Privacy Policy
1. Who We Are
Kambulo is an AI-powered job application platform that helps job seekers track applications, generate cover letters, practice interviews, and optimize their job search.
Data Controller:
Mikail Odabas, handelend onder de naam Kambulo
Registered with the Dutch Chamber of Commerce (KvK): 42063317
VAT (BTW) number: NL005467811B08
Website: https://kambulo.com
Contact: support@kambulo.com
2. What Data We Collect and Why
2.1 Account Data
Data: Email address, name, password (encrypted)
Why: To create and manage your account
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: Until you delete your account
2.2 Google Account Data (if you sign in with Google)
Data: Google account ID, name, email address, OAuth access token and refresh token
Why: To authenticate you and to sync your Gmail inbox if you choose to enable it
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: Until you disconnect your Google account or delete your Kambulo account
2.3 Job Application Data
Data: Company names, job titles, locations, job URLs, application status, salary information, notes, AI-generated analysis (match scores, strengths, gaps, insights)
Why: To provide the job tracking and AI analysis features
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: Until you delete the job entries or your account
2.4 CV / Resume Data
Data: Full CV text content, uploaded CV files (PDF, DOCX, TXT), AI-extracted skills and structured data
Why: To provide CV analysis and cover letter generation features
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: Until you delete your CV or your account
2.5 Personal Voice Profile
Data: Your career motivation, career direction, core values, personal work stories, writing tone preferences, what makes you unique as a candidate
Why: To generate cover letters that authentically reflect your voice and personality
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: Until you delete your profile or your account
2.6 Email Data (Gmail integration — optional)
Data: Email subject lines, email bodies, sender and recipient addresses (from, to, CC, BCC), email timestamps, read status, Gmail thread IDs, attachments metadata
Why: To help you track recruiter communications linked to your job applications
Legal basis: Your explicit consent (Article 6(1)(a) GDPR) — you must actively connect your Gmail account
Retention: 90 days after you disconnect your Gmail account. You can request earlier deletion at support@kambulo.com
2.7 Sent Emails (Pro feature)
Data: Cover letter content, recipient email address, subject line, delivery status, send timestamp
Why: To send cover letters on your behalf and track delivery
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: 90 days after sending, after which email body is deleted and only metadata (sent date, status) is retained
2.8 Interview and Call Logs
Data: Company name, contact name, interview date, type, notes, review
Why: To help you track your interview pipeline
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: Until you delete the entries or your account
2.9 Preferences and Settings
Data: Salary preferences, work location, preferred industries, job types, remote work preferences, company size preferences, notification settings
Why: To personalize your job search experience
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Retention: Until you delete your account
2.10 Subscription and Billing Data
Data: Subscription tier, subscription status, Stripe customer ID, billing period dates
Why: To manage your subscription and enforce feature access limits
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
Note: Payment card details are processed and stored exclusively by Stripe. Kambulo never sees or stores your card number.
Retention: 7 years after subscription ends (legal financial record-keeping obligation)
2.11 AI Usage Data
Data: Number of AI requests made per month per user
Why: To enforce fair usage limits per subscription tier
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — preventing abuse and managing costs
Retention: 12 months rolling
2.12 Technical Data
Data: IP address (for rate limiting), session tokens, error logs
Why: To secure the platform and diagnose technical issues
Legal basis: Legitimate interests (Article 6(1)(f) GDPR)
Retention: 30 days for logs, session tokens expire on logout
3. AI Processing
Kambulo uses artificial intelligence to power several features. Here is exactly what data is sent to which AI provider:
| Feature | Data sent to AI | AI Provider |
|---|---|---|
| Job analysis | Job posting text (from URL you submit) | Google Gemini |
| Cover letter generation | Your CV content, Personal Voice profile, job details | Anthropic Claude |
| Interview practice | Your responses during practice sessions | Anthropic Claude |
| CV parsing | Your CV text or uploaded file content | Anthropic Claude |
Important notices:
- All AI-generated content (cover letters, analysis, feedback) is clearly labeled as AI-generated
- AI outputs are suggestions only — you should review all content before using it
- Kambulo does not use AI to make hiring decisions about you
- Anthropic retains API inputs/outputs for up to 30 days for safety monitoring, after which they are deleted
- Google Gemini data processing is governed by Google's Cloud Data Processing Addendum
4. Who We Share Your Data With
We share your data only with the following sub-processors, each bound by data processing agreements:
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway (railway.app) | Hosting, database (PostgreSQL), queue (Redis) | EU — Amsterdam, Netherlands |
| Stripe | Payment processing, subscription management | EU (with EU data residency) |
| Google Cloud / Gemini | AI job analysis, Gmail OAuth authentication | EU Standard Contractual Clauses apply |
| Anthropic | AI cover letter, interview, and CV features | USA — 30-day retention, SCCs apply |
| SendGrid / Twilio | Transactional email delivery (cover letters, notifications) | USA — SCCs apply |
We do not sell your data. We do not share your data with advertisers. We do not use your data to train AI models.
5. International Data Transfers
Some of our sub-processors are based outside the European Union (Anthropic in the USA, SendGrid/Twilio in the USA). When we transfer your data to these providers, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Google Cloud Data Processing Addendum with EU SCCs certified on April 8, 2026
6. Your Rights Under GDPR
As an EU resident you have the following rights:
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Get a copy of all data we hold about you | Email support@kambulo.com |
| Rectification | Correct inaccurate data | Edit in app or email us |
| Erasure | Delete your account and all your data | Use "Delete Account" in settings, or email us |
| Portability | Receive your data in a machine-readable format | Email support@kambulo.com |
| Restriction | Ask us to stop processing your data | Email support@kambulo.com |
| Objection | Object to processing based on legitimate interests | Email support@kambulo.com |
| Withdraw consent | Withdraw Gmail consent at any time | Disconnect Gmail in settings |
We respond to all requests within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl
Phone: +31 (0)70 888 85 00
7. Cookies
Kambulo uses the following cookies:
| Cookie | Type | Purpose | Consent required |
|---|---|---|---|
| Session token | Strictly necessary | Keeps you logged in | No |
| CSRF token | Strictly necessary | Prevents cross-site request forgery | No |
| Stripe session | Strictly necessary | Processes payments securely | No |
We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
8. Data Security
We protect your data using the following measures:
- All data transmitted over HTTPS (TLS encryption)
- Database hosted in Amsterdam, Netherlands (EU)
- Passwords hashed using bcrypt (never stored in plain text)
- Access tokens encrypted at rest
- Regular automated database backups
- Rate limiting to prevent abuse
In the event of a data breach that risks your rights, we will notify the Autoriteit Persoonsgegevens within 72 hours and notify affected users without undue delay.
9. Children
Kambulo is not intended for use by anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us at support@kambulo.com.
10. Changes to This Policy
We will notify you by email and display a notice in the app when we make material changes to this Privacy Policy. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
For any privacy-related questions or requests:
Email: support@kambulo.com
Website: https://kambulo.com
For EU/GDPR matters you may also contact:
Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl