Privacy Policy

What we access

• Your Google account email address and basic profile, to create your account.
• Messages in your Gmail that match a recruiting filter. The filter is evaluated by Google before anything is sent to us. It searches the last 90 days and looks like this:

  newer_than:90d -in:chats -in:sent -from:me -category:social -category:forums -from:accounts.google.com -from:no-reply@google.com -from:noreply-accounts@google.com (from:(recruit OR recruiter OR recruiting OR talent OR hiring OR careers OR jobs OR staffing) OR subject:(role OR opportunity OR opening OR position OR hiring OR interview OR candidate) OR "job description" OR "job opportunity" OR "compensation package" OR "we are hiring" OR "would you be open" OR from:linkedin.com OR from:e.linkedin.com OR from:inmail-hit-reply@linkedin.com OR from:invitations@linkedin.com OR from:messages-noreply@linkedin.com OR from:messaging-digest-noreply@linkedin.com OR from:jobs-noreply@linkedin.com OR from:jobs-listings@linkedin.com)

• Evidence you choose to connect: public profiles (GitHub, Code4rena, Sherlock, Immunefi, Cantina), a CV you upload, a LinkedIn export you upload, and your Slack profile if connected.

We collect product usage analytics with PostHog to improve the service. It records which steps are used, not CV or email content, and stores the data in the US region.

What we never receive

• Any mail outside the filter. It is never transmitted to us.
• Personal, financial, medical and legal mail; chats, social and forum mail; attachments.
• We hold read-only Gmail access. We cannot send, delete, label or file anything in your mailbox.

What we store

• For matching mail: sender, subject, a short preview, and the reasons it was surfaced. We assess fit internally to decide what to show you; we show you the reasons, never a numeric score.
• Message body text only for the small number of messages we assess as most relevant and show in Signal.
• For mail assessed as "cold", we store no email headers at all.

Who can see it

Every stored message is restricted to the account that synced it by row-level security in the database. No one can read your mail through this product, including us — our operator console has no read access to mailbox data.

Certus IQ staff hold administrative database access, as any operator of a hosted service does. It is restricted and we do not use it to read user mail.

Your control

• Disconnect Gmail at any time. Disconnecting revokes our access and erases every synced message, reply and Gmail-sourced lead from our database immediately.
• "Delete all synced mail" erases the same data while keeping the connection.
• You can request deletion of your whole account by emailing certus-iq-privacy@enish.com.

Google API Services User Data Policy

Certus IQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not sell this data; we do not use it for advertising; we do not use it to train generalised AI or machine-learning models; and humans do not read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

Profiles built from public work

We build career records for people working in web3 from public sources (audit reports, contest leaderboards, public repositories). These are never visible to any third party and are never contacted except to invite the person to claim or remove the profile.

If you want to claim or remove a profile, use the link in our email or visit the claim or removal page.

Retention

Account data and evidence you choose to connect are kept while your account is active. Everything derived from Gmail is deleted when you disconnect Gmail or delete all synced mail. Public-profile records are kept until the person requests removal.

Who controls your data

The data controller for this service is enish, inc. You can reach us about anything on this page at certus-iq-privacy@enish.com.

If you are in the EU or the UK, you may write to us at the same address, and you have the right to complain to your national data protection authority.

Contact

For privacy questions, access or deletion requests, email certus-iq-privacy@enish.com.