what was submitted where) are kept so you have an accurate history. Reliability snapshots of filled forms are deleted automatically (currently after 14 days). Interview transcripts and feedback are kept with your account. Our cloud-browser provider may retain per-user browser session state between applications, as described in Section 4. ATS credentials created for you are kept while your account is active so you can use them. Where we use uploaded data to improve our AI systems, we may retain anonymized, aggregated, or de-identified versions for longer, including in proprietary datasets and benchmarks that improve our products, provided they can no longer be linked to you. When there is no ongoing legitimate business need, we delete or anonymize your information, or isolate it from processing until deletion is possible (e.g., backups).

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

We use appropriate technical and organizational measures: encryption in transit (TLS) everywhere, encrypted storage of secrets and ATS credentials, access controls, and isolation of production data. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security; use the Services in a secure environment.

International data transfers. We are based in India and use service providers located in the United States and other countries, so your personal information is transferred to and processed in India, the United States, and the countries where our providers operate, countries whose data-protection laws may differ from those of your own. If you are in the EEA, the United Kingdom, or Switzerland, we protect such transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses (supplemented by the UK Addendum or International Data Transfer Agreement where applicable) in our contracts with service providers, or, where a legal derogation applies, on the basis of your explicit consent or because the transfer is necessary to perform the contract you asked for (for example, submitting your application to an employer in another country). You can contact us at admin@syphonlabs.com for more information about the safeguards used.

11. DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly collect data from or market to anyone under 18 (or the equivalent age of majority in your jurisdiction). If we learn we have collected such data, we will deactivate the account and delete it promptly. Contact admin@syphonlabs.com if you believe this has occurred.

12. WHAT ARE YOUR PRIVACY RIGHTS?

Depending on your location (EEA, UK, Switzerland, Canada, various US states, India, and others), you may have rights to access, correct, delete, restrict, or port your personal information; to object to processing (including AI training uses, subject to law); to withdraw consent at any time; and not to be subject to solely automated decisions with legal or similarly significant effects. If such a decision is made, we will tell you, explain the main factors, and offer human review. Note that Talenry's automated application submission acts on your instructions; you choose what is applied to, and the review gates in the product let you approve or stop it. To exercise rights: syphonlabs.com/contact or admin@syphonlabs.com. EEA/UK/Swiss users may also complain to their data-protection authority. You can review, update, or delete account data in your account settings; on account termination we deactivate or delete your data, retaining only what fraud-prevention, dispute, or legal obligations require.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

No uniform DNT standard exists, so we do not currently respond to DNT browser signals. California law requires us to say so. We do honor the Global Privacy Control signal where legally required (see Section 14).

14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In short: residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws have rights of access, correction, deletion, portability, and opt-out.

Categories of personal information we collect (last 12 months)

We disclose personal information to service providers under written contracts, and to employers/ATS providers at your direction when you apply. We may use personal information for internal research and the development and improvement of our AI systems (excluding Google user data); this is not "selling." We have not sold personal information and will not sell it. Your state-law rights (know, access, correct, delete, portability, opt out of targeted advertising/profiling, limit sensitive-data use, non-discrimination, and state-specific rights such as third-party disclosure lists) can be exercised via syphonlabs.com/contact or admin@syphonlabs.com; authorized agents may act with valid proof of authorization. We verify requests against information we hold and may ask for more identification. Appeals: email admin@syphonlabs.com with subject "Privacy Rights Appeal"; if denied, you may contact your state attorney general. California "Shine The Light" requests are honored as described in that statute.

15. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

India: we process personal data in accordance with the Digital Personal Data Protection Act, 2023. You may request access, correction, or erasure, withdraw consent, and file grievances with our Grievance Officer at admin@syphonlabs.com (attn: Grievance Officer, Syphon Labs LLP, Sarjapur road, Kaikondrahalli, Bangalore, Karnataka 560035); if unresolved, you may complain to the Data Protection Board of India.

Canada: we process personal information with your express or implied consent under PIPEDA and applicable provincial laws (including Quebec's Law 25); you may request access or correction, withdraw consent (subject to legal or contractual restrictions), and complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner (in Quebec, the Commission d'accès à l'information).

Brazil: we process personal data under the legal bases of the Lei Geral de Proteção de Dados (LGPD); you may request confirmation, access, correction, anonymization, portability, or deletion, and may complain to the ANPD.

Australia / New Zealand: this Notice satisfies the notice requirements of the Privacy Act 1988 (AU) and Privacy Act 2020 (NZ); you may request access or correction, and may complain to the OAIC or the NZ Privacy Commissioner respectively.

South Africa: you may request access or correction, and may contact the Information Regulator (enquiries@inforegulator.org.za) with POPIA complaints.

Other countries: where your local law grants you rights over your personal information, you can exercise them by contacting admin@syphonlabs.com, and we will honor them as the law requires.

16. DO WE MAKE UPDATES TO THIS NOTICE?

Yes, as needed to stay compliant with relevant laws. The "Last updated" date at the top will change, and material changes will be prominently posted or notified directly.

17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

Email admin@syphonlabs.com (privacy-specific requests: subject line "Privacy Request"), or write to:

Syphon Labs LLP
Sarjapur Road
Bangalore, Karnataka 560035
India

18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Depending on your jurisdiction, you may request access to, correction of, or deletion of your personal information, and withdraw consent. You can export a copy of your data and delete your account and data using the in-product data controls (or by contacting us); deletion removes your profile, applications, documents, and connected-account data, except records we must keep for fraud prevention or legal compliance. Manage your data in your account settings, or submit a request at https://www.syphonlabs.com/contact.