Our Privacy Policy

1. Introduction

Arya by Mentoria is a job automation platform developed and owned by Mentoria Pvt. Ltd. ("we", "our", or "us"). This Privacy Policy outlines how we collect, use, store, and disclose your personal information when you interact with our services through:

• Arya Web Application: https://app.agent.mentoria.com
• Arya Marketing Site: https://agent.mentoria.com
• Arya Browser Extension: "Arya by Mentoria" for Google Chrome
• Any other related services owned by Mentoria Pvt. Ltd.

By using Arya by Mentoria, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide to Us

When you interact with Arya, we collect the following information:

• Account Information: Your name, email address, and profile details from Google when you log in using Google OAuth
• Resume/CV Content: Uploaded files or resume data you generate using our tools
• Job Preferences: Target roles, industries, locations, and related career details
• Email Communications: Complete content of job application emails created and sent via the platform (subject, body, attachments)

2.2 Information Collected Automatically

We collect certain data automatically as part of platform usage:

• Usage Data: Features used, actions taken, session duration, and interaction logs
• Email Engagement Metrics: Open rates, link clicks, CV downloads (collected via tracking pixels and redirected URLs)
• Performance Analytics: Application success rates, response times, and engagement patterns

2.3 Gmail Data Access & Limited Use Compliance

IMPORTANT: Google API Services User Data Policy Compliance

With your explicit OAuth consent, we access limited data from your Gmail account exclusively for job application automation:

What We Access:

• Gmail Send Scope: To send personalized job application emails from your account using your email address
• Gmail Readonly Scope: To read responses ONLY within job application email threads that we initiated

What We DO NOT Access:

• Your personal emails, inbox content, or any emails outside job application threads we created
• Emails unrelated to job applications sent through our platform
• General mailbox browsing or email search capabilities

Data Usage Restrictions:

• Gmail data is used exclusively for job application automation and tracking
• We implement thread-bounded access - only reading specific threads where we sent the original application
• No Gmail data is shared with third parties except as required for core platform functionality
• All Gmail access can be revoked at any time from your Google account settings

Privacy Protection:

• We use surgical access methods to ensure maximum privacy
• Only job application threads initiated by our platform are accessed
• No broad email scanning or general inbox access

Google API Services Limited Use Compliance:

Arya by Mentoria's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.4 Arya Browser Extension

Our Chrome browser extension, "Arya by Mentoria," fills job application forms for you using your Arya profile and resume. It never submits an application: you review every application and press Submit (or "Apply", or Internshala's "Find me opportunities") yourself.

Where It Works:

• LinkedIn, Indeed, Internshala and Lever. The extension loads on pages of these sites, and acts only on their job pages and application forms (on LinkedIn, Easy Apply; on Internshala, also Internshala's own resume-builder and preferences pages)
• Workday career sites (*.myworkdayjobs.com and *.myworkdaysite.com), only if you turn on "Workday autofill" in the extension. You can turn it off at any time
• It does not read your browsing history, your other tabs, or any other website

What It Reads on Those Pages:

• The job posting: its title, company and description
• The application form's questions, fields and answer options

What It Sends, and to Whom:

• The job site you are applying on: the extension enters your profile details and attaches your resume in that site's application form, so the site receives them as part of your application, under its own privacy policy
• Arya's servers (api.arya.mentoria.com): to load your profile, resume and saved answers into the form. Answers you enter, or that Arya fills in, are saved to your Arya account automatically, so a repeated question is answered instantly next time. An answer you typed yourself is never overwritten by one Arya filled in. A record of each application (the site, whether it finished, and how many fields were filled or missed) is also saved to your account
• Arya's AI answer service (also api.arya.mentoria.com): for open-ended questions such as "Why do you want to join us?", the question, its answer options, any length limit, and the job posting's title, company and description are sent to Arya's AI answer service. The extension does not send your profile: Arya's servers draft a first-person answer from the profile already stored in your Arya account, using our AI provider, Google Gemini. The provider receives this data only to draft the answer
• Sign-in (tigfyfhqyfqlgadpyodo.supabase.co): keeps you signed in to your Arya account
• If you signed in on arya-staging.mentoria.com (our staging site), the same requests go to arya-api-staging.mentoria.com and kjhxpspufejwxaaxocet.supabase.co instead
• Install attribution (api.arya.mentoria.com, arya.mentoria.com):
  • On install from the Chrome Web Store, the extension opens the Arya sign-up page once. The link carries tags (utm_source=chrome_web_store) so we know you came from the store. The sign-in and sign-up links in the popup and the widget carry the same kind of tag (utm_source=chrome_extension)
  • When you are signed in, the extension tells Arya's servers a random install ID, the extension's version, whether it came from the store, and, if the extension saw its own installation, when it was installed. This lets us count how many accounts use the extension and how many stay active. The ID is made on your browser, is not derived from you or your device, and a reinstall gets a new one. Nothing else about your browser or device is sent
  • When you remove the extension, Chrome opens an Arya page that counts the removal. The page's address carries the same random install ID, the version and how many days the extension was installed. The page asks you for nothing. If you had signed in, the install ID lets us connect the removal to your account's install record
• Nothing else: the extension uses no third-party analytics, advertising or tracking services

What It Keeps in Your Browser (Extension Storage):

• Your sign-in session
• A copy of your profile, fetched again from your account once it is more than 5 minutes old, and removed whenever you sign in or out
• The answers you have given, so repeated questions fill instantly, and a record of which answers are already saved to your account, so they aren't sent twice. Both are cleared when a different account signs in
• The job posting you last opened on a supported site (title, company and description), so its application pages can name the job and use it for AI answers
• Fingerprints (never the text) of AI answers written for a specific job, so they are not reused for another job
• Counts of which supported job sites showed an embedded application form, used only for troubleshooting
• Your extension settings, such as Workday autofill on or off and whether the widget is shown
• A random install ID, when the extension was installed or first ran and its version then, and which Arya account it was last linked to, used only for the install attribution above

Your Control:

• Your data is never sold. Apart from the job site you apply on, it is shared only with our AI provider, and only to draft your answers
• You can delete saved answers from your Arya profile, sign out of the extension, turn off Workday autofill, or uninstall the extension at any time. Signing out removes the sign-in session from your browser

AI-Generated Answers (Google Gemini):

Arya uses the paid tier of the Google Gemini API. Under Google's paid-tier terms, the information Arya sends to Gemini is not used by Google to train or improve its models.

Chrome Web Store Limited Use:

Arya by Mentoria's collection and use of data through the browser extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data accessed through the extension is used only to provide and improve the autofill features described above, and the random install ID is used only to count installs as described under Install attribution. None of it is sold, and none of it is used for advertising or any purpose unrelated to the extension's single purpose of assisting you in completing job applications.

3. How We Use Your Information

Your data enables us to:

• Send Job Application Emails: Send personalized job application emails to recruiters and employers using your Gmail account and email address
• Deliver, manage, and improve our job automation services
• Customize and optimize your CV and email applications
• Track the outcomes of applications (e.g., opens, replies, clicks)
• Generate analytics to improve application success
• Ensure platform stability and security
• Provide customer support and respond to inquiries
• Comply with legal obligations and prevent fraudulent activity

Data Minimization: We only collect and process data necessary for these specified purposes.

4. How We Share Your Information

4.1 With Service Providers

We may share your data with third parties who help operate Arya, such as:

• Cloud Infrastructure: Secure hosting and data storage (AWS, Google Cloud Platform, Render.com)
• Email Delivery: Gmail API for sending job application emails
• AI Processing: Google Gemini API, used to generate suggested answers to custom job application questions in the browser extension
• Analytics: Platform usage and performance monitoring (internal analytics systems)
• Security Services: Fraud detection and platform security (internal security systems)
• Database Services: PostgreSQL (hosted on cloud infrastructure)
• Cache & Session Management: Redis (for rate limiting and session management)

These providers are contractually bound to safeguard your information and use it solely to deliver their services.

4.2 With Your Consent

We may share data in ways you explicitly authorize, such as:

• Sending job application emails to recruiters and employers
• Sharing your resume with potential employers through our platform

4.3 Legal Disclosures

We may disclose information when required by:

• Law enforcement or legal process
• Protection of rights, property, or safety of our users
• Prevention of fraud or illegal activities
• Compliance with applicable laws and regulations

4.4 Business Transfers

If Arya or Mentoria Pvt. Ltd. is involved in a merger, acquisition, or reorganization, your information may be part of the transferred assets, subject to the same privacy protections.

5. Data Security & Encryption

We employ comprehensive security measures including:

• Authentication: Google OAuth 2.0 with secure token management
• Encryption: AES-256 encryption for sensitive data at rest
• Transmission: TLS encryption for all data in transit
• Access Control: Role-based access with principle of least privilege
• Rate Limiting: Comprehensive rate limiting (15 job applications/day, technical safeguards)
• Monitoring: Real-time security monitoring and audit trails
• Vulnerability Management: Regular security assessments and updates

Token Security: Gmail refresh tokens are encrypted using industry-standard encryption with secure key management. While we follow industry best practices, no system can be guaranteed to be 100% secure. Use of the platform is at your own risk.

6. Your Privacy Rights

6.1 General Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccuracies in your information
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit certain processing activities
• Objection: Object to processing based on legitimate interests
• Portability: Request export of your data in a structured format
• Withdraw Consent: Revoke consent for data processing at any time

6.2 Gmail-Specific Rights

• Revoke Gmail Access: Disconnect Gmail integration through your Google Account settings at myaccount.google.com
• Data Deletion: Request deletion of all Gmail-related data by emailing arya@mentoria.com
• Access Information: Request information about Gmail data access patterns by emailing arya@mentoria.com

To exercise any of these rights, contact us at: arya@mentoria.com

7. Email Tracking & Monitoring Disclosure

Arya uses built-in tracking features within job application emails to provide application performance insights:

• Tracking Pixels: Detect when emails are opened by recipients
• Link Tracking: Monitor click-throughs on links and attachments
• CV Download Counters: Track when resumes are downloaded via platform-generated links
• Response Detection: Monitor recruiter responses within job application threads

Transparency: All tracking serves legitimate business purposes (application analytics) and is disclosed to users. No tracking data is shared with third parties for marketing purposes.

8. Data Retention & Deletion

We retain your information to provide our services and comply with legal requirements. However, you have complete control over your data:

Your Control Over Data:

• Immediate Deletion: Email us at arya@mentoria.com to request deletion of any or all of your data
• Data Export: Request a copy of your data by emailing arya@mentoria.com
• Gmail Access Revocation: Disconnect Gmail access instantly through your Google Account settings at myaccount.google.com
• Processing Timeline: All deletion requests processed within 30 days
• What We Delete: Account data, resumes, job applications, email content, analytics data, and all personal information
• Confirmation: We'll confirm completion of your deletion request via email

Automatic Data Management:

• Gmail Tokens: Automatically deleted when you revoke Gmail access
• Account Closure: All data deleted within 30 days when you close your account
• Legal Compliance: Some data may be retained longer only when required by Indian law

9. Children's Privacy

Our platform is not intended for children under the age of 16. We do not knowingly collect personal information from children. If we learn that data has been collected from a child without verified parental consent, we will delete it promptly and take steps to prevent future collection.

10. Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Essential Cookies: Enable core platform functionality
• Analytics Cookies: Understand platform usage patterns
• Performance Cookies: Monitor and improve platform performance

You can control cookie settings through your browser preferences. Disabling certain cookies may affect platform functionality.

11. Data Management & User Control

Google OAuth Compliance: You have complete control over your data and Gmail access.

Gmail Access Management:

• Revoke Anytime: Disconnect our app's access to your Gmail through your Google Account settings at myaccount.google.com
• No Self-Service Required: Google provides native revocation - no additional features needed from our platform

Data Deletion Process:

• Email Support: Send deletion requests to arya@mentoria.com
• What We Delete: Account data, resumes, job applications, email content, analytics data
• Timeline: All deletion requests processed within 30 days
• Confirmation: We'll confirm completion of your deletion request via email

Data Export:

• Request Process: Email arya@mentoria.com to request a copy of your data
• Format: We'll provide your data in a structured, readable format
• Timeline: Export requests fulfilled within 30 days

Support Contact: For all data management requests, email arya@mentoria.com

12. Data Protection Officer & Contact

For privacy-related inquiries, you can contact our Data Protection team at:

Support: arya@mentoria.com

Address: 505, 506, Kshitij, Veera Desai Rd, opposite Sports Complex, Azad Nagar, Andheri West, Mumbai, Maharashtra 400053

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. All changes will be posted on this page with the updated effective date.

Notification: For material changes, we will notify users via email or prominent platform notice 30 days before the changes take effect. Continued use of the platform after changes constitute acceptance of the revised policy.

14. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.

Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: arya@mentoria.com

Address: 505, 506, Kshitij, Veera Desai Rd, opposite Sports Complex, Azad Nagar, Andheri West, Mumbai, Maharashtra 400053