Privacy

Who we are

K2LAB PTE. LTD. (UEN 202020387G), of 138 Robinson Road, #26-01 Oxley Tower, Singapore 068906, a company incorporated in Singapore, operates expressautomate.app. We are the organisation responsible for the personal data described here. Reach us at [email protected] about anything on this page, including a request to see, correct or delete your data.

Where we are today

Mailbox ingestion is not running. No email has been read from any account, no job records exist, and no message text has been sent to an AI model. Signing in is built; reading mail is not. We say this because a policy describing ingestion in the present tense would misrepresent what we hold — which today is your sign-in identity, and nothing more.

What we collect when you sign in

Signing in with Microsoft gives us, from your Microsoft account:

• your email address or user principal name;
• your display name, where Microsoft supplies one;
• your Microsoft object id and your organisation’s tenant id — identifiers we use as the durable key for your account, so that renaming your mailbox address updates your record instead of creating a second one;
• the time you last signed in;
• a refresh token, held encrypted, which is what would later let us read mail on your behalf if you connect a mailbox.

If you submitted an email address to the early-access form before sign-in existed, we still hold that address and the page it came from. Ask us and we will delete it.

Mailbox data, when you connect one

Connecting a mailbox is a separate, explicit step, and a separate permission from signing in. We request Mail.Read only. We cannot send, modify or delete your email; that permission is never requested and never granted. When ingestion is switched on:

• we read messages from the connected mailbox and store them, including sender, recipients, subject, body and attachments;
• we send message text to an AI model to extract recruitment details — vacancies, companies, requirements — and store what it extracts alongside the evidence it drew on;
• we never discard the original email. Every extracted field keeps the wording it came from, so any record can be traced back to its source, and so an extraction can be checked rather than trusted.

Mail in a recruitment mailbox contains other people’s personal data — candidates, clients, colleagues. Where we process that, we do so on your instructions and on your organisation’s behalf. You remain responsible for having a lawful basis to hold it and to have it processed by us.

Who else processes it

We do not sell personal data, and we do not use it to train AI models. We rely on:

• Microsoft — identity, and the Graph API your mail would be read through.
• Koyeb — hosting for the application and the managed PostgreSQL database where your data is stored.
• OpenRouter — routing message text to the AI models that perform extraction. Relevant only once ingestion is running. OpenRouter is a router, so the model provider it forwards a request to also receives that text. We would rather name the arrangement than let “we use OpenRouter” imply the text stops there.
• Cloudflare — DNS for expressautomate.app.

If you need to know the specific region our database runs in for a compliance review, ask and we will tell you rather than leave you to infer it.

How your data is kept apart, and how it is protected

Every business record carries the identity of the agency it belongs to, and that separation is enforced in the database itself through row-level security — not only in application code, where one missed condition would be enough to leak. One agency cannot read another’s records.

Refresh tokens are encrypted at rest with a key held outside the database, and traffic to and from the service is encrypted in transit. To be precise rather than reassuring: other stored fields, such as your name and email address, are protected by the database’s access controls and our host’s disk encryption, not by application-level encryption of each field.

Cookies

Every cookie we set is functional: one recording that you are signed in, and short-lived ones that hold a sign-in in progress and are discarded when it completes. None is readable by scripts in your browser and none is shared with anyone. There is no advertising or analytics cookie on this site, which is why you have not been shown a consent banner — we have nothing to ask you to consent to.

How long we keep it

Retention periods for mail and extracted records are not set yet, and we would rather say so than publish a period we have not decided. We will publish them here before ingestion is switched on for anyone. Account data is kept while your account exists; ask us to delete it and we will.

Your choices

• Disconnect at any time. Revoke our access from your Microsoft account and we can no longer read anything.
• Ask what we hold. Under Singapore’s Personal Data Protection Act you may ask for access to your personal data and for it to be corrected. If you are in the UK or EU, you may also have rights to erasure, portability and objection. Email us and we will act on it — we will not require a particular form of words.
• Complain. If we have not resolved something, you may complain to Singapore’s Personal Data Protection Commission, or to your local supervisory authority.

Changes

When this policy changes materially we will change the date at the top and tell account holders by email. We will not change it quietly and rely on your having re-read it.