Legal · Codessy

Privacy Policy

Last updated: 30 September 2026 · Effective immediately

This Privacy Policy explains how Codessy (“we”, “us”, “our”) — the cold-email automation platform, Chrome browser extension, job-application agent, and our upcoming Interview Rooms product — collects, uses, stores, and protects your information. By creating an account or using any Codessy service, you agree to this policy.

1. What Codessy does

Codessy is a multi-tenant SaaS that helps you:

  • Send AI-personalized cold email — import Excel/CSV recipients, connect your own Gmail via OAuth or SMTP, generate drafts with AI agents, review them, and schedule sends from your account.
  • Hunt jobs automatically — set preferences, upload resumes, connect job portals (LinkedIn, Naukri, Indeed, Wellfound, Hirist, Instahyre), search listings, score matches with AI, and submit applications through browser automation.
  • Score resumes — upload a PDF resume and receive an AI-generated score with section breakdowns, strengths, and missing keywords.
  • Run interview practice sessions (upcoming) — join one-to-one or panel Interview Rooms with live video, screen share, interviewer notes, and resume panels. Details in Section 7.

2. Information we collect

2.1 Account information

When you sign up we collect your name, email address, phone number, and a bcrypt password hash. We never store or can recover your plaintext password.

2.2 Campaign and recipient data

If you import spreadsheets or add recipients, we store what you provide (names, company details, email addresses, job roles, industry, websites) solely to run your campaigns on your behalf. This data is tenant-isolated per account and is never sold or shared with other users.

2.3 Email credentials

When you connect Gmail via Google OAuth, we store an encrypted refresh token (Fernet encryption) so campaigns can send from your account. We do not receive or store your Google password. SMTP account passwords are encrypted at rest the same way.

2.4 AI model keys

If you configure your own AI provider (Anthropic, OpenAI, Gemini, etc.) or use admin-provisioned platform models, API keys are encrypted at rest and used only to generate content for your campaigns, agents, chatbot, matching, and interview features.

2.5 Job-hunting data

Resumes you upload (PDF text is extracted with pypdf), job preferences, applications, cover letters, screening answers, and job-portal session state are used to run job search and application features. Portal credentials are never stored in our database — login state lives in encrypted Playwright browser-profile storage on our server, scoped per user/platform.

2.6 Chrome extension data

The Codessy Chrome extension reads job postings you view (Greenhouse, Workday, Lever, Ashby, SmartRecruiters, and others) when you click “Save Job” or request a match score. Only the job fields shown in the side panel (title, company, location, description snippet) and your saved preferences are sent to your Codessy account. Browsing history is not collected.

2.7 Payments

Payments are processed by Razorpay. We receive payment status, order/subscription references, and limited billing metadata (plan, amount, currency). Full card numbers, CVV, and banking credentials never touch our servers.

2.8 Interview Rooms data (upcoming)

When Interview Rooms launch, the following additional data categories will apply. We will notify you before launch if this section changes materially:

  • Session media — audio/video streams and shared-screen content during a live interview. Streams are peer-to-peer/WebRTC where possible; if relayed through our servers they are processed in real time and not stored unless you explicitly opt into recording.
  • Recordings — if a session is recorded (Pro feature, opt-in per session), the recording is stored encrypted, visible only to room participants, and deletable at any time by the room host or candidate.
  • Resumes in rooms — the candidate’s resume (already uploaded to their profile) is rendered in the interviewer panel. It is shown only to participants of that room and is not shared outside it.
  • Interviewer notes & chat — notes typed by interviewers and in-room chat messages are stored per session to power post-session feedback. They are visible only to room participants.
  • Scoring & feedback — interviewer ratings and AI-generated feedback reports are stored on your account so you can track improvement over time.
  • Credits ledger — a transaction log of interview credits earned (by interviewing others) and spent (by taking interviews), used for fraud prevention and balance integrity.

2.9 Usage data

We collect standard technical logs (IP address, browser type, pages visited, API request metadata, rate-limit events) for security, abuse prevention, and product improvement.

3. How we use your information

  • To provide, operate, and maintain Codessy — sending emails, generating content, scoring resumes, searching and applying to jobs, and hosting interview sessions as instructed by you.
  • To authenticate you and secure your account (JWT sessions, rate limiting, spam and abuse detection).
  • To process payments and manage plans/credits via Razorpay.
  • To provide customer support and respond to your requests.
  • To send service-related notices (verification emails, security alerts, billing receipts, interview confirmations).
  • To generate AI feedback on your interviews and applications, only within your own account.
  • To improve the product (aggregated, de-identified analytics where feasible).

We do not sell your personal data. We do not use your email content, resumes, interview media, or application data to train third-party AI models. Prompts sent to AI providers include only what is needed for generation and are governed by each provider’s data-handling terms.

5. Sharing and disclosure

We share data only with:

  • Infrastructure providers — hosting, database, and storage (e.g. AWS) under confidentiality agreements.
  • Payment provider — Razorpay processes payments; we receive only payment status and references.
  • AI providers — only the minimal prompt content required for generation, under their API data policies.
  • Google / OAuth providers — when you explicitly connect an account.
  • Job portals — your own credentials and sessions are used to act on your behalf on platforms you connect (applying to jobs, saving listings).
  • Other interview participants — within an Interview Room, participants can see the candidate’s video, shared screen, resume panel, and chat/notes as designed by the room layout. Nothing else is visible outside the room.
  • Law enforcement — when required by law or to protect rights, safety, and security.

6. Data retention

  • Account and campaign data are retained while your account is active.
  • Job-portal browser sessions are deleted when you disconnect a portal or delete your account.
  • Interview recordings (if you opt in) are retained until you delete them or delete your account; transcripts and notes follow the same rule.
  • Payment records are retained as required by Indian tax law.
  • You may delete your account at any time from Settings; upon deletion we remove personal data within 30 days, except where retention is required for legal, tax, or dispute-resolution purposes. Encrypted OAuth tokens are destroyed with the account.

7. Cookies and local storage

We use a strictly necessary auth token (stored in your browser’s localStorage) to keep you signed in, and a theme preference key. We do not use third-party advertising cookies. The Chrome extension stores job-page data locally in your browser and only sends it to your Codessy account when you save a job or request a match score.

8. Interview Rooms — special provisions (upcoming)

Our upcoming Interview Rooms feature lets you practice interviews in realistic settings. The following provisions specifically govern that feature:

  • Participants consent by joining. When you join a room you are informed who else is in the session. Audio/video capture happens only while you are an active participant; you can mute/stop your camera at any time.
  • Recording requires explicit consent. Recording is off by default. When enabled, all participants see a recording indicator. In jurisdictions requiring two-party consent, we will require every participant to acknowledge before recording starts.
  • Credits, not cash, for peer interviews. The free tier lets you earn interview credits by interviewing others and spend them to be interviewed. We keep a ledger of these transactions; this is anti-abuse data, not financial advice or employment services.
  • No employment promises. Codessy does not act as a recruiter, employer, or placement agency. Interview Rooms are practice/mock sessions between users (and, on paid tiers, potentially with experienced interviewer communities we onboard). Outcomes of interviews — real or mock — are never guaranteed.
  • Conduct. Recording, sharing, or republishing another user’s interview media, resume, or notes without their permission is prohibited and may result in account termination.
  • Deletion rights. You may delete your recordings, notes, and feedback reports from your session history at any time. Room hosts can end sessions and delete room-level artifacts.

9. Security

  • TLS encryption in transit for all API traffic.
  • Fernet (AES-128-CBC) encryption at rest for OAuth tokens, SMTP passwords, and AI keys.
  • bcrypt password hashing with per-user salts.
  • Per-user tenant isolation — every query is scoped to your user ID.
  • Least-privilege Gmail scopes (send only; we never request broad Gmail read permissions).
  • Encrypted, per-user browser profiles for job-portal sessions; job-portal credentials are never written to our database.
  • Interview media encrypted in transit (DTLS/SRTP for WebRTC); recordings encrypted at rest.

No system is 100% secure. If we become aware of a breach affecting your data, we will notify you and regulators as required by applicable law.

10. Your rights

Depending on your jurisdiction (GDPR, DPDP Act 2023, CCPA), you may have the right to:

  • Access the personal data we hold about you (including interview recordings and notes you participated in).
  • Correct inaccurate data.
  • Export your data in a portable format (recipient lists, resumes, campaign history, interview feedback).
  • Delete your account and associated data, including recordings.
  • Object to or restrict certain processing.
  • Withdraw consent where processing is consent-based (e.g. opt out of recording).
  • Lodge a complaint with a supervisory authority.

To exercise any right, email support@codessy.site. We respond within 30 days.

11. Children’s privacy

The Service is not directed at individuals under 18. Interview Rooms are intended for adult job seekers and professionals. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

12. International transfers

Your data may be processed in countries other than your own (e.g. where our cloud infrastructure is located). We rely on appropriate safeguards — standard contractual clauses or equivalent mechanisms — for cross-border transfers. Interview streams may transit global CDN/WebRTC relay networks solely to deliver real-time media.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes — including changes triggered by the launch of Interview Rooms or new data categories — will be announced in-app or by email before they take effect. Continued use of the Service after the effective date constitutes acceptance.

14. Contact

Questions about this policy or your data: