Controller and contact
The service provider shown as Zeravo acts as the data controller for Zeravo account and product data. Privacy requests can be sent to [email protected].
Google, Stripe and the companies receiving an application may act as separate controllers for their own services and legal duties.
Information we process
- Account: email, name, password hash or Google account identifiers.
- Career profile and CV: target roles, city, work preferences, uploaded documents, builder content and document checks.
- Applications: target company, corporate contact, message, attached CV, scheduled deliveries, reply classification and delivery errors.
- Zeravo Mail: the envelope recipient, sender, company, subject, time, plain-text content and attachments received by your personal
@apply.zeravo.appaddress. Raw HTML is not displayed directly. - Email connection: sender address, Gmail send permission and an encrypted OAuth refresh token. An encrypted app password may be stored only when the legacy connection method is selected. Zeravo does not request your normal Google password.
- Billing: plan, subscription state and Stripe references. Full card details do not reach Zeravo.
- Security: IP address, browser, session and audit records.
Purposes and legal grounds
Information is used to create and secure the account, store and check CVs, match selected targets, run workflows you start, stop follow-ups after replies or bounces, manage subscriptions, prevent abuse and provide support.
The legal ground may include contract performance, legal obligations, legitimate interests in security and fraud prevention, and consent where required.
Sharing
Your name, sender address, message and CV are sent to the corporate address selected within an application you start. Necessary data may also be processed by Google, Stripe, hosting, storage and email providers, professional advisers and competent authorities.
Some providers may process data outside Türkiye or the EEA under applicable transfer rules and safeguards.
Automation and document checks
CV checks evaluate text-based structure such as contact details, headings, dates, bullet use and measurable outcomes. They are not a hiring decision or job guarantee.
Application automation operates only within the categories, documents, templates, sender and limits you select. Reply or bounce detection can stop remaining follow-ups.
Google API data use
Zeravo requests only the Gmail send scope and does not request inbox-reading access. Use and transfer of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Google API data is not sold or used for advertising. It is used only to perform a Gmail send action initiated by the user and deliver the message to the recipient selected by that user.
Retention and deletion
Account, profile, CV, application and Zeravo Mail records are kept while needed to provide the service. When paid access ends, the personal address and message history remain assigned to the account while message content and attachments are locked until paid access resumes. After a valid deletion request, data that is no longer required is deleted or anonymised, while billing, security and dispute records may be retained for mandatory periods.
Disconnecting Gmail removes the encrypted OAuth refresh token or legacy app password from the active connection and attempts to revoke Google access.
Security
Zeravo uses HTTPS, access controls, HttpOnly session cookies, password hashing, encryption for OAuth refresh tokens and legacy app passwords, signed Stripe webhooks, file checks and administrator audit records. No internet service can promise zero risk.
Your rights
Depending on the law that applies to you, you may request access, correction, information about purposes and recipients, deletion or restriction where conditions are met, objection to automated analysis and a copy of relevant information. Send requests from the registered account email with a clear subject.
Cookies and choices
Necessary session and OAuth security cookies are used. Analytics and advertising storage remain denied until the user grants the relevant consent. See the Cookie Policy.