Privacy Policy

1. What we collect

Account information

Your name, email, phone number, and preferred language. If you are an organization, also: the company/organization name, its location, and its website.

Candidate profile

Your CV (PDF or image), the skills we auto-extract from it, work experience, certifications, languages, salary expectations, and availability.

Applications & references

The vacancies you apply to, your answers to application questions, and the references you add (names, phone numbers, email addresses, recommendation letters).

Messages

The content of the messages you send inside the platform to employers or candidates.

Technical data

IP address, browser type, operating system, and access logs. These are needed for security and to detect abuse.

2. How we use it

• Run the platform and deliver its core features.
• Match candidates with suitable vacancies based on skills, language, and location.
• Send notifications related to your application or vacancy (status update, new message, vacancy closed).
• Improve the product using aggregated, anonymized usage statistics.
• Comply with legal obligations and respond to valid authority requests.
• Detect and prevent fraud or abuse.

3. AI processing of CVs

When you upload a CV, we process it with an AI model to extract skills, past roles, language level, certifications, and country/city. The extracted results are saved in your profile, and you can edit or delete them manually.

We do not use your CV content to train public AI models, and we do not share it with AI providers outside the scope of this specific extraction step.

4. Who sees your data

Your public profile

Some details (your first name, city, headline skills, and languages) may appear to other users if you mark your profile as "open to work". Sensitive details (phone, email, the CV PDF) are only revealed after you apply to a specific vacancy.

The employer you applied to

When you apply, the employer sees your full CV, your answers, and your references. Withdrawing your application removes their access to new files, but they may retain an older copy for as long as the application was under review.

Bev staff

A limited number of support staff can access your data only when necessary to resolve a support ticket or investigate a Terms violation. All staff are bound by strict confidentiality.

5. Third-party services

We rely on trusted technical providers to run the platform:

• File storage: Yandex Cloud Object Storage (Russia region) for uploaded CVs.
• Database: secure, encrypted servers that host account data, applications, and messages.
• Email delivery: a transactional email provider for verification and notification emails.
• AI processing: for CV data extraction.

All providers are contractually bound to protection standards no lower than those set in this Policy.

6. Google integrations (Calendar, Meet & Gmail)

Bev offers two optional Google integrations, each connected separately from the “Integrations” page. Employers can connect Google Calendar so we can schedule interviews on their behalf, automatically generate Google Meet links, and show their busy times when they pick a slot. Job seekers can connect Gmail so their job applications are sent from their own email address. Both are entirely optional, and no other part of the platform requires them.

Google Calendar & Meet: what we request

• googleapis.com/auth/calendar.events.owned: to create, update, and cancel interview events on calendars you own. We only use your primary calendar.
• googleapis.com/auth/calendar.freebusy: to see only when you are busy or free, so we can warn you about conflicting interview slots, without seeing the details of your events.
• openid, email, profile: to identify the linked Google account.

Google Calendar & Meet: what we do with the data

• Create an event on your calendar when you schedule an interview, and attach the candidate and a Google Meet link.
• Read only your busy times so we can warn you about conflicts when picking an interview slot. We do not read other events’ contents or titles for this.
• Display your current-week events inside the Bev dashboard for your eyes only. We do not persist these events on our servers.
• Update or delete the corresponding event on your calendar when you reschedule or cancel the interview in Bev.

Gmail: what we request

• googleapis.com/auth/gmail.send: to send job applications from your Gmail address on your behalf. This permission can only send email; it does not let us read, search, change, or delete anything in your mailbox.
• openid, email: to identify the linked Gmail address.

Gmail: what we do with the data

• When you click “Send now from my Gmail” on a job, we send one application email from your Gmail to the application address published on that job, with your CV attached or linked.
• If you turn on Automatic apply (it is off by default and asks for your separate consent), we send applications from your Gmail to new jobs that match you, within a daily limit and a limit per employer address. You can turn it off at any time.
• The recipient is always taken from the job on our servers, so this feature cannot be used to email anyone else, and we never send marketing or any email other than your job applications from your Gmail.
• We keep a record of each application email we send (recipient address, subject, date, which CV was attached, and the Gmail message ID) so you can see your sent applications in Bev. A copy of every email also stays in your Gmail “Sent” folder.
• We never read, search, modify, or delete the emails in your mailbox.

Google API Services User Data Policy: Limited Use disclosure

Bev’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to both Google Calendar and Gmail data. Specifically:

• We use Google Calendar and Gmail data only to provide the features you have turned on: interview scheduling with Meet, and sending your job applications from Gmail.
• We do not transfer Google user data to third parties except as necessary to provide these features, to comply with applicable law, or with your explicit consent.
• We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.
• No human at Bev reads your Google user data except when you give us explicit consent for support, for security, for legal compliance, or when the data has been aggregated and anonymized for internal operational use.

Storage, encryption, and revoking access

OAuth tokens received from Google (access token and refresh token) are stored encrypted at rest in our database using AES-256-GCM with an authentication tag, and are only decrypted in memory when an actual Google API call is made. We request the minimum scopes necessary to operate the feature and never request broader scopes.

You can disconnect Google Calendar or Gmail at any time from the “Integrations” page inside Bev, at which point we delete the tokens from our database and call Google’s token-revocation endpoint. Disconnecting Gmail also turns off Automatic apply; applications already sent stay in your Gmail “Sent” folder. You can also review and revoke Bev’s access directly from your Google account at myaccount.google.com/permissions.

7. Storage & security

We apply reasonable technical and organizational measures to protect your data: transport encryption (HTTPS), disk-level encryption for uploaded CVs, and least-privilege access controls internally.

That said, no transmission or storage method is 100% secure, and we cannot promise absolute protection. In the event of a breach affecting your data, we will notify you within the timeframe required by law.

8. Retention & deletion

We retain your data while your account is active. When you delete your account, your personal information and CV are erased within 30 days, except for:

• Accounting or tax records that the law requires us to keep.
• Records of Terms violations, to prevent repeat abuse.
• Certain automated backups that rotate out within 90 days.

9. Your rights

At any time you may:

• Access a copy of your personal data.
• Correct any inaccurate information in your profile.
• Delete your account or specific files (e.g. your CV).
• Withdraw consent for processing (some features may become unavailable).
• Export your data in a portable format.

To exercise any of these rights, email us at info@bevsr.com. We'll respond within 30 days.

10. Cookies

We use essential cookies to run your login session and remember your preferences (language, theme). We also use anonymized analytics tools to understand how the platform is used and improve it, without building an advertising profile on you.

You can disable cookies from your browser settings, but some features may stop working correctly.

11. Children

Bev is not intended for anyone under 16. If we discover an account belonging to a minor, we will delete the data as soon as possible.

12. Changes to this policy

We may update this Policy as the platform evolves or legal requirements change. Material changes will be announced in advance by email or inside the app.

13. Contact

For any question about your privacy, email info@bevsr.com or visit the Contact Us page.