Privacy Policy

Depending on how you use Surfwork, we collect:

• Account information, such as your name, email address, profile image, account identifier, and authentication session information.
• Profile information you provide, such as education, work experience, skills, interests, goals, LinkedIn URL, personal website, and target companies or locations.
• Search and contact information, including search queries, saved results, professional profile details, contact details, notes, and information returned by search and enrichment providers.
• Jobs and opportunities, including employer or careers-page searches, preferences, saved roles, source links, and fit assessments based on the profile information you provide.
• Uploaded PDF documents, such as resumes and cover letters, including the file contents, filename, size, and attachment selections. Files are stored for your document library and email attachments. Uploading a document does not currently parse it into an AI profile or make it available as agent context.
• Outreach content, including templates, generated drafts, recipients, subjects, message bodies, send status, and reply-tracking metadata.
• Connected Google account information, as described in the Google OAuth and Gmail section below.
• Subscription and transaction information, such as your Stripe customer and subscription identifiers, plan, status, and billing period. Payment card details are submitted directly to Stripe rather than stored in Surfwork's application database.
• Technical and usage information processed in connection with requests, authentication, security, rate limiting, and service operation.

We use information to:

• create and secure accounts and provide the Surfwork service;
• search target employers for roles, assess fit using saved profile fields, and save opportunities;
• run hiring-contact searches and save contacts and search history;
• suggest likely work emails, personalize templates, and convert supplied emails into reusable templates;
• store PDF documents, provide authenticated previews, and attach selected files to email you choose to send;
• send user-directed email and track whether a reply is received;
• operate subscriptions, usage limits, support, security, and troubleshooting; and
• maintain and improve the reliability and functionality of the service.

Surfwork uses Google OAuth in two contexts. First, you may use Google to create or access your Surfwork account. For that sign-in flow, Surfwork and its authentication provider receive the account information Google makes available for authentication, such as your name, email address, profile image, and Google account identifier.

Second, after signing in, you may separately connect Gmail. The Gmail authorization requests permission to send email and read Gmail messages and history. It does not request permission to modify or delete existing messages or mailbox labels. Surfwork's currently implemented Gmail features use that access to:

• identify the connected Gmail address and store OAuth access and refresh tokens;
• send messages that you direct Surfwork to send;
• retrieve message and thread identifiers and limited message metadata after sending;
• register inbox-change notifications and review Gmail history, headers, and message snippets to identify replies to messages sent through Surfwork; and
• store send and reply-tracking records, including recipient and sender addresses, subjects, message bodies sent through Surfwork, reply sender, reply subject, reply snippet, and related message or thread identifiers.

Current job applications open on the employer's website. Surfwork does not currently submit applications for you or classify Gmail into application statuses. Outreach tracking follows replies to sent messages; it is not an inbox-wide application tracker.

The current product does not use Gmail access to delete messages or change mailbox labels. Surfwork does not sell information received from Google APIs or use it for advertising. Gmail data retrieved for reply tracking is not sent to an AI provider or used to develop, improve, or train generalized AI or machine-learning models.

Surfwork's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy. We limit access and sharing to providing the user-facing features described here, security, and applicable legal obligations. Human access to Google data is limited to your affirmative agreement for specific messages, security investigations, legal requirements, or internal operations on aggregated and anonymized data.

Surfwork shares information with service providers only as needed to provide the functions described in this policy. Current integrations include:

• Supabase for authentication, application database services, and private PDF attachment storage;
• Google for Google sign-in and optional Gmail features;
• Exa for hiring-contact search, public profile lookup, employer and careers-page discovery, and email-format research;
• Microsoft Azure OpenAI for search summaries, profile-based job-fit assessments, and converting supplied emails into templates;
• Hunter for company/domain suggestions and work email lookup or verification;
• Stripe for checkout, subscription management, and billing; and
• hosting, infrastructure, and security providers that process application requests and operational data.

The information sent to a provider depends on the feature you choose. For example, search queries and public profile URLs go to search providers, saved profile fields and job descriptions may be included in a job-fit request, and an email you paste for template conversion goes to the AI provider. Selected PDF attachments are sent through Gmail to your chosen recipients. Current PDF upload and attachment support does not send those documents to an AI document-parsing service. Billing details go to Stripe.

Surfwork currently stores account and feature data while your account is active and does not apply one fixed automatic retention period to every category of data. You can delete your account from Settings. The account-deletion process is designed to remove your authentication account and associated Surfwork records, including profile, contacts, templates, search history, saved opportunities, Gmail connection tokens, send records, file metadata, and subscription metadata where covered by the deletion flow and database relationships.

Removing a PDF from Library hides it, removes its template links, and deletes its stored file. Earlier send-attachment metadata can remain until account deletion. Account deletion purges your uploaded PDFs, profile images, and feedback images from active storage. Failed cleanup is retained for retry; a delayed cleanup pass catches uploads already in progress when deletion began. Deletion in Surfwork does not recall messages or attachments already delivered to recipients or erase copies held by Google or other providers. Manage billing separately in Settings.

You can also revoke Surfwork's Google access from your Google Account connections. Revocation stops future access through those credentials but does not itself delete information already stored by Surfwork; use account deletion or contact us for that. Limited information may remain in provider backups, security logs, or records a provider retains under its own obligations.

Career chat, resume creation/tailoring, profile context from uploaded resumes and cover letters, recommendations, and user-dispatched job/application agents are on the roadmap. These descriptions do not mean those features process your data today. Every application submission will require your approval. We will update data-use descriptions when those workflows become available. Hosted portfolio websites are not part of Surfwork.

Surfwork uses authenticated sessions, database access controls, server-side provider credentials, and rate limiting on selected endpoints to help protect information. No storage or transmission method is completely secure, and Surfwork cannot guarantee absolute security.

We may update this policy as Surfwork's features and data practices change. We will post the revised policy here and update the “Last updated” date.

For privacy questions or requests, email jp@surfwork.io.