The service and its operator
This notice explains how CareerOS AI handles information when you browse its public pages or use an account to prepare and manage your job search.
Deskiit Innovation Incorporation
Information used in your workspace
CareerOS uses the information you provide to create and operate your account and the workspace features you choose:
- Account access: your name, email address, password hash and session records. Administrator accounts also use authenticator verification and access records.
- Career information: your profile, experience, education, skills, preferences and any CV you upload.
- Your search: saved opportunities, CVs, letters, application records, document versions, notes, follow-ups and reminder preferences.
- Support: messages, tickets, attachments and the basic account context needed to handle your request.
- Service security: technical request information, rate-limit records and operational or administrative audit events.
You choose what career information to add. Avoid including identification documents, sensitive personal details or information about another person unless it is necessary and you are entitled to share it.
Purposes and legal bases
Where the GDPR applies, the legal basis depends on the purpose of the processing:
- Account and core workspace: performance of the service contract you request, including account access, saved career records, document preparation, application tracking and account support.
- Security and service protection: legitimate interests in protecting accounts, preventing misuse and investigating incidents, taking your rights and interests into account.
- Optional external AI: your consent before selected career information is shared with the named provider. You can decline or withdraw consent for future optional requests without losing the core workspace.
- Applicable legal requirements: compliance with legal obligations where they apply to the operator or a particular request.
The European Commission explains these legal grounds.
Job-fit views are estimates based on recorded information. They help you assess opportunities; they do not make binding employment decisions or determine an employer’s response.
Storage, access and service providers
The current service uses Cloudflare hosting, D1 database storage and private R2 file storage. Workspace records are associated with the account that owns them. Authorized support and administrative access is restricted by role and purpose.
Workspace record payloads and private support content use application-level AES-GCM encryption with a server-held key. Original CV uploads are held in private file storage. Account identifiers and operational routing metadata are not all encrypted as application payloads.
Passwords are stored as salted, one-way PBKDF2 hashes. Authentication uses a session cookie protected with HttpOnly and SameSite settings; HTTPS sessions use a Secure cookie. These controls do not make the service end-to-end encrypted.
Cloudflare processes service data as part of hosting and storage. Other optional providers receive information only when their integration is configured, activated and used for its stated purpose.
Website fonts are served from this site. Your browser does not need to contact an external font service to display these pages.
International processing and transfers
Cloud infrastructure may process information outside your country. Processing locations and applicable transfer safeguards depend on the services in use; this notice makes no data-residency commitment or claim about an unverified contractual arrangement.
For details about current processing locations, recipients and applicable international-transfer safeguards, contact info@deskiit.com.
Before optional external processing is activated, the configured provider and sharing details are presented before you consent. That choice does not replace any international-transfer protections required by applicable law.
Private support conversations
Support requests use a limited context: your name, account identifier and your account email only if you allow it for the conversation. Your CV, career profile and application documents are not automatically copied into a support request.
You decide whether to send a message or attach a file. Replies are available in the same signed-in conversation, with in-app notifications when your notification preference allows them. Internal staff notes are not displayed in the customer conversation.
Share only what is needed to explain the issue. Do not send passwords, authenticator codes, recovery links or provider API credentials in a support message.
Optional AI and external sharing
External AI rewriting is not currently configured for this public launch. A proposed ChatGPT Pro connection is awaiting provider approval and is not an active connection.
If an external AI option is enabled later, the review screen identifies the configured provider and the selected information to be shared. You must authorize that sharing before a request runs. Declining it leaves the ordinary workspace and local review tools available.
The implemented optional review is designed to send selected career evidence while omitting identity, contact, original CV, education, language, authorization and date fields. Free text can still contain personal information, so review the sharing explanation and your text before authorizing a request.
AI output is a draft. You choose which suggestions to apply and remain responsible for checking their facts. Choosing not to authorize further requests stops future optional sharing; it does not recall a request already processed by an external provider.
Optional Gmail recruitment email
Gmail recruitment email is an optional iApply247 feature. When it is available, it connects only after you consent in Settings → Recruitment Email and approve access at Google. Google grants permission to read the mailbox; iApply247 limits its checks to application evidence you provide or a recruitment label you select. Follow-up sending requires separate Gmail permission and your explicit choice to enable it. iApply247 does not use the shared support mailbox for candidate follow-ups.
iApply247 first checks limited message metadata, such as sender, dates and thread identifiers, against your recorded applications. When you confirm the link, iApply247 can read the relevant message to identify recruitment outcomes, such as an interview invitation, and update your application or notify you. It does not import unrelated messages, retain message bodies or attachments, or send Gmail message content to an AI provider. If you authorize a follow-up, Google receives the message and its thread details to send it from your Gmail account.
OAuth tokens and retained recruitment review records are encrypted in server storage. You can choose a 7 to 90 day retention period for message review and classification records. You can pause monitoring, or disconnect to delete stored mailbox access, application links and message review records. Disconnect and revoke also asks Google to revoke access. You can manage the grant in your Google Account. Application history may retain status changes and minimal follow-up records.
iApply247’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Retention and account deletion
Your active workspace is generally retained while you maintain your account, until you remove individual records or delete the account. Settings & privacy provides an account-deletion control with an explicit confirmation.
Account deletion removes the active account and its associated workspace records, original CV upload and support attachments from the application’s active storage. Export the information you want to keep first.
Operational backups and limited security or administrative logs are handled separately where needed for recovery, security or applicable obligations. Deleting an active record is not a promise that every backup copy disappears immediately.
The retention-days setting is a saved preference. It does not activate an automatic purge or a scheduled account-deletion process.
Access, correction and your rights
You can edit your career profile and records in the workspace. Settings & privacy provides a JSON data export, account requests and deletion controls. Your original uploaded CV can be downloaded separately from Career profile.
Where the GDPR applies, your rights can include access, correction, erasure, restriction, portability and objection, subject to the circumstances and legal conditions. Where processing relies on consent, you can withdraw that consent for future processing. You can also complain to the relevant data-protection authority. The European Commission’s information for individuals explains these rights and how to exercise them.
For a request beyond the self-service controls, contact the operator using the route below. Account ownership or identity may need to be verified before personal data is disclosed or changed.
Updates and questions
This notice will be updated when confirmed operator details or the service’s actual processing arrangements change. Optional provider activation must still be explained at the point where sharing is requested.
For practical guidance, visit Help & support. Questions about the handling of your account information can be raised through info@deskiit.com.