Privacy Policy
Effective date: August 8, 2026
1. Who we are
- Service: Cofa Sourcer (sourcer.cofa.app)
- Operator: KRAFTON, Inc.
- Contact: ka_privacy@krafton.com
2. Data we process
2.1 Account holders (recruiters and their organisations)
| Data | Source | Why |
|---|---|---|
| Name, work email, password hash | provided at signup | authentication |
| Organisation and membership | provided / invited | access control, workspace scoping |
| Connected mailbox address + OAuth refresh token (encrypted at rest) | Google / Microsoft OAuth | sending outreach as the user |
| Search queries, job descriptions, saved lists | in-product activity | delivering the service |
| Usage events, IP address, device/browser | automatic | product analytics |
2.2 Candidates
| Data | Source | Why |
|---|---|---|
| Name, current and past roles, employer, education, public profile links, publicly posted professional activity | public web sources | matching candidates to a role |
| Resume / CV content | uploaded by our users | matching and evaluation |
| AI-generated assessment of fit against a job description | generated by us | ranking and shortlisting for the recruiter |
| Outreach messages addressed to them, and delivery status | generated in-product, sent via the recruiter's mailbox | contacting the candidate |
We do not knowingly collect special-category data (health, beliefs, trade-union membership, political opinions, sex life).
2.3 What we deliberately do not do
- We do not build or sell a cross-organisation candidate database. Candidate data is scoped to the searching organisation's workspace.
- We do not read our users' mailboxes. We hold send-only access.
- We do not use customer data or Google user data to train AI models.
- We do not make automated decisions producing legal or similarly significant effects on candidates.
3. Google user data — Limited Use
Cofa Sourcer requests the gmail.send scope only.
Cofa Sourcer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- gmail.send is used solely to send messages the user has composed or approved from their own mailbox.
- We store the connected mailbox address and an encrypted OAuth refresh token. We do not read, index, download, or store the contents of the user's mailbox.
- Google user data is never used to build a candidate database, never used to train generalised AI models, and is never sold or transferred to third parties except as necessary to perform the send itself.
- You may disconnect a mailbox at any time in-product, and may revoke access at myaccount.google.com/permissions. On disconnection we delete the stored token.
Microsoft Outlook access is used on the same send-only basis.
4. AI processing and human control
- Cofa uses AI to search, summarise, rank against a job description, and draft outreach copy.
- A human recruiter makes every decision. The AI does not select, reject, or contact anyone on its own. Every outbound message is sent by a person, from their own mailbox, as themselves.
- The AI's assessment is an internal aid to the recruiter. It is not disclosed to the candidate and is not applied against them as a score.
- No automated decision produces legal or similarly significant effects on a candidate.
5. Legal basis
Candidate data is collected from publicly available sources and processed for the legitimate recruiting purpose of the customer. Candidate rights (access, correction, deletion, suspension of processing) are honoured on request.
6. Sharing and sub-processors
We do not sell personal data. We share it with the following providers, each only as needed to run the service:
| Provider | Purpose | Data reaching them | Location |
|---|---|---|---|
| Amazon Web Services | hosting, database, file storage | all application data | US |
| Anthropic | LLM for matching, evaluation, drafting | job descriptions, candidate profile text, message drafts | US |
| OpenRouter | LLM gateway | as above | US |
| Exa | public web / people search | search queries | US |
| mailbox OAuth + sending; Analytics | mailbox address, outbound message content; usage + IP | US | |
| Microsoft | mailbox OAuth + sending | mailbox address, outbound message content | US |
| Resend | transactional email | recipient email address | US |
Cross-border transfer: these providers process data outside Korea, primarily in the United States.
7. Cookies and analytics
- Essential cookies — session and authentication. Cannot be disabled.
- Google Analytics 4 — loaded only on the production hostname; collects usage events, IP address, device and browser information.
8. Retention and deletion
| Data | Retention | Basis |
|---|---|---|
| Account data after deletion request | 30 days, then destroyed | internal standard |
| Abuse / fraud records | 5 years | internal standard |
| Access logs, IP | 3 months | 통신비밀보호법 |
| Consumer complaint / dispute records | 3 years | 전자상거래법 |
| Contract, withdrawal, payment records | 5 years each | 전자상거래법 |
| Tax-related records | 5 years | 세법 |
| Mailbox tokens | deleted on disconnection or revocation | Cofa-specific |
| Unsubscribe / suppression records | kept indefinitely | so an opt-out outlives everything else |
9. Your rights
Account holders and candidates may request access, correction, deletion, suspension of processing, and withdrawal of consent at ka_privacy@krafton.com. Korean users may also complain to 개인정보보호위원회 / KISA.
10. Changes
We will post changes on this page and notify users in advance of material changes, in-product or by email.