Privacy Policy

Last updated: 19 September 2026. Farouk AI, published by Assam Sigoul, Paris, France

1. Data we collect

To provide the Farouk AI service, we collect the following data:

Email address and name: provided at sign-up, used for authentication and service-related communication.
Candidate profile and application answers: the CV you upload, the profile you confirm, and the answers you save for job application forms (desired salary, availability, contractual restrictions, work authorization). Diversity declarations (gender, disability status) are optional: only you enter them, they are used solely to answer these questions in the forms Farouk fills in for you, and you can delete them at any time. Ethnicity, religion, and veteran status are never collected; these questions receive “prefer not to say”.
OAuth data and integration tokens: when you connect third-party services (Instagram, Facebook, Stripe, and others), access tokens are collected and stored encrypted.
Usage logs: a history of the tasks that ran, the tools the agents used, and the results produced, for traceability and to improve the service.
Payment data: payment information is handled directly by Stripe; Farouk AI never stores card details.

2. How we use data

Your data is used solely to:

Provide the service: run your AI agents, remember your business context, send notifications and documents.
Improve the agents: analyse anonymously which kinds of task are used most, to make the agents more relevant.
Service communication: send you confirmations, security alerts, and important updates about your account.
Job alerts: send you, at regular intervals (once a week by default), new job offers matching your searches. Every email has a one-click unsubscribe link, and you can stop them at any time in Settings, Notifications.

We never sell your data to third parties.

3. OAuth and third-party integrations

When you connect third-party services through Farouk AI (Meta, Stripe, Google, Twilio, and others), the OAuth tokens and API keys you provide are:

Encrypted: access and refresh OAuth tokens are encrypted at rest with pgsodium in our database.
Used only: to carry out the actions you explicitly ask your agents to perform.
Revocable at any time: from the Settings page of your Farouk AI workspace, or directly with the third-party service.

4. Your mailbox data (Google, Microsoft)

Farouk AI does not ask the two providers for the same permissions. Here is exactly what is requested, and why.

Google (Gmail)

Send email on your behalf (gmail.send): to send job applications from your mailbox. You choose when a campaign starts and its volume; the application records the sending activity. This Gmail permission is used only for sending applications.

For new Gmail connections, we request only gmail.send to send applications, plus OpenID, email and basic profile for sign-in. Gmail mailbox reading is disabled in the current release. While that configuration is in effect, Farouk AI does not use Gmail message content.

Sharing, transfer and disclosure of Google user data

Google user data includes the account identity received at sign-in (such as your Google account ID, name and email address), the connected Gmail address, OAuth access and refresh tokens, and sending identifiers/status returned by Gmail. We share or disclose only the data needed for the purposes below. Service providers process it to operate Farouk AI; connecting Google does not authorise unrelated sharing.

Supabase — authentication and storage: Supabase processes Google sign-in identity and account/session data to authenticate you. It stores the connected Google email address, encrypted OAuth credentials and application-sending records in our database so your connection and application history work.
Railway and Vercel — application and website hosting: Railway hosts our API and processes the connected Google address, OAuth credentials and sending results to execute the Gmail features you authorise. Vercel hosts our website and processes the account/session information needed to display and operate your workspace. These providers support the service; your Google credentials are not given to recruiters.
Google, recruiters, employers and their recruitment platforms: When you start a campaign or authorise an application, our server sends the application through Google’s Gmail API. Google and the recipient mail services deliver it to the recruiter or employer selected for that campaign, which may use a recruitment platform (ATS). The recipient receives your sender name/email, application text and attached CV, including any Google-derived identity you use in the application. We do not give recipients your OAuth tokens or access to your mailbox.
Resend — service notifications: Resend receives your connected Gmail address or account email address and the content of service emails, such as account notifications and campaign summaries. This address may be the one received from Google sign-in. The production Gmail integration does not give Resend your Google OAuth tokens or read your Gmail inbox for this purpose.
Stripe — subscriptions and billing: If you subscribe, Stripe processes the account/billing email address and subscription identifiers needed for checkout, payment and subscription management. This may be your Google email address if you use it for billing. We do not provide Stripe with your Gmail OAuth tokens or mailbox content.
OpenRouter and its AI model providers — application preparation: OpenRouter and the model provider processing the request (for example OpenAI) receive the CV, candidate profile and job information needed to prepare an application. If you include or confirm your Google name or email in that profile, it may be included in this processing. Our current Gmail integration does not send Gmail inbox messages or Google OAuth tokens to these AI providers. We do not use Google user data to train general-purpose AI or machine-learning models.

Access by authorised Farouk personnel is limited to the service and permitted support/security needs. Human access to Google user data requires your explicit consent, a security or abuse investigation, or a legal obligation. We may disclose the minimum necessary data to competent authorities where required by law or for permitted security purposes. Any transfer of Google user data as part of a merger, acquisition or sale of assets requires your explicit prior consent.

We do not sell Google user data or share it with advertising platforms, data brokers or information resellers. We do not use it for personalised advertising, credit scoring or lending. Transfers are limited to the user-facing features you consent to and the security, legal or consented business-transfer exceptions above, in accordance with Google’s Limited Use requirements.

Microsoft (Outlook)

Read and organise your messages (Mail.Read, Mail.ReadWrite): for the two uses described below, and no others. The write permission is used only to move a message to the bin when you ask for it; permanent deletion remains impossible.
Send email on your behalf (Mail.Send): for your job applications, exactly as with Google.
1. Record application sending. Record applications sent and their sending status in the app. This record does not provide access to Gmail mailbox messages.
2. The inbox assistant (a paid feature you switch on). Farouk AI goes through messages received in the last 2 days, sorts them by importance and drafts replies for you. Nothing is ever sent without your approval. We do not go through your archives, and we do not index your mailbox.

What we keep, and for how long. For the Outlook messages we process, we keep the sender, subject, excerpt, summary and suggested reply for up to 30 days, with a daily deletion pass. Application history keeps sending records and status; it does not require reading replies in your Gmail inbox. Google connection credentials are kept while the connection is active, subject to the disconnect and deletion process below.

The AI model. In the current release, AI generation uses the CV, profile and public job listings you provide, not Gmail mailbox content. For Outlook, message content may be sent to our language-model provider, OpenRouter (see section 5), to classify a message and draft a suggested reply. We do not use your data for advertising, resale or training general-purpose AI models.

No human being reads your messages, except with your explicit consent, for security reasons, or where the law requires it.

You can cut off access whenever you want. The “Disconnect” button is in Settings → Connections. In that operation, Farouk AI asks Google or Microsoft to revoke access and attempts to delete the stored connection tokens and mailbox-derived records, without waiting for the 30 days. If a service error prevents cleanup, contact support to complete it. You can also withdraw access from your Google account permissions page.

Limited Use commitment (Google API Services User Data Policy)

Farouk AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Farouk AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Hosting and international transfers

Your data is hosted with the following providers:

Supabase (database, file storage)EU: data stored in Europe, GDPR-compliant.
Vercel (website)USA: member of the EU-US Data Privacy Framework.
Railway (application server)USA: GDPR-compliant through standard contractual clauses (SCCs).
OpenRouter (language models)USA: processes CV/profile and job information for application generation and, when the Outlook assistant is enabled, Outlook message text. The Google-data sharing limits in section 4 apply. Provider retention depends on the applicable service terms; we do not promise immediate deletion by the provider.

6. Protecting your data

Data taken from your mailbox is sensitive. These are the technical and organisational measures that protect it.

Encryption in transit: Data in transit between your browser, our website and our servers uses HTTPS/TLS. The site enforces HTTPS with HSTS.
Token encryption at rest: Google and Microsoft OAuth access and refresh tokens are encrypted at rest in the database with pgsodium, a PostgreSQL encryption extension.
Per-account isolation: Row-level security (RLS) limits workspace records to the relevant workspace. Browser-facing database permissions exclude credential fields; our application server accesses tokens only to provide the connected feature.
Private files: CVs, invoices, quotes and contracts are stored per workspace in a private bucket. They can only be opened through a signed link valid for one hour; no public address to these files exists.
Automatic deletion: content taken from your mailbox (sender, subject, excerpt, summary, suggested reply) is deleted after 30 days by a daily purge that runs every night at 03:30 UTC.
Disconnect and revocation: Disconnect asks Google or Microsoft to revoke access and attempts token and mailbox-record deletion in the same operation. If a service error prevents cleanup, contact support to complete it.
AI request configuration: For applicable AI requests, we include the provider parameter “data_collection: deny”. This request setting does not change a provider's own retention terms.
Data breach: should a breach affect your data, we notify the supervisory authority within 72 hours and inform you without delay where the risk is high, as required by articles 33 and 34 of the GDPR.

7. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights over your personal data:

Right of access: obtain a copy of all the data we hold about you.
Right to rectification: correct inaccurate or incomplete data.
Right to erasure: ask for your data to be deleted (the “right to be forgotten”).
Right to portability: receive your data in a structured, machine-readable format.

To exercise these rights, write to us at contact@farouk.app. We reply within 30 days at the latest.

8. Cookies

Farouk AI uses only technical session cookies, strictly necessary for the platform to work (authentication, keeping you signed in). We use no advertising cookies, no third-party trackers, and no behavioural analytics. If you arrive through an ambassador's link, a cookie keeps their promo code for 30 days to apply it at checkout, and the code is linked to your account.

9. Contact

For any question about this privacy policy, or to exercise your rights, contact the data controller:

Assam Sigoul, Paris, France
Email: contact@farouk.app

The French version of this document is the binding one. Other languages are courtesy translations.