Privacy and data protection
CandidatePulse values your privacy. This policy explains how we collect, use, protect, retain, and delete your data, including explicit disclosures on Google API user data handling in compliance with Google API Services User Data Policy.
What this changes
CandidatePulse processes account identity (name, email), recruiter-managed candidate records, job mandates, email sequence delivery logs, connected mailbox authentication tokens (Google OAuth, Microsoft OAuth, and custom SMTP), and limited product milestones used to understand onboarding and activation.
When you connect your Google Workspace or Gmail account, CandidatePulse requests access to the https://www.googleapis.com/auth/gmail.send scope. This scope is used strictly and exclusively to send candidate follow-up emails that you configure and trigger within the recruitment pipeline. CandidatePulse does not read, access, or index your incoming inbox messages, and does not request any unnecessary permissions.
CandidatePulse does not share, transfer, disclose, or sell Google user data (including OAuth tokens, user email addresses, or email message content) to any third parties, external advertising platforms, data brokers, or AI model providers. Google user data is strictly used within the application to perform the email dispatching actions requested by the authenticated recruiter.
Google OAuth access and refresh tokens are encrypted at rest using AES-256-GCM encryption and are retained only for as long as your mailbox connection remains active. You can immediately revoke and permanently delete your Google account connection at any time by navigating to Settings > Mailbox Connection > Disconnect in the CandidatePulse application. Upon disconnection or account termination, all stored Google tokens are permanently and immediately purged from our databases. You can also revoke CandidatePulse access at any time through Google Account Security settings at https://myaccount.google.com/permissions.
CandidatePulse’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
CandidatePulse uses Google Analytics to measure visits, traffic sources, and aggregate geographic activity. Analytics storage is enabled by default, so analytics cookies may distinguish sessions and visitors and measure campaign attribution. You can disable analytics cookies from Analytics preferences in the website footer; after that choice, Google Analytics does not read or write first-party analytics cookies and receives only cookieless measurements such as page context, consent state, and browser-provided technical information for basic measurement and modeling. Advertising storage, advertising user data, and ad personalization remain denied. We do not send candidate names, candidate email addresses, recruiter notes, message subjects, or message bodies to Google Analytics.
Customer records are separated by authenticated account boundaries. Communications use TLS in transit, while sensitive mailbox credentials are encrypted at rest. For privacy questions or deletion requests, contact privacy@candidatepulse.com.
