Privacy Notice — ShortlistKiya
This notice explains what ShortlistKiya collects, how it's used, who it's shared with, and what control you have over it. It's written to describe what the product actually does, not a generic template — if something here changes, this file changes with it.
Last updated: 8 November 2026
Who operates this
ShortlistKiya is operated by Rajvinder Singh, trading as KCube Labs (a sole proprietorship). It is a career workspace: it helps you keep track of opportunities (recruiter emails, roles you capture or paste), understand how well they fit your experience, keep a record of evidence for your achievements, and create CVs tailored to the roles you want.
What data is collected
| Data | Collected when | Why |
|---|---|---|
| Email address, name and profile photo | You sign in with Google or a magic link | Identifies your account |
| Profile details (title, company, phone, LinkedIn URL) | You choose to add them in Settings | Personalises the workspace; all optional |
| Career preferences (directions, focus areas, availability) | You choose to add them | Tunes what the workspace emphasises for you |
| Your CV / Career Story | You paste it or upload a file | The basis for every score, evaluation and CV |
| Documents in your library (resumes, case studies, project write-ups, references) | You upload them, one by one or as a folder | The text is read and sorted so claims, your Master Career Story and gap-filling can draw on it; only the extracted text is stored, not the original file |
| Career notes (projects, ventures, career breaks) | You add them | Context a CV can't capture |
| Evidence sources and claims | You add material or ask ShortlistKiya to extract claims from your Career Story | So every CV line can be traced to something you confirmed |
| Job descriptions and opportunities | You paste them, evaluate them, or import them | To score fit and track your pipeline |
| Recruiter emails from Gmail | Only if you connect Gmail and choose emails to import | To turn recruiter conversations into opportunities |
| LinkedIn job listings | Only if you install the browser extension and capture a search page | To add roles to your "To review" list |
| Generated content (evaluations, rebuilt CVs, resume versions, cover letters, interview prep packs, reply drafts) | When you ask for them | So your work persists between visits |
| Account access status | When you sign up | New accounts are reviewed before they can use the workspace |
Not collected: no payment information (billing doesn't exist yet), no browsing data outside this app, no data about you from any other source. Everything in your account is something you put there or chose to import.
Gmail access
Connecting Gmail is optional. If you connect it:
- ShortlistKiya asks Google for read-only access (
gmail.readonly). It cannot send, delete, or change any email. - It reads your mailbox only when you search for recruiter or opportunity emails, or open one you imported. Only the emails you choose to import are saved, along with the text of their attachments where you ask for that.
- The access tokens Google issues are stored in the database and used only by the server. They are never sent to your browser.
- You can disconnect at any time, and you can also revoke access from your Google account's security settings.
ShortlistKiya's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Google Drive
Importing from Google Drive is optional. If you use it:
- ShortlistKiya asks Google for the narrowest Drive permission (
drive.file). It can open only the files you pick in Google's own file picker, nothing else in your Drive, and it does not change or delete anything there. - Each picked file is read once on the server. Its text is kept in your library (with a link back to the file); the original file is not stored.
- The access Google grants for this is short-lived and is not stored. Each time you import, you choose the account and the files again.
Notifications and email
- Weekly email (on by default): a short "Your career this week" summary of what needs you. Turn it off in Settings or with the one-click link in any email.
- Push notifications (off until you turn them on, per device): at most one morning alert when a follow-up or interview needs you. The notification contains only a short title and a link into the app. Turn it off in Settings or in your browser at any time.
Your own AI key (Infra-only plan)
If you choose to use your own Anthropic or OpenAI key, it is stored encrypted on our server, is never shown back to you or anyone else (only a short hint), and is used only to run your own AI requests. Those requests then go to your provider under your account and its terms. Remove the key any time in Settings.
The LinkedIn browser extension
The extension is optional. It runs in your own browser, using your own LinkedIn session. When you click its button, it reads the job listings already shown on your LinkedIn search page and sends them to your "To review" list. It does not browse, apply, message or connect on your behalf. It authenticates with a token you create in Settings; only a hashed form of that token is stored.
The free CV score
The public "Score my CV" page scores your CV inside your browser. The text you paste or the file you choose is not uploaded to ShortlistKiya or stored anywhere, and no AI service sees it. If you sign in and ask for an AI rebuild, the rules in the next section apply.
Student verification (Student plan only)
To buy the Student plan you upload one document: your student ID card or a fee receipt for this academic year, plus your college name and (optionally) course. It is stored in a private storage area that only the server can read, looked at once by the operator to confirm you are a current student, and deleted as soon as it is approved or rejected. We then keep only the outcome, your college, the dates and, if rejected, the reason, for one year (when the verification expires) or until you delete your account. You agree to this check with a tick box before uploading; you can choose the Pro plan instead if you'd rather not share a document. Deleting your account also deletes any document still waiting for review.
Campus Ambassador referrals
If you open ShortlistKiya through a campus ambassador's link or poster, a small cookie (sk_ref, 30 days) remembers which ambassador sent you. If you then create an account, your account is linked to that ambassador so they can be paid a fixed reward if you buy a plan. The ambassador sees only counts (scans, sign-ups, paid plans), never your name, email or anything in your workspace.
How it's used
Solely to provide your own workspace: scoring and evaluating opportunities, suggesting your next action, extracting claims for you to confirm, and generating CVs, resumes and reply drafts. Nothing here is used to train any AI model, and your data is never sold.
Who it's shared with
These services are involved in making the product work, each receiving only what it needs:
- Supabase (database and sign-in, hosted in Mumbai, ap-south-1) stores your account and everything listed above. Access is enforced at the database level (Row-Level Security), so your data is readable only by your own signed-in session, never by another user's.
- AI providers: Anthropic (Claude), OpenAI and Google Gemini. Writing and judgement work (evaluations, tailored CVs, cover letters, your Master Career Story, gap-filling and interview prep) goes to Anthropic first; quick tasks such as sorting an uploaded document go to OpenAI first. If one provider is unavailable the next is used automatically. The relevant text is sent by API: your CV or Career Story, confirmed claims, relevant passages from your library, the job description, and, for recruiter emails, the email text. This is a real disclosure of your content to third-party APIs, which is why it is named here. These providers do not use API data to train their models by default. ShortlistKiya may also use a self-hosted model operated by KCube Labs as a last-resort fallback.
- Google provides sign-in and, if you use them, read-only Gmail access and Google Drive import of the files you pick.
- Resend sends the sign-in (magic link) email. It only receives your email address.
- Cloudflare carries traffic between your browser and ShortlistKiya's server.
No data broker, advertiser or analytics network receives anything from this app.
Your control over your data
- Edit or replace your Career Story, notes, claims and preferences at any time.
- Edit any generated content before you download or use it.
- Disconnect Gmail at any time.
- Delete your account and all associated data via Settings. This permanently removes everything listed above and cannot be undone.
Retention
Your data is kept for as long as your account exists. There is no automatic expiry; deleting your account is how you remove it.
Security
Every table is scoped by Row-Level Security to your own authenticated session. This is enforced by the database, whatever the application code does. Database credentials, API keys and Gmail tokens are never exposed to the browser; all AI calls happen server-side.
Contact
Questions about this notice, or a request regarding your data (access, correction or deletion):
- Name: Rajvinder Singh (trading as KCube Labs)
- Email: [email protected] or [email protected]
- Phone: +91 98731 54007
This notice is published in good faith and will be updated as the product evolves, in particular once billing exists, which will add a payment processor to the list above.