1. Information We Collect
Account information: When you create an account, we collect your name, email address, and password (hashed). If you sign in with Google, we receive your Google profile information (name, email, profile picture) and an authorization token to send emails on your behalf via Gmail.
Resume/CV data: If you upload a PDF resume, we extract the text content to generate personalized emails. We do not permanently store your uploaded files — text is processed in memory and used only during your session.
Usage data: We collect information about your searches, generated emails, and activity within the platform to provide the service and enforce usage limits.
Payment information: Payment processing is handled entirely by Stripe, Inc. We do not store your credit card numbers or payment details. We store your Stripe customer ID to manage your subscription.
2. How We Use Your Information
- To provide and maintain the ConnectEd service
- To generate personalized outreach emails using AI based on your resume and the recipient’s profile
- To send an individual outreach email on your behalf via Gmail, one recipient at a time, only when you explicitly initiate it
- To process payments and manage subscriptions
- To send you service-related communications (verification emails, password resets, subscription updates)
- To enforce usage limits and prevent abuse
3. Google User Data
Connecting your Google account is optional. If you choose to connect it, we request only the following scopes:
- Sign-in (openid, email, profile): To create and manage your account and show your name and profile picture.
- Send email on your behalf (gmail.send): So you can send an individual outreach message you have written and reviewed, directly from your own Gmail account, one recipient at a time. We only send a message when you explicitly click send — we never send anything automatically or in bulk.
We request the gmail.send scope only. We do NOT request read access to your mailbox, and the app never reads, scans, imports, or accesses your existing emails, drafts, contacts, or any other Gmail content. The only Google data we store is (a) your basic profile (name, email, picture) and (b) an OAuth refresh token, encrypted in transit and at rest, used solely to send the messages you initiate. You can revoke this access at any time at https://myaccount.google.com/permissions, and it is removed automatically when you delete your ConnectEd account.
4. Limited Use of Google User Data
ConnectEd’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above. We do not use it for advertising, we do not sell or transfer it to third parties (including data brokers), and we do not use it to train, develop, or improve any generalized AI/ML models.
5. Data Sharing
We do not sell, trade, or rent your personal information to third parties. We share data only with:
- Stripe: For payment processing
- Google: For authentication and for sending the emails you initiate (only data you authorize)
- Resend: For sending transactional emails (verification, password reset)
- Google Gemini API: Your search queries and resume text are sent to generate directory results and draft emails. We never send your Gmail content to Gemini (we have no access to it). This data is processed per Google’s API terms and is not used to train models.
6. Data Security
We implement industry-standard security measures including:
- Passwords hashed with bcrypt
- HTTPS encryption for all connections
- HTTP-only secure session cookies
- SSL-encrypted database connections
- Environment-variable-based secret management
7. Data Retention and Deletion
You can delete your account at any time from your account settings. When you delete your account, we permanently remove all your data — including your profile, Google profile information, stored Google OAuth refresh token, search history, activity logs, outreach records, and subscription records. Your Google refresh token is also invalidated so ConnectEd can no longer act on your behalf. Active Stripe subscriptions are cancelled immediately. You can additionally revoke ConnectEd’s Google access at any time at https://myaccount.google.com/permissions.
8. Cookies
We use a single essential session cookie to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
9. Children’s Privacy
ConnectEd is designed for high school students (typically ages 14+) and college students. We do not knowingly collect information from children under 13. If you are under 13, please do not create an account.
10. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes by email or through a notice on our website.
11. Contact Us
If you have questions about this privacy policy or your data, contact us at support@useconnected.com.