Effective date: 11 October 2026

Last updated: 11 October 2026

We respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, and safeguard your information when you interact with our website, products, and services. It covers:

• our website, protocoljobs.ai

• the Protocol web app, app.protocoljobs.ai

• the Protocol Chrome extension

• job alerts and messages we send you on WhatsApp and by email

In this policy, "Protocol", "we", "us" and "our" mean PROTOCOL JOBS, the business that operates Protocol. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

⸻

The short version

• We do not sell your personal data.

• We use your data to find you jobs, help you apply, and help you reach the people hiring for them.

• If you connect Gmail, we can only send emails you have reviewed and pressed Send on. We never read, list, change or delete the emails in your mailbox.

• Some features use AI to draft text from your resume and profile.

• We show you work contact details of people at employers only after you unlock them, and only so you can reach a hiring team. Those people can ask us to remove their details at any time.

• You can see, correct or delete your data, disconnect Gmail, and stop alerts whenever you like. Write to tanya.kapoor@protocoljobs.ai.

⸻

1. Information We Collect

Information you give us

• Account information: your name and email address, and how you sign in: with an email and password, or with Google. If you sign in with Google, Google shares your name and email address with us.

• Professional details: your LinkedIn profile, resume, work history, skills, education, notice period, current and expected salary, job preferences (roles, experience level, locations, work type), and other details you choose to provide for job applications (for example, work authorisation).

• Phone and WhatsApp number: if you give us your mobile or WhatsApp number for job alerts, or verify it to unlock contacts (see "Get a human to see you" below).

• Content you create with us: tailored resumes, application answers, email and LinkedIn note drafts you edit, and the emails you send through our Gmail feature.

• Communication data: any information you share when you contact us, fill out forms, answer our questions (for example, "did you get a reply?"), or report a problem with a contact.

Information we collect when you use our services

• Usage information: how you interact with our website, web app and extension, such as pages viewed, jobs opened, saved and applied to, and buttons pressed.

• Device and log information: your IP address, browser and device type, and the time and outcome of each request to our servers.

• Usage records for abuse prevention: per-account request counts and IP addresses, which we use to rate-limit requests and to pause accounts that abuse the service.

• Chrome extension: when you ask the extension to fill a job application, it reads the form fields and questions on that application page and sends them, with the job title and company, to our servers so we can suggest answers from your profile. It may also note that you submitted an application so the job shows under Applied in your account. It does not read other pages you visit.

Information from Google, if you connect Gmail

If you choose to use "Send from your Gmail", we receive the email address of the Gmail account you connect and a permission (a "refresh token") that lets us send email from it. Details are in the "Google user data" section below.

Information about people at employers ("contacts")

To help job seekers reach hiring teams, we hold professional contact details about people who work at employers. This is described in "Information about people at employers" below.

⸻

2. How We Use Your Information

We use your information to:

• Evaluate your eligibility for our products or services

• Communicate with you regarding updates, access, or opportunities, including job alerts on WhatsApp and by email

• Show you jobs that match your profile and preferences

• Parse your resume, tailor it to a job, and help fill in job applications (including through the Chrome extension)

• Draft emails and LinkedIn notes to people at employers, and send emails you approve from your own Gmail

• Keep track of your applications and outreach so you can see them in one place

• Apply plan limits and allowances (for example, how many contacts you can unlock)

• Keep the service safe: rate-limit requests, detect and pause abusive accounts, and investigate misuse

• Improve our offerings and user experience

• Conduct internal analysis and research

• Comply with the law

We process your data for these purposes on the basis of the consent you give when you sign up and use each feature, and, where the DPDP Act allows, for legitimate uses such as keeping the service safe and complying with the law.

⸻

3. Get a human to see you (outreach)

"Get a human to see you" helps you reach a real person at the company you are applying to. Here is what happens to data at each step.

Unlocking a contact

• When you unlock a person, we show you their work contact details (see "Information about people at employers").

• We record which people you unlocked and when, so you can see them again and so we can count your allowance.

Verifying your WhatsApp number

• Unlocking a contact needs a WhatsApp-verified phone number.

• We send a 6-digit code to your number on WhatsApp, using Meta's WhatsApp Business Platform. Meta processes your number to deliver the message.

• We store a one-way hash of your number (a scrambled form that cannot be turned back into the number) plus its last 4 digits. We use these to check that the number is verified and to count your unlock allowance.

• Once your number is verified, we also save it as the WhatsApp number on your profile, which we use for job alerts. You can stop WhatsApp alerts at any time (see "Your Choices").

• Each verified number gets one free unlock for life. Paid plan limits apply after that.

• If you delete your account, we remove the link between your account and the number. We keep only the one-way hash with a count of free unlocks already used, so the same number cannot claim the free unlock again.

Drafting messages with AI

• Emails and LinkedIn notes are drafted by AI using your resume and profile, and the contact's job title and company. See "How we use AI".

• You can edit every draft before you use it.

Sending

• From your Gmail: if you connect Gmail, we send the message you reviewed and pressed Send on, from your own address, with the CV you chose attached. See "Google user data".

• Yourself: you can copy a draft and send it from your own email or LinkedIn. If you tell us you sent it ("I sent it myself"), we record that you did. We do not record the content of a message you sent yourself.

After you reach out

• Later we ask whether you got a reply. We store your answers to improve the suggestions we make.

• You can report a wrong email address or profile (for example, a bounced email, a broken profile link, a different person, or someone who has left the company). Our team reviews these reports.

⸻

4. Google user data (Send from your Gmail)

This section explains exactly what we do with data we receive from Google when you connect Gmail. It applies only if you choose to connect Gmail; everything else on Protocol works without it.

What we ask Google for

We request only these permissions ("scopes"):

• https://www.googleapis.com/auth/gmail.send — send email on your behalf

• openid and email — to learn which Gmail address you connected

We do not request permission to read, list, search, change or delete your emails, contacts, calendar or files.

How we use it

• We only send the message that you reviewed and pressed Send on, from your own Gmail address, with the CV you chose attached. It appears in your Gmail Sent folder and replies come to your inbox.

• We never read, list, modify or delete your emails.

• We use the Gmail address you connected to show you which account is connected and to send from it.

What we store

• Your connection: the Gmail address you connected, Google's identifier for that account, the permissions you granted, when you connected, and a refresh token. The refresh token is encrypted at rest and used only to send the emails you approve.

• A receipt of each send: recipient, subject, body, attachment name, time, and the message id Gmail returns. We keep it so you can see your sent messages on your Outreach page.

What we never do with Google user data

• We do not use it for advertising.

• We do not sell it.

• We do not transfer it to anyone else, except as needed to provide this feature (for example, storing it with our hosting providers) or to comply with the law.

• We do not use it to train AI models, and we do not send it to our AI provider: drafts are written before you send, from your resume and the job, not from your Gmail.

• Our staff do not read it, except with your consent, for security purposes (for example, investigating abuse), or to comply with the law.

Disconnecting and deletion

• You can disconnect Gmail at any time in the app, or at https://myaccount.google.com/permissions.

• If you delete your Protocol account, we revoke our access with Google and delete your Gmail connection, your send receipts, your drafts and your unlocked contacts.

• If you only disconnect Gmail, we delete the connection and the refresh token. Receipts of emails you already sent stay on your Outreach page until you delete your account or ask us to delete them.

Limited Use

Protocol Jobs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

⸻

5. How we use AI

• Emails and LinkedIn notes are drafted by AI from your resume and profile and the contact's job title and company.

• Resume parsing, resume tailoring and application autofill (including suggested answers in the Chrome extension) also use AI.

• AI output can be wrong. Please read every draft, tailored resume and suggested answer before you use it.

• Our AI runs in India. Under our AI provider's terms, the data we send is not used to train AI models. The provider may keep it for a limited time to monitor for abuse, as its terms describe.

⸻

6. Information about people at employers

This section is for people who work at employers, as well as for our users.

What we hold

For people at employers ("contacts"), we hold professional contact data: name as used at work, employer, job title, seniority, city, work email address and LinkedIn profile URL.

Where it comes from

We obtain it from a third-party B2B data provider and store it ourselves. The provider checks email addresses for deliverability.

How we use it

• We use it only so that job seekers can reach hiring teams about jobs at that employer.

• A contact's details are shown to a signed-in user only after the user unlocks that person.

• We do not sell contact data or use it for advertising.

If you are one of these people

You are a Data Principal too. You can ask us to correct your details or remove them at any time by writing to tanya.kapoor@protocoljobs.ai. When you ask, we remove you from the feature. Users can also report a wrong address or profile, and our team reviews these reports.

⸻

7. Data Sharing

We do not sell your personal data.

We may share your information only in the following cases:

• With trusted service providers who help us operate our services. They process data on our behalf and only for that purpose:

– Cloud hosting providers: Hosting our servers, web app, database and stored files (such as resumes)

– An AI provider (servers in India): AI drafting, resume parsing and tailoring, application autofill

– An email delivery provider: Sending our emails to you

– Meta (WhatsApp Business Platform): WhatsApp job alerts and verification codes

– Google (Gmail API): Sending emails you approve, if you connect Gmail

– A B2B contact data provider: Supplying and checking professional contact data

– An analytics provider: Product analytics, and session replay on a sample of sessions with sensitive fields masked (data stored in the EU)

– An error-monitoring provider: Error reports so we can fix problems, which may include a short screen recording around an error with all text masked

• When you ask us to. For example, when you send an email through Gmail, the recipient receives your message and the CV you attached.

• Contact details you unlock. A contact's work details are shown to the user who unlocked them (see "Information about people at employers").

• If required by law or to comply with legal obligations, or to protect the rights, safety and security of our users, the public or Protocol.

• If our business changes hands (a merger, acquisition or sale of assets), your data may move to the new owner, who must keep this policy's promises. Google user data moves only as Google's Limited Use rules allow.

⸻

8. Where Your Data Is Stored

Our servers, stored files, web app and AI all run in India. Some service providers may process data outside India, for example our analytics, error-monitoring, database and contact data providers. We transfer data outside India only as the DPDP Act allows.

⸻

9. Data Storage and Security

We take reasonable measures to protect your information from unauthorized access, misuse, or disclosure. These include encrypted connections (HTTPS), encryption of Gmail refresh tokens at rest, storing phone numbers used for verification only as a one-way hash plus last 4 digits, and rate limits on our servers. Only staff who need it can see personal data, through admin tools that require a sign-in with a role and log what each person does.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires.

⸻

10. How Long We Keep Your Data

• Your account and profile: while your account is open. When you delete your account, we delete your resumes, tailored documents, saved and applied jobs, activity, Gmail connection, send receipts, drafts and unlocked contacts, and remove your email address and details from your account record.

• After account deletion we keep: the one-way hash of a verified phone number with its count of free unlocks used (see "Verifying your WhatsApp number"), and aggregate usage counts that no longer identify you.

• Usage records and logs (request counts, IP addresses): up to 90 days for request counts and AI usage, and up to 180 days for extension activity, unless we need them longer to investigate abuse or the law requires it.

• Contacts' data: while it is current and the person has not asked us to remove it. We retire addresses that bounce or people who have left their employer.

• We may keep information longer where the law requires it.

⸻

11. Cookies and Similar Technologies

We use cookies and similar browser storage (such as local storage) to keep you signed in, remember your settings, and measure how our services are used. The Chrome extension stores your sign-in and settings in the browser's extension storage. You can clear these in your browser settings, but parts of the service may stop working.

⸻

12. Your Choices

You may:

• Request access to the data we hold about you, including a summary of what we process and who we have shared it with

• Request correction, completion, updating or deletion of your data

• Delete your account, by writing to us from your account's email address

• Disconnect Gmail in the app or at https://myaccount.google.com/permissions

• Opt out of communications at any time: use the unsubscribe link in any alert email, or tap "Stop updates" on any WhatsApp alert

• Withdraw any consent you gave us. This does not affect what we did before you withdrew it, and some features may stop working

• Nominate another person to exercise your rights if you die or become unable to do so

• Raise a grievance with us (see "Contact Us"), and if you are not satisfied with our answer, complain to the Data Protection Board of India

To do so, please contact us at the email below. We may need to confirm your identity before acting on a request. We reply within 7 days and resolve requests and grievances within 30 days.

⸻

13. Children

Protocol is meant for adults looking for work. We do not knowingly collect personal data from anyone under 18. You must be 18 or older to create an account. If you believe a child has given us their data, contact us and we will delete it.

⸻

14. Third-Party Platforms

Our services may integrate with or link to third-party platforms (such as LinkedIn, Google, WhatsApp, and employers' job application sites where the Chrome extension works).

We are not responsible for the privacy practices of these platforms. Their own privacy policies apply when you use them.

⸻

15. Updates to This Policy

We may update this Privacy Policy from time to time.

Any changes will be reflected on this page with an updated effective date. If we make a significant change, for example to how we use Google user data, we will tell you in the app or by email and, where the law or Google's policies require it, ask for your consent again before the change applies to you.

⸻

16. Contact Us

If you have any questions about this Privacy Policy or how your data is handled, or want to make a data request or raise a grievance, you can contact us at:

tanya.kapoor@protocoljobs.ai

Grievance Officer: Tanya Kapoor, tanya.kapoor@protocoljobs.ai

Postal address: PROTOCOL JOBS, C-199 Pushpanjali Enclave, Pitampura, New Delhi, India