Privacy Policy
GP Solution
Effective from August 1st, 2025
1. General matters — who we are
With this Privacy Policy (the "Policy") we inform you about the processing of personal data carried out by SIA "GP Global" (Sabiedrība ar ierobežotu atbildību "GP Global"), registration number 40203648365, entered in the Commercial Register of the Republic of Latvia on 14 May 2025. Our registered office is at Riepnieku Street 2 – 58, Rīga, LV-1050, Latvia.
We operate the website https://gpsolution.app/. When we say "we", "us", "GP" or "Controller", we mean this company. We are the controller of your personal data.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable laws.
Data-protection contact: privacy@gpsolution.app · General contact: info@gpsolution.app.
2. How GP Solution works
GP Solution is a technology platform that helps people find jobs and helps employers find candidates. It is important to understand what we do and what we do not do:
- GP does not employ candidates.
- GP does not make hiring decisions.
- GP does not guarantee employment.
- GP provides technology: search, job aggregation, smart matching and communication tools.
You decide whether to apply, and where. Employers independently decide whether to hire.
3. What data we process
Users. Identification data (name, surname, username, IP address), authentication data, contact details, education and employment information, profile data you add, your CV, your applications and the correspondence related to them, subscription and payment status, career content you choose to publish, safety reports, and information on your activity on the website.
HR representatives / recruiters. Name, contact details and vacancy details of the person responsible for a specific vacancy. For recruiters we use information they have made public or that they provide when registering.
Google account data (if you connect Gmail). Your Google Account email address and basic profile, and the Gmail data needed to send and manage your job-application emails — see Section 5.
4. Why we use your data and on what legal basis
| Purpose | Legal Basis |
|---|---|
| User identification and information security (detecting possible illegal activity, protecting the app and data). | GDPR Art. 6(1)(b) — performance of a contract / pre-contractual steps. |
| Selecting and transferring the necessary User information (including contact details of companies and recruiters) to provide the service you request. | GDPR Art. 6(1)(b). |
| Sending and managing your job-application email correspondence to the recruiters, according to the parameters you set (Auto-send). | GDPR Art. 6(1)(b). |
| Running, maintaining and improving the platform; statistics and analytics. | GDPR Art. 6(1)(f) — legitimate interests (documented balancing test). |
| Direct marketing (news and updates). You can opt out at any time. | GDPR Art. 6(1)(a) — your consent. |
| Processing and storing payment-related information via Stripe. | GDPR Art. 6(1)(b) and Art. 6(1)(c) — legal accounting obligations. |
| Collecting and publishing company recruitment contacts; sending your CV to the selected company. | GDPR Art. 6(1)(f) — legitimate interests. |
5. Google user data and Gmail access
If you choose to connect your Google account (for the Auto-send / email features), you authorise GP to access certain Google data through Google APIs. We request the following OAuth scopes:
- Sign-in — userinfo.email, userinfo.profile, openid: to identify you and see your primary Google Account email address.
- Gmail — gmail.modify: to read the replies you receive from recruiters, compose, and send your job-application emails from your Gmail account according to the settings you choose. We use this access only to provide the features you request.
What we do with this data: We access your Gmail only to send, and where applicable read, the emails related to your job applications, based on your instructions. We do not use your Gmail data for advertising, and we do not sell it.
Storage of Gmail data:
We do not store the content (body, attachments, replies) of incoming emails on our servers; access is real-time. To pull thread and message information on demand live for you, we only save the associated Thread IDs and Message IDs. For outgoing emails that you schedule within the app, we only temporarily store the email body up until the moment it is sent out, after which the content is deleted.
Human access: In normal operation, no member of our team reads the content of your emails. Access is restricted and logged; a person may access content only with your consent, for security, to comply with the law, or where the data is aggregated and anonymised.
Sharing: We share Gmail data only with the service providers strictly needed to run the feature (see Section 10).
6. Limited Use — Google API Services User Data Policy
GP Solution’s use and transfer of information received from Google Accounts and Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We only use Google user data to provide or improve the features you have requested.
- We do not transfer or sell Google user data for advertising, marketing or other unrelated purposes.
- We strictly do not use Google user data to develop, improve or train generalised or non-personalised AI/ML models.
- We do not allow humans to read Google user data except with your consent, for security, to comply with law, or on aggregated/anonymised data.
7. AI features
GP Solution uses artificial intelligence built and run by us; your data is not sent to external AI companies. AI helps read your CV and suggest profile entries, suggest matching vacancies, and draft your application letter — always subject to your review and confirmation. AI assists; it does not decide, and nothing is sent without your confirmation. We confirm that your Gmail data is never used to train or improve any artificial intelligence or machine learning modules.
8. International data transfers
We usually process your personal data within the EU/EEA. We may process data outside the EU/EEA only where adequate safeguards apply: an adequacy decision by the European Commission, EU Standard Contractual Clauses, or other GDPR-compliant safeguards. Hosting / data location: hosting.com, United Kingdom. (The European Commission has adopted an adequacy decision for the United Kingdom, ensuring that data transfers to this location provide an essentially equivalent level of data protection as within the EU/EEA).
9. How long we store your data
We store your personal data only as long as needed for the purposes for which it was collected, or as required by law:
- User account data: while your account is active and for 3 months after account deletion.
- Recruiter (HR representative) data: 2 years.
- Data we must keep under accounting or other laws: for the statutory period.
- Gmail data: Scheduled outgoing email content is strictly deleted immediately after the email is sent out. Thread IDs and Message IDs are kept only as long as your account is active to facilitate live requests and are fully deleted upon account erasure.
10. Who we share your data with
Your data is provided to the recruiter / company you select when you apply. Recruiter contact data is available to Users of the website. We also use trusted service providers (processors) who act on our instructions:
- Hosting / infrastructure: hosting.com, United Kingdom
- Payment processing: Stripe
- Any other subprocessors: None
We do not sell your personal data.
11. Security
We apply appropriate technical and organisational measures to protect your data, including access controls, logging and encryption in transit and at rest. Independent security assessment (Google CASA): Completed. Validation achieved for CASA Tier 2 on June 12, 2026[cite: 1, 2].
12. Your rights
You have the right to:
- request information about the processing of your personal data;
- request rectification of incorrect, inaccurate or incomplete data;
- request restriction of processing;
- request erasure of your personal data;
- object to, or withdraw consent for, processing for marketing purposes;
- receive your data in a portable format and, where technically feasible, have it transferred to another controller;
- lodge a complaint with the Data State Inspectorate (dvi.gov.lv).
13. How to exercise your rights and disconnect Google access
To exercise your rights, send a request to privacy@gpsolution.app. We respond within one month; we will tell you if we need more time. You can disconnect your Google account at any time in your GP account settings and in your Google Account permissions (myaccount.google.com/permissions).
14. Changes to this Policy
We may update this Policy in line with changes to law or our operations. We will inform you of changes through our website and update the "Last updated" date.
15. Contact us
SIA "GP Global"
Riepnieku Street 2 – 58, Rīga, LV-1050, Latvia
info@gpsolution.app · privacy@gpsolution.app