wtomate

Privacy Policy

Effective 24 October 2026 · Owtomate, Sydney, Australia

Owtomate applies to jobs for you. To do that it holds your resume, your details and a signed-in session on the job boards you use, and it sends parts of that to the services that help write and send your applications. This page says exactly what is collected, which services see it and where they are, how long it stays, and how to have it removed. We follow the Australian Privacy Principles.

1. What we collect

Your account

When you sign in with Google we receive your name, email address, profile picture and Google account identifier. Signing in alone does not give Owtomate access to your Gmail, Google Drive or calendar. Connecting Gmail is a separate, optional action described below.

What you tell us

Your profile: full name, phone number, suburb and postcode, work rights, an experience summary, skills, the roles, locations and pay you will accept, and any standing instructions you write for the agent. Your answers to employer screening questions are saved so you are not asked the same thing twice.

Your documents

The resumes and supporting files you upload, and the notes you attach to them. Text is extracted from them so the agent can read them.

Your job-board sessions and mailbox

You sign in to SEEK and Indeed in a private browser that runs on our server, in a profile that belongs to your account alone. That browser keeps your signed-in session as cookies. We never see or store your job-board password. When a job board ends a session, Owtomate signs back in using the Google account already signed in to that browser, by pressing the board's own "Continue as" or "Continue with Google" option. It never types a password. The Job boards panel in the app shows the address each board is signed in with, and signing out there stays in effect until you sign in again.

Optional Gmail connection. You can allow Owtomate to find verification codes and account-confirmation links needed for your job applications, and to send email-only applications that you explicitly review and confirm. Connect the same Gmail address saved in your application profile. We do not create Gmail accounts for you, request your Gmail password through an Owtomate form, or send arbitrary messages from your mailbox.

Browser Gmail during the transition. While the Gmail API integration awaits Google verification, normal users connect Gmail by signing in directly to Google in their account's private browser. The browser stores Google session cookies. This session technically permits access to the entire connected mailbox, so consider using an inbox dedicated to your job search. Our mailbox tools search recent verification emails and send only the applications you have confirmed. Choosing Disable mailbox access in Settings stops those tools; it does not sign your Google account out of the browser or revoke job-board sign-in. You can open the browser to sign out of Google yourself.

Gmail through MCP and the Gmail API. Administrators can test this method while verification is pending; public access remains disabled until enabled by the operator after approval. When you choose it, Google asks you to authorize Gmail read access (gmail.readonly) and send access (gmail.send), alongside your verified email identity. Read permission is technically broader than verification emails. Owtomate limits verification searches to messages from the last two hours and reads only threads returned by that search. It also checks Sent to reconcile an uncertain application email and prevent duplicates. Our private MCP service mediates these operations; Google OAuth tokens stay on our server and are encrypted at rest.

What is sent and stored. Verification message text and links are processed locally on our server to extract the code or link, rather than sending message bodies to an AI provider. Codes and links are used to complete the relevant job-board or employer authentication step. Application emails include the recipient, subject, cover letter and resume you reviewed, and an optional cover-letter attachment if selected. We keep approval revisions and submission receipts to prevent duplicate sends. We do not keep a separate archive of your Gmail inbox. A verification code or link may appear in temporary browser pages or diagnostic traces while completing the relevant form.

Accounts on employer sites

Some employers only accept applications through their own site, and ask you to create an account there first. Owtomate creates it in your name with your email address. The password is not stored: it is worked out when needed from a secret held on our server, and shown to you on request. We keep a record of each such account: the site, the email address used, and the job it was for.

What the agent does

For every application: the job, the employer, the cover letter written for it, the answers given, and whether it was sent. For every run: a log of what the agent did. For an application it could not finish: a trace with snapshots of the pages it was on, so you or we can see what went wrong. While a run is going you can watch its browser live; that picture goes to you and is not recorded.

Payments

Card details are entered on Stripe's checkout page and never reach us. We keep a record of each purchase: which pass, the amount, the date and Stripe's reference for it.

Your visit to this site

Which pages you open, how long they stay in front of you, your browser type, your IP address, and the country and city that address maps to. Location is worked out on our own server from a local database; your address is not sent to anyone for it.

Cookies

A session cookie that keeps you signed in for 30 days, a short-lived cookie that protects the sign-in handshake for ten minutes, and browser storage for preferences such as your theme.

Advertising pixels from Reddit and Meta may set cookies so we can tell which advertisements bring people here and stop paying for the ones that do not. We also keep Reddit's click identifier in a first-party cookie for 28 days. These tools record page visits and whether a sign-up or payment happened — never what you searched for, which jobs you viewed, or anything from your resume or applications.

2. What we use it for

  • Finding jobs that match you, writing a cover letter for each, answering screening questions from your details, and submitting the application from your own job-board account or on the employer's site.
  • Suggesting search terms and filling in your profile from your resume, when you ask for that.
  • Showing you what was sent, what needs your attention, and how much of your allowance is left.
  • Emailing you: an evening summary of the day's applications, and an alert when something stops Owtomate working for you (your applications are nearly or fully used, a job board has signed you out, runs keep failing, or your setup is unfinished). You can switch the alerts off in Settings or from the link in any of them.
  • Taking payment for a pass and crediting it to your account.
  • Understanding how the site is used, keeping it working, and stopping abuse.

We do not sell your information. We do not build a profile of you to advertise to you, and we do not advertise other companies' products to you anywhere. We do measure our own advertising: Reddit is told that someone who saw one of our ads went on to create an account or buy a pass, so we know which ads are worth their cost. That is described in the next section.

3. Decisions the software makes for you

You start every application run manually. Uploading documents or completing your profile does not start a run. During a run, software decides which listings to review, whether a job matches your preferences, and what to answer from your profile, documents and saved answers. Auto apply may submit online applications during that run. Semi auto fills forms and saves applications in Prepared Applications; only the applications you select and confirm are submitted. Email-only applications always require explicit confirmation of the prepared application. Preparing an application uses an application credit; confirming that same preparation does not charge another credit. You can edit a prepared cover letter before confirming, save standing cover-letter instructions, change preferences or stop a run. If a question cannot be answered truthfully from your information, the agent asks for your help.

4. Who else sees it, and where they are

Only the services needed to do the work above, and only the part each one needs:

  • Employers and job boards (SEEK, Indeed, and the employer sites a listing sends you to). The applications you asked us to send, under your name. Australia and wherever those employers and boards operate.
  • Celeris (AI models). Runs the agent that fills in forms, judges whether a job fits, ranks listings and answers screening questions. It receives the job's text, the page the agent is on (including a picture of it when the agent needs one), and the relevant parts of your profile, resume and saved answers. Celeris does not publish where it processes requests; we treat it as an overseas recipient.
  • Google Gemini (AI model). Writes cover letters, and suggests search terms and profile details from your resume. It receives the job's text and your resume and profile. United States and other countries where Google operates.
  • CapMonster Cloud (bot-check solving). When a site puts a CAPTCHA or "verify you are human" check in front of an application, the check's web address and identifier are sent so it can be solved. Nothing from your profile or documents is sent. European Economic Area and United States.
  • Google. Sign-in to Owtomate and optional Gmail browser or Gmail API access. Google processes your authorization and the mailbox operations you enable, including verification reads and confirmed application sends. Our pages also load fonts from Google Fonts, which receives your IP address and browser type. Our nightly backups are stored in Google Drive after encryption on our server. United States and other countries where Google operates.
  • Webshare (paid passes only). While you hold a pass, the browser that applies for you connects to job boards and employer sites through an Australian residential internet address dedicated to your account, so your applications come from an ordinary Australian connection rather than a data centre. Webshare carries those connections: it sees which sites are contacted and how much data passes, not what is sent, which is encrypted between the browser and the site. It receives nothing else about you. United States; the addresses themselves are in Australia.
  • Stripe. Payment for a pass. Australia and the United States.
  • Reddit (advertising measurement). Told when someone creates an account or buys a pass, so we can tell which of our advertisements worked. It receives the identifier of the ad click, Reddit's own cookie from your browser, your IP address and browser type, and — where we have it — your email address, which leaves our server hashed so Reddit cannot read it. It is told the amount of a purchase, and nothing else: not which jobs you looked at, not your resume, not your applications. It is sent both from your browser and from our server, because ad blockers stop the first and we would otherwise be paying for advertisements we could not measure. United States.
  • Resend. Delivers our emails, so it receives your email address and the contents of each email. United States.
  • Alpha Layer (our hosting provider). Runs the server everything above lives on. Sydney, Australia.

Google data and Limited Use. Owtomate's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. Google mailbox data is used only for the verification and confirmed application features you enable. We do not sell it, use it for advertising, or use it to create, train or improve general-purpose AI or machine-learning models. We do not permit routine human reading of mailbox data. Any human access is limited to your explicit agreement for specific data, necessary security or abuse investigation, or legal requirements.

Overseas disclosure. Some of these services are outside Australia, in the countries shown above. By using Owtomate you consent to that, and you accept that the Australian Privacy Principles may not apply to those services in the same way once the information is with them. We choose services that keep what they receive to the purpose we send it for, and send each one only what its job needs.

5. How long we keep it

  • Your account, profile, documents, answers, application history and the record of accounts created on employer sites: for as long as your account exists.
  • Run logs: your most recent 60 runs.
  • Job review decisions: while your account exists, so unchanged rejected jobs do not use repeated AI reviews. These include listing identifiers and fingerprints, the decision and reason, and the profile or preference fingerprint used for that decision. The Skipped page shows your latest 500 skipped jobs. Changed adverts or candidate preferences can be reviewed again.
  • Traces of unfinished applications: 14 days, then deleted automatically.
  • Records of visits to the site: 180 days, then deleted automatically.
  • Your job-board and browser mailbox sessions: until you sign out in that browser, the provider expires the session, or your Owtomate account is deleted. Disabling browser mailbox automation does not sign out of Google.
  • Gmail API authorization tokens: encrypted until you disconnect the API connection, delete your account, or replace the authorization. Disconnect removes the local authorization immediately and requests revocation from Google. You can also revoke access in your Google Account connections settings.
  • Gmail verification message bodies: API responses are processed in memory, without a separate inbox archive. Browser Gmail may cache mailbox page data in your isolated browser profile until cleared by Google or removed with that profile. Submission receipts and approved application records: while your account exists. Incidental verification information in diagnostic traces follows the 14-day trace retention above.
  • Backups: taken nightly, kept 14 days on our server and 30 days in encrypted off-site storage, then deleted automatically.
  • Purchase records held in Owtomate: for as long as your account exists. Payment processors keep their own transaction records.

6. Deleting your account

You can delete your account in Settings. Confirm your account email, then choose Permanently delete account. This stops active application work and removes your account, profile, documents, answers, application history, purchase records held in Owtomate, run logs, traces, browser sessions, Gmail authorization tokens and pending authorization states, email submission receipts, records of employer-site accounts and visits linked to your account. Copies in our backups expire within 30 days. Deleting Owtomate data does not delete your Gmail account or messages already held by Google or employers. You can revoke Owtomate's Google authorization at Google Account connections. Payment processors retain their own transaction records. If you cannot access Settings, email support@owtomate.com from the address you signed in with for help.

Applications already sent are with the employers, and accounts created on employer sites belong to those sites: we cannot recall or close them for you. Before deleting your account you can ask us for the list of those accounts and their passwords, so you can close them yourself.

7. How we protect it

Everything travels over HTTPS. Each account's documents and browser profile are kept apart from every other account's, and a run can only ever reach its own account's files. Only the operator can see accounts other than your own, and every such access is through an administration page that checks that on each request. Sessions expire after 30 days and are ended immediately if an account is suspended. Backups are encrypted before they leave our server.

8. Your rights

You can see everything we hold about you inside the app, and correct most of it there. For anything else, or to ask what we hold, write to us at the address below and we will answer within 30 days. If you think we have mishandled your information, tell us first; if you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Age

Owtomate is for people aged 18 and over who are looking for work in Australia. We do not knowingly collect information from anyone younger.

10. Changes

If this policy changes in a way that matters to you, we will show the change in the app before it takes effect. The date at the top is the date of the current version.

11. Contact

Owtomate is operated from Sydney, Australia. Privacy questions and deletion requests go to support@owtomate.com.