Privacy Policy

What we collect

• Account: you sign in with Google, which gives us your name, email address and profile picture link. We never see your Google password.
• What you add: jobs, companies, links, notes, job descriptions, board columns, application history and steps, and how you applied.
• Your CV: the text you paste or upload, and the original file if you upload one.
• Results we generate for you: match reports, skill checks, tailored CVs and interview preparation.
• Connected mailboxes (only if you connect one): the mailbox address, an encrypted access token and sync progress. From job-related emails we keep only what we extract: the sender’s name, subject, a link to open the email, the company, role, interview or assessment type, a job link and description if the email contains one, and how you applied. We never store whole emails.
• Usage counts: when you use AI tools, email sync and searches, so daily limits can be applied.
• Your language choice, and technical data our hosting provider logs to run the service (such as IP address and request time).

How we use it

Only to provide Dreamplish to you: showing your board, matching your CV to jobs, tailoring CVs, preparing interviews, researching companies you apply to, and turning job emails into suggestions you review. We do not sell your data, show ads, or use it for marketing.

We also keep usage statistics, such as how many jobs are added or briefings opened, to understand how Dreamplish is used and improve it (see “Usage statistics”).

AI and research

Some features send information to Google’s Gemini AI: job descriptions, your CV text with your name, email addresses, phone numbers and links removed first, and for connected mailboxes the subject, sender and the first part of likely job emails, with email addresses, phone numbers and links removed. When Gemini isn’t available, Dreamplish sorts job emails with its own model on its servers instead.

Dreamplish uses Gemini’s free tier. Under Google’s terms, Google may use what is sent to the free tier, including the parts of job emails above, and the responses, to improve its products, and people at Google may review it. Please don’t add information to job notes or descriptions that you don’t want processed this way, and don’t connect a mailbox if you don’t want its job emails processed this way.

Company briefings search the web for the company name and the roles you track there, through our own search server, which passes the search to public search engines (such as Bing, Startpage, Mojeek and Yahoo) without saying who asked. Our server then opens the pages found to read them. Briefings contain only public information about companies and are shared between users who track the same company.

To read a job posting from a link, our server opens that page.

Who processes your data

• Supabase: database, sign-in and file storage. Your data is stored in Tokyo, Japan.
• Vercel: hosts the app, with servers in Tokyo, Japan.
• Google: sign-in, and Gemini AI.
• Microsoft: Outlook, if you connect it.
• Google: Gmail, if you connect it (offered only to invited testers for now).
• Oracle Cloud: hosts our search server for company briefings and job descriptions, in Jeddah, Saudi Arabia.
• PostHog: usage statistics (United States).

Because most of these providers are outside Saudi Arabia, your data is transferred abroad to provide the service, as the PDPL permits for this purpose.

Connected mailboxes

Access is read-only: Dreamplish can never send, change or delete your emails. It looks for job-related messages (applications, assessments, interviews, offers, rejections) and suggests updates you accept or ignore. You can disconnect at any time from your profile; your token and pending suggestions are deleted (for Gmail, we also end Dreamplish's access in your Google account), and you can revoke access yourself in your Microsoft or Google account settings.

Gmail is in limited testing: only people we invite can connect it, Google asks them to reconnect every 7 days, and Google shows a notice that the app isn't verified yet. Job-related Gmail messages are handled like Outlook ones, as described in “AI and research”.

Gmail data is used only to show you job-email suggestions; it is never sold and never used for advertising.

Cookies and storage

• A sign-in cookie that keeps you signed in.
• A cookie that remembers your language.
• A short-lived cookie (10 minutes) used only while you connect a mailbox.
• Your browser’s storage remembers your theme and which board columns you collapsed.

We use no analytics, advertising or tracking cookies.

Usage statistics

Our server records which pages are opened and what you do, such as signing up, adding a job, changing its status, running Match & CV or connecting a mailbox, under your account’s random ID. It never sends your name, email address, IP address, CV, job titles, company names, notes or emails. No cookies are used: a visit while signed out gets a temporary ID that is forgotten when you leave the page. To have your statistics deleted, email us.

How long we keep it

We keep your data while your account exists. Deleting your account (Profile → Delete account) immediately deletes your profile, jobs, CV and its file, history, results, mailbox connections and usage counts. Company briefings contain no personal data and remain. Our hosting provider keeps technical logs for a limited period.

Your rights

Under the PDPL you can ask to access your data, get a copy, correct it, have it deleted, and withdraw consent (for example by disconnecting a mailbox or deleting your account). You can edit and delete most data in the app yourself; for a copy of your data or anything else, email dreamplish.support@gmail.com. We reply within 30 days. You can also complain to the Saudi Data & AI Authority (SDAIA).

Security

Data is encrypted in transit. Each account can only reach its own data, enforced by the database itself. Mailbox tokens are encrypted, and CV details are removed before CV text goes to the AI. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Children

Dreamplish is for people aged 18 and over. We do not knowingly collect data from children.

Changes and contact

We will update this page when our practices change and show the date below. Questions or requests: dreamplish.support@gmail.com.