Stazh

Privacy Policy

Last updated 29 October 2026

Stazh helps students and new graduates reach people directly. Doing that means handling your CV, your Gmail account and the contacts you research, so this page sets out exactly what we collect, why, and what you can ask us to do about it.

01Who we are

Stazh is operated by the Stazh team (“we”, “us”, or “our”), based in Milan, Italy. We are the data controller for the personal data described here.

For anything in this policy, write to team@stazh.io.

02What we collect

  • Account details. Your email address, and a password if you create one. If you sign in with Google, we receive your name, email address and profile picture from Google.
  • Your CV and profile. Documents you upload and the structured details we extract from them (education, experience, coursework), so drafts can be written from your actual background. If your CV states your date of birth we extract that too, and we ask for it during setup if it does not: we use it only to check that you are 16 or older (section 12), never in an email. You can remove your photo and date of birth from the file before uploading it. If you add your LinkedIn link, we look that profile up in the business-contact database (section 5) and add the roles it returns to your profile.
  • Campaign and outreach data. The companies and contacts you research, the drafts written for you, what was sent, and which emails you have marked as replied.
  • Gmail access tokens. When you connect Gmail, we store the refresh token needed to send email on your behalf, and the Gmail message and thread IDs of the emails Stazh sent, so a reply you write from Stazh stays in the same conversation.
  • Billing data. Subscription status and credit balance. Card details are handled by Stripe and never reach our servers.
  • Technical data. Basic logs needed to operate and secure the service.
  • Problem reports. When you report a problem from the app, what you write, the last steps and requests the app recorded (listed in the report before you send it), the agent conversation open at the time, and a screenshot of the page if you add one. The screenshot is shown to you first, and you can remove it before sending.
  • The launch draw. If you take part in the draw on our homepage, the result of your draw and a salted, one-way hash of your network address, so each network gets one draw. We do not keep the address itself. If you claim a free month, the claim also records your account, a normalised copy of your email address and the network hash, so each person and network can claim once. That record stays, without the link to your account, if you delete your account, for the same reason. All of it is deleted 90 days after the draw closes.
  • Usage and source. Anonymous page-view statistics (which pages are visited, the referring site, country, device and browser), and, when you sign up, where you first found us: the referring site and any campaign tags in the link you followed.

03Google user data

This section governs wherever Google data is concerned, and takes precedence over anything more general in this policy.

  • What we ask Google for. Your name, email address and profile picture, to create your account. Separately, and only when you choose to connect Gmail, one Gmail permission: send email on your behalf (gmail.send). Signing in with Google does not grant it. We do not ask for, and cannot use, any permission to read, search, change or delete the email in your mailbox.
  • How we use it. The send permission is used only to send the emails you write or approve in Stazh (outreach to the people you chose, the follow-ups you scheduled, and replies you write from your Stazh inbox), from your own Gmail address. Because Stazh cannot see your inbox, you mark a conversation as replied yourself, and follow-ups to that person stop.
  • What we store. Your name, email address and profile picture, the Gmail refresh token, and the Gmail message and thread IDs of the emails Stazh sent. Tokens are kept server-side and never reach the browser.
  • Who it is shared with. Google user data is not sold, not used for advertising, and not shared with anyone except the processors that host the service (Supabase and Vercel, section 6). It is never used to train AI models, ours or anyone else’s. No person at Stazh reads it unless you ask us to, it is needed for security or to comply with the law.
  • Nothing is sent from your account without you approving that message, or without you having explicitly set a campaign you created to send on its own (its follow-ups only, or its opening emails too).
  • Stazh’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
  • You can revoke Stazh’s access at any time from your Google Account (myaccount.google.com/connections), which stops all sending immediately, or write to team@stazh.io and we will delete your stored tokens.

04Why we process it, and on what basis

  • To provide the service: performance of our contract with you. Finding companies, researching contacts, writing drafts, sending and following up.
  • To take payment: performance of a contract, and a legal obligation for tax records.
  • To keep the service secure and working: our legitimate interest in preventing abuse and diagnosing faults.
  • To contact you about your account: legitimate interest. Marketing email, if we ever send it, is consent-based and always unsubscribable.
  • To find and write to the people our users choose: legitimate interest (Article 6(1)(f) GDPR): our users’ interest in finding work, and ours in providing that service. We weighed it against the interests of the people contacted: we use only professional details about their current role, the emails are individual and written to them about that role, and anyone can object at any time (section 5).

05If you received an email sent with Stazh

Stazh finds people two ways. It searches a third-party business-contact database (Apollo) for professional details such as name, role, employer, work email and public profile link. And it reads what a company publishes about itself on its own website (the home, about and careers pages), honouring that site’s robots.txt. We do not scrape LinkedIn. Where profile information appears, it reached us through the contact database above.

What we hold about a person contacted: those professional details, the emails sent to them through Stazh, and whether the sender marked them as replied. If the sender turned on open tracking, the email carries a small invisible image that records when it was opened; if the sender turned on click tracking, its links pass through stazh.io to record when they were clicked. Neither sets a cookie or records anything else about you.

You can object at any time. Reply to the sender asking not to be contacted, or write to team@stazh.io, and we will make sure you are not emailed through that sender’s Stazh account again. You can also ask us what we hold about you, or for it to be deleted.

06Who we share it with

Only processors who need it to run the service, each under contract and none of them permitted to use your data for their own purposes:

  • Supabase: database, authentication and file storage.
  • Vercel: application hosting and anonymous page-view statistics (Vercel Web Analytics, which sets no cookies).
  • OpenAI: the AI behind Stazh. It reads your CV and any cover letter or writing samples into your profile and writing voice, runs the setup chat when you join and the agent chat after that, researches companies and the people you look up, writes your drafts, follow-ups, CVs and cover letters, and answers the questions typed into the FAQ on our homepage. Under OpenAI’s API terms, what we send it is not used to train its models; OpenAI keeps API inputs and outputs for up to 30 days to monitor for abuse, then deletes them. Your CV goes to it as the whole file, so a photo in it goes too (section 2).
  • Apollo: business contact lookup, and the LinkedIn profile you link to your own account.
  • Google: sign-in and Gmail sending.
  • Stripe: payments.

Two kinds of request leave your browser for other services as the app draws a page. Where the app shows a company’s logo, it is loaded from Google’s public favicon service, which receives that company’s web address and, as with any web request, your network address and browser details. Where it shows a contact’s photo, the picture is loaded from LinkedIn’s image servers (media.licdn.com), which receive the same. We do not copy either; your browser fetches them directly.

We do not sell personal data, and we do not share it for advertising.

07International transfers

Our hosting providers, Supabase and Vercel, are United States companies. They store and process our data in their Tokyo region, under the EU Standard Contractual Clauses included in our agreements with them. OpenAI and Apollo are also in the United States; transfers to them rest on the Standard Contractual Clauses in their agreements and, where the provider is certified under it, on the EU-US Data Privacy Framework. Google and Stripe act under their own EU-facing terms and the same instruments.

08How long we keep it

  • Account and campaign data: for as long as your account exists.
  • After you delete your account: erased within 30 days, except where we must keep something longer by law, and the launch-draw claim record described in section 2, which is deleted 90 days after the draw closes.
  • Gmail tokens: deleted when you delete your account or ask us to; revoking access in your Google Account makes them unusable immediately.
  • Details of people contacted: kept while the account that contacted them exists, and deleted with it or when the person asks. Search results from the contact database are deleted after 30 days.
  • Billing records: kept for up to 10 years to meet statutory tax and accounting obligations.
  • Usage statistics: the record of what the service was used for (sign-ups, emails sent, credits spent and the like) is kept after you delete your account, with your account identifier removed from it, apart from the single entry recording that the account was deleted. A one-way hash of the fingerprint Stripe assigns your payment card is kept so that a card cannot start a second free trial (our legitimate interest in preventing abuse); it cannot be turned back into the card.

09Your rights

Under the General Data Protection Regulation (EU GDPR and UK GDPR), you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time.

Write to team@stazh.io and we will respond within one month. If you are unhappy with the outcome, you have the right to lodge a complaint with your local supervisory authority (in Italy, the Garante per la protezione dei dati personali).

10Security

Data is encrypted in transit and at rest. Access to production systems is restricted and authenticated. Gmail refresh tokens are stored server-side and are never exposed to the browser. No system is perfectly secure, and we will tell you and the relevant supervisory authority without undue delay if a breach affects you.

11Cookies

We set only what the service needs, all of it first-party:

  • Sign-in cookies (set by our authentication provider, Supabase) that keep you signed in.
  • stazh-locale: the interface language you chose, kept for a year.
  • stazh-plan and stazh-billing: the plan and billing period you picked on our homepage, so the plan step after signing up starts on them. Kept for 30 days, and cleared once you choose.
  • stazh_src: the site or campaign link that first brought you here, kept for 90 days and read only when you sign up.
  • stazh_promo: if you take part in the launch draw, the id of your draw ticket, kept for 14 days. Page scripts cannot read it.
  • stazh_gmail_connect: while you connect Gmail, a cookie of up to 10 minutes that matches Google’s answer to your request.

Your browser’s own storage (localStorage and sessionStorage), not a cookie, remembers a few things about the interface — your light or dark theme, the width of the sidebar and inbox panels, a lock key that keeps the sidebar open for the tab, and whether you have dismissed the tutorial or the draw — all strictly necessary for the page and never sent to us. There are no advertising or cross-site tracking cookies, which is why you are not asked to dismiss a banner. The open and click tracking in emails sent with Stazh sets no cookies (section 5).

12Age

Stazh is for people aged 16 and over. If we learn we hold data on someone younger, we will delete it.

13Changes

If we make a material change we will email account holders and update the date at the top of this page before it takes effect.