Email Accounts

1. Why We Ask You to Connect Your Email

Job applications on SPAAN NOW are sent directly from your own email address, not from a SPAAN NOW address. This means employers see your real name and email in their inbox, replies come straight to you, and there is no middleman between you and the employer.

To make this possible, we need your permission to send emails on your behalf through your Gmail or Outlook account. We use the official OAuth 2.0 authorisation flow provided by Google and Microsoft — the same secure process used by thousands of apps worldwide. We never see, ask for, or store your email password.

2. How the Connection Works

When you tap 'Connect Gmail' or 'Connect Outlook', you are redirected to Google's or Microsoft's own sign-in page. You log in there (not on our site) and Google or Microsoft shows you the specific permissions we are requesting. You choose whether to grant them. If you do, Google or Microsoft issues us a set of tokens — digital keys that allow us to perform only the actions you approved.

At no point does SPAAN NOW receive your email password. The tokens we receive are limited to the permissions you granted and can be revoked by you at any time.

3. Permissions We Request

Gmail (Google)

When you connect a Gmail account, we request the following permissions through Google's OAuth consent screen:

• Send email on your behalf (gmail.send) — This allows us to compose and send job application emails from your Gmail address. We use this permission exclusively for sending job applications that you have authorised, either manually or through the Auto-Apply feature.
• View your email messages (read-only) (gmail.readonly) — This allows us to poll the delivery status of application emails we sent on your behalf, and to check for employer replies to your applications. We use this permission to provide the following features:
  • Application status tracking — Automatically detect whether an application was delivered, bounced, or received a reply. Your application status updates automatically based on employer responses.
  • Follow-up status — Know when an employer has responded to your application so you don't send unnecessary follow-ups, and track which follow-ups have been answered.
  • Suggested replies — When an employer replies, we analyse the message and suggest AI-generated response options tailored to the conversation, helping you reply professionally and promptly.
  • Interview detection — Automatically identify interview invitations in employer emails so we can prompt you to confirm your availability and track upcoming interviews.
  • Document request detection — Detect when an employer asks for additional documents (certificates, ID copies, etc.) and prompt you to upload and send them without leaving the platform.
  We do not read, scan, index, or store the content of any emails in your inbox outside of employer replies to applications. We do not access personal conversations, promotional emails, or any messages not related to your job applications.
• View your email address (email, profile) — This allows us to identify which email address you connected and display it in your settings.

Outlook (Microsoft)

When you connect an Outlook account, we request the following permissions:

• Send mail as you (Mail.Send) — This allows us to compose and send job application emails from your Outlook address. We use this permission exclusively for sending job applications that you have authorised.
• Read your mail (Mail.Read) — This allows us to poll the delivery status of application emails we sent on your behalf, and to check for employer replies to your applications. We use this permission to provide the following features:
  • Application status tracking — Automatically detect whether an application was delivered, bounced, or received a reply. Your application status updates automatically based on employer responses.
  • Follow-up status — Know when an employer has responded to your application so you don't send unnecessary follow-ups, and track which follow-ups have been answered.
  • Suggested replies — When an employer replies, we analyse the message and suggest AI-generated response options tailored to the conversation, helping you reply professionally and promptly.
  • Interview detection — Automatically identify interview invitations in employer emails so we can prompt you to confirm your availability and track upcoming interviews.
  • Document request detection — Detect when an employer asks for additional documents (certificates, ID copies, etc.) and prompt you to upload and send them without leaving the platform.
  We do not read, scan, index, or store the content of any emails in your inbox outside of employer replies to applications. We do not access personal conversations, promotional emails, or any messages not related to your job applications.
• Read your basic profile (User.Read) — This allows us to identify your email address and display name for your settings.
• Maintain access (offline_access) — This allows us to refresh your connection in the background so you don't have to reconnect every hour. Without this, your token would expire after roughly 60 minutes and you would need to re-authorise every time.

4. What We Do with Your Email Connection

We use your connected email account for the following purposes and no others:

• Send job application emails — When you apply for a job (manually or through Auto-Apply), the application email is composed on our platform and sent from your connected email account. The email includes your subject line, a short message body, and your CV, cover letter, and any other required documents as attachments.
• Confirm delivery — We check whether an application email was delivered or bounced, so we can update the status in your application tracker and alert you to any failures.
• Poll for employer replies on application threads only — After sending an application, we periodically check the specific email thread (identified by the unique thread ID and message ID of the application we sent) for new replies from the employer. We only look at messages within the application thread — we never scan your inbox broadly. This allows us to:
  • Detect employer replies and update your application status automatically
  • Generate AI-suggested replies to help you respond professionally
  • Identify interview invitations, document requests, and other important responses
  • Track follow-up status so you know when an employer has already responded
• Save to your Sent folder — Application emails sent through your connected account appear in your Sent folder, so you have a complete record of every application in your own email.

5. What We Will Never Do

We make the following commitments regarding your connected email account:

• We will never read your personal emails — not your inbox, not your conversations, not your promotions, not your social messages. We do not scan, index, analyse, or store the content of any email you receive or send outside of SPAAN NOW application threads.
• We will never scan your entire inbox — our email access is strictly limited to the specific threads that contain applications we sent. We identify these threads by the unique message ID and thread ID of each application we dispatched from your account.
• We will never send emails that you haven't authorised — every email we send is either a job application you initiated manually, or an automated application governed by your Auto-Apply settings (which you control and can disable at any time).
• We will never send marketing emails, spam, or promotional content from your account.
• We will never share your email credentials (tokens) with any third party, advertiser, or data broker.
• We will never use your email connection to track you across other services or websites.
• We will never modify, delete, or move any existing emails in your account.
• We will never access your contacts, calendar, Google Drive, OneDrive, or any other service beyond the specific permissions listed above.
• We will never read emails from threads we did not originate — if an employer emails you separately (outside the application thread), we do not access, read, or process that email.

6. How We Protect Your Credentials

The security of your email tokens is a top priority. Here is exactly how we handle them:

• Encryption at rest — Your access token and refresh token are encrypted using AES-256-CBC encryption before they are stored in our database. Even if our database were somehow compromised, the tokens would be unreadable without the application's encryption key.
• No password storage — We never receive or store your Google or Microsoft password. Authentication happens entirely on Google's or Microsoft's servers via OAuth 2.0.
• Minimal token exposure — Tokens are decrypted only at the moment they are needed (when sending an email or refreshing a connection) and are never logged, cached, or written to disk in plaintext.
• Automatic refresh — Access tokens expire after roughly one hour. Our system automatically refreshes them using the refresh token, so you stay connected without re-authorising. This happens server-to-server between SPAAN NOW and Google/Microsoft — your browser is not involved.
• Automatic cleanup — If a refresh fails (for example, because you revoked access through Google or Microsoft), we immediately mark the connection as expired, clear the stored tokens, and prompt you to reconnect. We do not retain expired or invalid credentials.
• Deletion on disconnect — When you disconnect an account from SPAAN NOW, we revoke the token at Google's servers (Google supports remote revocation) and then permanently delete it from our database. For Microsoft, we delete the token locally — you can additionally revoke from your Microsoft account.
• Deletion on account removal — If you delete your SPAAN NOW account, all connected email tokens are permanently destroyed within 30 days alongside all your other data.

7. Auto-Apply and Your Email

If you enable the Auto-Apply feature, SPAAN NOW will send job application emails from your connected account automatically when a matching job is found. Here is how this works and the controls you have:

• Match threshold — Only jobs that meet your minimum match score (which you set in your profile settings) are considered.
• Daily limit — You set a maximum number of applications per day (default: 5). We will never exceed this limit.
• Pause and resume — You can pause Auto-Apply at any time, either indefinitely or until a specific date.
• Unique messages — Each automated application email includes a unique, AI-generated message body tailored to the specific job and your profile. We do not send identical bulk messages.
• Document requirements — You can require that Auto-Apply only sends to jobs where you have all the necessary documents uploaded.
• No email if no mailbox — If you have not connected an email account, Auto-Apply will prepare your application but will not send it. You will be notified to connect your email or send it manually.

8. Monitoring and Tracking

We do not monitor your email inbox broadly. The only email activity we are aware of is:

• Application emails that we composed and sent through your connected account
• The delivery status of those specific emails (delivered, bounced, or failed)
• Replies from employers within the specific application threads we originated (identified by thread ID and message ID)

Our polling is strictly limited to checking for new messages within application threads we sent. When an employer replies within that thread, we use that reply to:

• Update your application status automatically (e.g., from "Submitted" to "Employer Replied")
• Generate AI-suggested replies so you can respond promptly and professionally
• Detect interview invitations, document requests, and other key employer communications
• Update follow-up status so you don't send unnecessary reminders after an employer has already responded

We do not track whether employers open your application emails, and we do not install tracking pixels, read receipts, or link-tracking in outgoing emails. We do not access or read emails outside of the application threads we originated.

9. How to Disconnect

You can disconnect your email account at any time through two methods:

• From SPAAN NOW — Go to your profile settings and tap 'Disconnect' next to your connected Gmail or Outlook account. This revokes the token at Google's servers (for Gmail) and permanently deletes it from our database.
• From Google or Microsoft directly — Visit Google Account Permissions or Microsoft Account Permissions and revoke SPAAN NOW's access. Our system will detect the revocation on the next refresh attempt and clear the invalid credentials.

Disconnecting your email account does not delete your SPAAN NOW account or any applications that have already been sent. It only removes our ability to send future emails from your address.

10. Data We Access vs Data We Store

11. Compliance

Google API Services — Limited Use Disclosure

SPAAN NOW's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We limit our use of Google user data to providing and improving user-facing features that are visible and prominent in our application's user interface. The features that use Gmail data are: sending job applications from your connected account, checking delivery status, detecting employer replies, generating AI-suggested replies (processed on our own server, not sent to any external service), and detecting interview invitations and document requests.
• We do not transfer Google user data to any third party — not to AI providers, advertisers, data brokers, or any other service. All processing of Gmail data occurs locally on our own servers using a self-hosted model. No Gmail data is transmitted to an external AI provider or cloud service.
• We do not allow humans to read Google user data unless (a) we have the user's affirmative agreement for a specific message (e.g. to assist with a support request the user initiated), (b) it is necessary for security purposes such as investigating abuse, or (c) it is required to comply with applicable law.
• We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
• We do not use Google user data to train, retrain, fine-tune, or improve any machine learning or artificial intelligence model, whether proprietary or third-party.

Other compliance

Our use of Microsoft Graph complies with the Microsoft API Terms of Use.

Our handling of your personal data, including email credentials, complies with the Protection of Personal Information Act (POPIA) of South Africa.

If you believe we have accessed or used your email account in any way not described in this policy, please contact us immediately at legal@spaannow.co.za.

12. Changes to Email Permissions

If we ever need to request additional permissions beyond what is described above, we will notify you in advance, explain why, and ask for your explicit consent again through the OAuth flow. We will never silently expand the scope of our access to your email account.