Privacy Policy

Corus is operated by 25 labs LLC (business name Reel25), 228 Park Avenue South, New York, NY 10003, United States. Questions and privacy requests can be sent to mail@corus.so or made by phone at +34 666 44 27 59.

Depending on how you use Corus, we collect:

• Account information: name, email address, authentication identifiers, account settings, subscription plan, and support communications.
• Professional and application information: your CV or résumé, contact details, location, work history, education, skills, professional links, job preferences, work-authorization information, screening answers, cover letters, and other material you choose to provide.
• Job-search activity: searches, saved and matched roles, fit scores, application decisions, application history, employer form fields, submission status, and evidence needed to diagnose uncertain or failed submissions.
• Outreach information: professional contact profiles and work contact details, message drafts, recipients, subjects and bodies, schedules, suppression and opt-out entries, and delivery, bounce, and reply-event metadata.
• Connected-mailbox information: mailbox address, provider, permission scopes, connection status, and a revocable Nylas grant identifier. Corus does not store your Google password or Google OAuth access and refresh tokens.
• Billing information: plan, purchases, credit balance, invoices, and payment status. Stripe processes payment-card details; Corus does not store full card numbers.
• Technical information: IP address, device and browser details, timestamps, security and diagnostic logs, API requests, extension pairing status, and essential cookie or session identifiers.

We receive information from you, from your use of Corus, from job and employer websites, from public professional sources, and from service providers used for authentication, job discovery, contact enrichment, billing, AI-assisted features, and email delivery.

We use information to:

• create, authenticate, support, and secure your account;
• find and rank relevant jobs, organize your search, and maintain your application history;
• parse and format your CV, suggest improvements, and generate user-requested, job-specific materials;
• fill and submit applications that you have approved and report their outcomes;
• find relevant professional contacts and create or send outreach that you initiate or expressly enable;
• process subscriptions and credits, prevent fraud and abuse, enforce sending limits, and honor recipient suppressions;
• respond to support requests, analyze reliability, debug problems, and improve user-facing features; and
• comply with law and protect users, recipients, Corus, and third parties.

If you connect a Google mailbox, Corus requests the minimum permissions needed for the feature: basic identity scopes and the Gmail permission to send email (gmail.send). Corus uses this access only to send messages from your connected mailbox when you initiate a send or expressly enable an approved outreach workflow.

Corus does not request permission to read or modify your Gmail inbox, manage Gmail labels or drafts, access Google Contacts, or access Google Calendar. We store outgoing message content created in Corus and limited delivery identifiers and events. Reply tracking records that a recipient replied so pending follow-ups can stop; Corus does not store the reply body.

Nylas processes the OAuth connection and email delivery on our behalf and holds the provider access and refresh tokens. You can disconnect the mailbox in Corus settings, which revokes the Corus connection and stops pending automated follow-ups for that mailbox.

Corus's use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not sold, used for advertising, used to determine creditworthiness, or used to train generalized artificial-intelligence or machine-learning models. Human access is prohibited except with your specific consent, when necessary for security, when required by law, or when data is aggregated for lawful internal operations.

When you choose an AI-assisted feature, relevant content—such as CV text, a job description, screening context, or an outreach draft—may be sent to OpenRouter and the model provider selected by Corus to generate the requested result. Corus does not send Google inbox content to AI providers. You should review generated material before using it and correct anything inaccurate.

When you pair and enable the Corus browser extension, it receives one approved application task at a time. It may open the employer's application page, fill supported fields, upload the selected CV, and submit the form. Applicant and CV data are held in extension memory while a task is processed; the extension retains only pairing, enabled-state, and recent operational information in Chrome local storage.

Employer application systems receive the information and documents you would provide when applying manually. Their own privacy policies govern their later handling of that information.

We disclose information only as needed to operate Corus, including:

• to infrastructure and service providers such as Clerk (authentication), Stripe (billing), Nylas (mailbox connection and delivery), OpenRouter and model providers (opt-in AI features), and job-discovery and contact-enrichment providers;
• to employers and their application systems when you approve an application;
• to recipients and their email providers when you send outreach;
• when required by law or necessary to protect rights, safety, security, and service integrity; and
• in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable notice and consent requirements.

We do not sell personal information or share it for cross-context behavioral advertising.

Where data-protection law requires a legal basis, we process information to perform our contract with you, with your consent, to comply with legal obligations, and for legitimate interests such as securing and improving Corus, preventing abuse, supporting users, and operating a reliable job-search service. You may withdraw consent at any time, without affecting processing already completed.

We retain account and product data while your account is active and as reasonably needed to provide Corus. After an account or data-deletion request, we delete or de-identify information unless retention is required for legal, billing, security, dispute, backup, or fraud and abuse-prevention purposes. Suppression records may be retained to ensure recipients are not contacted again.

Disconnecting a mailbox stops future Corus access through that grant. You may also revoke access from your Google Account permissions. To request access, correction, portability, or deletion, email mail@corus.so. We may verify your identity before completing a request.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encrypted network connections, revocable credentials, tenant isolation, and service monitoring. No system can guarantee absolute security.

Corus and its providers may process information in the United States and other countries. Where required, we use recognized safeguards for international transfers and require providers to protect information consistently with applicable law.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, or withdraw consent. You may also have the right to appeal our response or complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

Corus does not currently respond to browser "Do Not Track" signals because we do not use personal information for cross-site behavioral advertising.

Corus is intended for people aged 18 or older and is not directed to children. If you believe a child has provided information to Corus, contact us so we can investigate and delete it where required.

We may update this Privacy Policy as Corus or legal requirements change. We will post the updated version here and revise the "Last updated" date. If a change materially affects how we use information, we will provide additional notice or request consent when required.

Privacy inquiries and requests: mail@corus.so

25 labs LLC (business name Reel25)
228 Park Avenue South
New York, NY 10003, United States
+34 666 44 27 59