Kattia (“we”, “us”) is a job-search CRM operated by Kattia Technologies Limited. This policy explains what personal data we collect, why we collect it, and the rights you have over it. It applies to kattia.io and app.kattia.io.
1. Data we collect
We collect data you provide directly, data generated by your use of the product, and data from integrations you authorize:
- Account data: email address, name, password hash (via Supabase Auth) or OAuth identifier (Google).
- Profile data: job target, current role, location, resume text or file you upload.
- Application data: companies, roles, statuses, notes, attachments, timeline events you create or import.
- Google integration (optional): if you connect Google, we access read-only Gmail message metadata and bodies, and read-only Google Calendar events from your primary calendar, to surface interviews in your pipeline. We never send email as you.
- Billing data (if you subscribe): subscription status and last-4 card digits (Stripe is the processor; we never see full card numbers).
- Usage data: page views, feature interactions, and errors, via our analytics providers (PostHog and Google Analytics). We mask form inputs by default.
2. How we use it
- To operate the product: pipeline tracking, AI features, Gmail synthesis, calendar events.
- To process payments and manage subscriptions.
- To understand usage and improve the product.
- To send transactional email (welcome, billing, account-related notifications).
- To respond to support requests you send us.
We do not sell your data. We do not use your application content to train public AI models.
3. Processors we use
- Supabase — database and authentication (US/EU regions).
- Stripe — payments.
- OpenAI (via our LLM gateway) — AI text processing. Content you send to AI features is transmitted to the model provider for processing; our gateway does not store prompts or outputs on its own systems.
- Google — OAuth and, if you authorize it, Gmail read and Calendar events read scopes.
- Resend — transactional email delivery.
- PostHog — product analytics and error capture.
- Google Analytics — anonymous traffic analytics across kattia.io and app.kattia.io. Until you accept the cookie banner it runs in a consent-denied mode: it records that a page was viewed, without cookies, identifiers, or anything stored on your device. Accepting enables cookie-based analytics; declining keeps the cookieless mode.
- Vercel — hosting and request logs.
4. Google user data and Limited Use
Kattia’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, for the gmail.readonly and calendar.events.readonly scopes:
- We use Google user data only to provide and improve the user-facing features described in this policy — matching job-related email threads and interview events to the right application in your pipeline.
- We do not transfer Google user data to third parties, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition.
- We do not use Google user data for advertising, and we do not sell it.
- We do not allow humans to read Google user data, unless we have your explicit consent for a specific message, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified.
- Google user data is not used to train generalized or public AI models. Where an AI feature processes the content of an email you have connected, it is sent to our model provider for processing and used only to produce your result; our gateway does not store it on its own systems.
You can disconnect Google at any time from account settings, and you can revoke Kattia’s access directly from your Google account permissions page.
5. Retention
We retain account and application data for as long as your account is active. Billing records are retained for 7 years to meet tax obligations. Gmail content and synced calendar events are fetched on demand and stored only as needed to render the app; you can disconnect Google at any time from account settings.
6. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data. To exercise any of these rights, email privacy@kattia.io. We respond within 30 days.
EU/UK residents: our legal basis for processing is (a) contract, for account and billing data; (b) legitimate interest, for analytics and product improvement; (c) consent, for the analytics cookie banner.
California residents: you have the right to know what we collect, the right to delete, and the right not to be discriminated against for exercising these rights.
7. Cookies
We use strictly necessary cookies where needed for basic operation of this site. Analytics cookies (PostHog and Google Analytics) are optional and set only after you accept via the cookie banner. Before you accept, Google Analytics still records anonymous page views without setting cookies or identifying you. To withdraw consent, click the button below or clear cookies for this site in your browser.
8. Security
We encrypt data in transit (TLS 1.2+) and at rest. Row-level security policies enforce user-level isolation on the database. Webhooks are signature-verified. See our Securitypage for more detail.
9. Beta-specific notes
Kattia is currently in beta. During the beta period, we may delete test data, change features, or take the service offline for maintenance with limited notice. We may also run limited testing cohorts for specific features or periods. Feedback you submit may be quoted (anonymously) in public product updates.
10. Changes to this policy
We will update the “Last updated” date when we change this policy. Material changes will be announced by email to active users.
11. Contact
Privacy inquiries: privacy@kattia.io.
General support: support@kattia.io.