Privacy Policy

1. Who is responsible for your information

Zephy is an independent service operated by Sohail Gsais in the United Kingdom. Sohail Gsais is the data controller for the personal information described in this policy. “Zephy”, “we”, “us”, and “our” refer to that service and its operator.

Questions and data-protection requests can be sent to support@sohailgsais.com.

2. Information we collect

Account and identity information

Your name, email address, email-verification status, authentication records, and account settings. Passwords are handled as protected authentication credentials rather than stored in readable form.

Job-search and CV information

Job applications, company and role details, statuses, notes, job descriptions, timeline activity, uploaded CV files, structured CV content, tailoring instructions, generated CV versions, and related metadata. CVs may contain information you choose to provide about your employment, education, skills, location, and other personal circumstances.

Gmail information

If you choose to connect Gmail, Zephy requests read-only Gmail access. It checks messages for job-search updates and stores limited message information such as sender, sender email, subject, date and time, a short snippet, Gmail message identifiers and links, matching results, and your linking or ignore choices. Zephy does not store full email bodies.

We also store your connected Gmail address, granted permissions, synchronisation state, and an encrypted refresh token so that requested monitoring can continue. Connecting Gmail is optional and can be disconnected from Zephy.

Zephy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Billing and transaction information

Stripe processes payment-card and billing-address information. Zephy receives and stores transaction references, payment status, currency, amount, tax amount, and Search Pass entitlement records. We do not receive or store complete card details.

Technical and usage information

Security, session, rate-limit, and service logs may include IP address, browser or device information, request time, identifiers, and error information. We also store your selected light or dark theme locally in your browser and in a cookie.

3. How and why we use information

Zephy does not sell personal information and does not use Gmail information for advertising.

4. AI processing

When you request AI CV tailoring, the relevant job description and CV content are sent to OpenAI’s API to generate the requested result. Zephy validates the returned structure and stores the tailored version and generation metadata in your account. Do not include information that is unnecessary for the tailoring request.

AI output can be incomplete or inaccurate. You remain responsible for reviewing generated content before using it in an application. Zephy does not make hiring decisions or send applications to employers on your behalf.

5. Service providers and disclosures

We use service providers where necessary to operate Zephy, including:

• Amazon Web Services for hosting, database, file storage, encryption, and service email.
• OpenAI for user-requested CV tailoring.
• Google for optional Gmail access and OAuth authorisation.
• Stripe for checkout, payments, tax calculation, and payment-risk controls.
• Cloudflare Turnstile for registration abuse and bot protection when enabled.

We may also disclose information where required by law, to protect users and the service, or as part of a future business transfer subject to appropriate safeguards and notice.

6. International transfers

Some providers may process information outside the United Kingdom. Where UK data-protection law treats this as a restricted transfer, we rely on an adequacy regulation or contractual safeguards made available by the relevant provider, together with appropriate security measures.

7. Retention and deletion

Account and job-search information is generally kept while your account remains active and for as long as needed to provide Zephy. Billing and transaction records may be retained for longer where required for tax, accounting, disputes, fraud prevention, or legal obligations. Security logs are retained only for a proportionate operational period.

Disconnecting Gmail revokes or removes Zephy’s ongoing access token and stops future syncs. Previously stored message metadata remains part of your Zephy records until it is deleted or you request deletion. To close an account or request deletion, email support@sohailgsais.com. Residual copies may remain briefly in backups or where retention is legally required.

8. Your rights

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase, restrict, or object to processing of your personal information, and to receive certain information in a portable format. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing.

Send requests to support@sohailgsais.com. We may need to verify your identity. You may also complain to the UK Information Commissioner’s Office.

9. Security, children, and changes

Zephy uses access controls, encrypted connections, protected credentials, and provider security features intended to reduce risk. No online system can guarantee absolute security.

Zephy is intended for people aged 18 or over and is not directed to children. We may update this policy as the service changes. Material changes will be communicated in the service or by email where appropriate, and the date above will be updated.