1. Who we are; contact
SubmitX is a product of YEMYEL (OPC) Private Limited, the controller for most personal data processing described in this Policy.
Company: YEMYEL (OPC) Private Limited
Address: 10/280-106 Sai Rajeswari Colony, Proddatur, 516360
Phone: +91 8639576755
For questions about data handling, contact us via our Contact page.
2. Scope
This Policy covers personal data processed via:
- The SubmitX website and web application
- AI job application automation (AI Apply)
- Smart recruiter reply drafting
- Resume builder and job search features
- Marketing communications (where you have opted in)
3. Data we collect
- Account & contact data: name, email, country, preferences, and authentication data (via Clerk).
- Job-search materials: resumes/CVs, cover letters, job descriptions, role preferences, and application content.
- AI Apply data: prompts, drafts, submissions, application content, and mailbox metadata when you connect Gmail.
- Technical/usage data: device, browser, IP address, event logs, and diagnostics.
- Marketing preferences: opt-ins, unsubscribes, and consent records.
4. How we use data; legal bases
- Provide and secure the Services — contractual necessity and legitimate interests.
- AI Apply automation — contractual necessity: we perform automated ranking, selection, and form-filling at your direction when you enable auto-submit or approve queued submissions.
- Smart recruiter replies — contractual necessity: we draft replies based on your context and preferences.
- Improve reliability & abuse-prevention — legitimate interests: we may use aggregated, de-identified telemetry (e.g., error rates, anonymised patterns).
- Marketing — consent or soft opt-in where permitted; legitimate interests for corporate subscribers.
- Compliance, security and fraud prevention — legal obligations and legitimate interests.
5. AI model providers; processing
When you request AI-generated content (e.g., a tailored resume or recruiter reply), we send the minimum necessary prompt data to our AI model provider(s). We use Claude Opus 4.6 and instruct providers not to use prompts or outputs to train their models. Returned content is stored in your account only as long as you keep it or as needed to deliver the feature.
6. Automated decision-making (AI Apply)
If you enable auto-submit or approve a queued submission, we perform automated ranking, selection, and form-filling at your request to execute your instructions. This automates tasks you would otherwise perform manually. It does not produce legal or similarly significant effects about you. To avoid automated submissions, keep Review Mode enabled and decline submissions you do not want sent.
7. "As-provided" transmission; restricted data
Application data is transmitted to third-party platforms (job boards, employer forms) as provided by you; we do not redact or mask fields on your behalf. Avoid including payment-card data, bank details, government ID numbers, health data, or other special-category data unless a form explicitly requests it and you choose to provide it.
8. Mailbox retention (Gmail connection)
When you connect Gmail for recruiter reply features, we process mailbox data to draft replies and track conversations. Mailbox metadata is retained for the duration of your account and for a limited period after disconnection for backup and recovery. You may disconnect Gmail at any time from your dashboard.
9. International transfers
We host primarily in cloud infrastructure that may span multiple regions. Where data is transferred outside the UK/EEA, we use Standard Contractual Clauses or another lawful mechanism to ensure adequate protection.
10. Sharing
We do not sell or rent personal data. We share personal data with: (i) service providers acting on our instructions (hosting, analytics, email delivery, AI model providers, payment processors such as Paddle); (ii) third-party platforms where you direct us to submit applications; (iii) authorities where required by law; and (iv) parties necessary to protect rights, enforce our terms, or detect and prevent fraud or abuse.
11. Cookies & similar technologies
We use cookies and similar technologies to operate and improve the Services (e.g., session authentication, preferences, analytics). You can manage preferences via your browser settings. We use Clerk for authentication, which may set its own cookies.
12. Marketing; consent records
We only send marketing to individuals with consent or where soft opt-in applies. We maintain records of consent (who, when, how, what you were told). Every marketing message includes an easy way to unsubscribe.
13. Data retention (summary)
- Account data: life of the account; key logs up to 12 months; security logs up to 24 months.
- Resumes and application content: until you delete them or close your account; backups purge within 30 days after primary deletion unless required by law.
- Mailbox data: retained while Gmail is connected and for a limited period after disconnection; then deleted.
14. Your rights (UK/EEA & similar)
You may request access, correction, deletion, restriction, objection, or portability, and withdraw consent at any time. Contact us via the Contact page. You may complain to a supervisory authority (e.g., UK ICO or your local data protection authority). We encourage you to contact us first so we can try to resolve your concern.
15. Security
We implement reasonable technical and organisational measures (access controls, network protections, encryption where appropriate). No method is infallible; we cannot guarantee absolute security.
16. Children
The Services are not directed to those defined as minors in your jurisdiction. If you believe a child has provided us with personal data, contact us immediately so we can delete it.
17. Complaints
You have the right to lodge a complaint with your local data-protection authority. In the United Kingdom this is the Information Commissioner's Office (ICO). We encourage you to contact us first so we can try to resolve your concern.
18. Changes to this Policy
We may update this Policy; we will post changes with a new "Last updated" date. Where required by law, material changes will be accompanied by additional notice or consent.
19. Third-party links
We are not responsible for the content or privacy practices of external sites we link to. When you leave our site, you are subject to their privacy policies.