Privacy Policy

Effective as of May 6th, 2026. This Privacy Policy describes how Do A Huddle, Inc. (d/b/a Massive) and our subsidiaries and affiliates (“Massive,” “we”, “us” or “our”) processes personal information that we collect through our digital or online properties or services that link to this Privacy Policy (collectively, the “Service”).

Index

• Personal information we collect
• How we use your personal information
• How we share your personal information
• Your choices
• Other sites and services
• Security
• International data transfers
• Children
• Changes to this Privacy Policy
• How to contact us
• California privacy rights notice

California Notice at Collection of Personal Information

This Notice at Collection applies only to California residents. It provides the categories of personal information we collect, the purposes for which we use it, whether we “sell” or “share” it, and how long we keep it. Categories of personal information collected: See “Personal information we collect” above. Categories of sources: We collect personal information from you, public sources, private sources, automated technologies, job boards, employer systems, and third-party partners. Purposes for collection and use: See “How we use your personal information” above. Whether we sell or share personal information: We do not “sell” personal information for monetary consideration, but we may “share” personal information for cross-context behavioral advertising. Retention period: See “Data retention” above. Sensitive personal information: We may collect certain sensitive personal information (such as work authorization, demographic data you choose to provide) but we do not use or disclose this information for purposes other than those permitted by Cal. Civ. Code §1798.121. How to exercise your rights: See “California Privacy Rights Notice” below or contact us at dan@usemassive.com.

Personal information we collect

Information you provide to us. Personal information you may provide to us through the Service or otherwise includes

• Contact data, such as your first and last name, salutation, email address, billing and mailing addresses, professional title and company name, and phone number
• Demographic data, such as your city, state, country of residence, postal code, gender, and age
• Profile data, such as the username and password that you may set to establish an online account on the Service, date of birth, biographical details, photograph, links to your profiles on social networks, interests, preferences, and any other information that you add to your account profile
• Communications data based on our exchanges with you, including when you contact us through the Service, social media, or otherwise
• Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them
• Job application data, such as professional credentials and skills, educational and work history, certifications and/or licenses held, LinkedIn profile page, personal website, authorization to work in the U.S., and other information that may be included on a resume or curriculum vitae as well as in a cover letter. This may also include diversity information that you provide
• Job preferences, such as relocation options, time zones, hybrid environments, any other information that you choose to provide or want potential employers to know
• Proxy email communications. If you use our auto-apply or proxy email features, we may collect and process the content of communications sent or received through a Massive-managed proxy email address, including emails between you and potential employers. This may include application confirmations, scheduling emails, recruiter outreach, or any other communications routed through the proxy email system. These communications may include personal or sensitive information that the sender chooses to include, and we process such information in accordance with this Privacy Policy
• Connected Google account data (Gmail integration). If you opt in to connect a Google account through OAuth, Massive requests the following Google scopes: (i) openid, used solely so Google issues a sign-in token Massive can verify; (ii) https://www.googleapis.com/auth/userinfo.email, used solely to read your verified Google account email address from the sign-in token; and (iii) https://www.googleapis.com/auth/gmail.modify, used to operate the Gmail features described below. Massive does not request, read, or store your Google profile name, profile picture, given or family name, or any other identity field. Under gmail.modify, Massive reads inbound messages relevant to job applications you sent through Massive (matched via the unique recipient address Massive generated for the application, or via reply-thread linkage to a message Massive previously stored), sends replies on your behalf via Gmail, fetches new messages via Gmail’s history change feed, subscribes your inbox to Gmail’s push-notification service so we can process new mail in near-real time, and modifies message labels (for example, marking a thread as read after we process it). Massive does not delete messages, does not access drafts that Massive did not itself create on your behalf, and does not read messages unrelated to job applications you sent through Massive. Stored data for the integration consists of: encrypted access and refresh tokens for the connected account, the Gmail history checkpoint, the push- notification subscription expiry, copies of relevant inbound messages (in the same internal table our existing proxy-email feature uses), and metadata about messages Massive sent on your behalf. Tokens are encrypted at rest with AES-256-GCM and the encryption key is managed in Google Secret Manager
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection
• Sensitive personal information. Some of the information we collect may be considered “sensitive personal information” under applicable laws, such as work authorization status, demographic information you voluntarily provide, and the content of proxy email communications. We do not use or disclose sensitive personal information for purposes other than those permitted by applicable law
• Inferences. We may create inferences based on the information we collect, such as inferred skills, suitability for certain jobs, or predicted job preferences

Third-party sources. We may combine personal information we receive from you with personal information we obtain from other sources, such as: - Public sources, such as public records, social media platforms, and other publicly available sources. Private sources, such as data providers, social media platforms and data licensors.

Automatic data collection. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications and other online services, such as

• Device data, such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area
• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them
• General location data when you authorize the Service to access your device’s location
• Communication interaction data such as your interactions with our email, text or other communications (e.g., whether you open and/or forward emails) – we may do this through use of pixel tags (which are also known as clear GIFs), which may be embedded invisibly in our emails

Cookies and similar technologies. Some of the automatic collection described above is facilitated by the following technologies

• Cookies, which are small text files that websites store on user devices and that allow web servers to record users’ web browsing activities and remember their submissions, preferences, and login status as they navigate a site. Cookies used on our sites include both “session cookies” that are deleted when a session ends, “persistent cookies” that remain longer, “first party” cookies that we place and “third party” cookies that our third-party business partners and service providers place. You may encounter a cookie banner or preference tool on our Service that provides additional details about our use of cookies and allows you to modify your cookie settings. These preferences may not apply across all devices or browsers. Your cookie preferences may not apply across all browsers, devices, or sessions
• Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data on your device outside of your browser in connection with specific applications
• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked
• Session-replay technologies, such as those provided by Hotjar that employ software code to record users’ interactions with the Services in a manner that allows us to watch video replays of those user sessions. The replays include users’ clicks, mobile app touches, mouse movements, scrolls, and keystrokes/key touches during those sessions. These replays help us diagnose usability problems and identify areas for improvement. You can learn more about session replay providers such as Hotjar at https://www.hotjar.com/legal/policies/privacy/ and you can opt-out of session recording by Hotjar at https://www.hotjar.com/policies/do-not-track/

Data about others. We may offer features that help users invite their contacts to use the Service, and we may collect contact details about these invitees so we can deliver their invitations. Please do not refer someone to us or share their contact details with us unless you have their permission to do so.

How we use your personal information

We may use your personal information for the following purposes or as otherwise described at the time of collection: Service delivery and operations. We may use your personal information to

• provide, operate and improve the Service and our business;
• personalizing the service, including remembering the devices from which you have previously logged in and remembering your selections and preferences as you navigate the Service;
• establish and maintain your user profile on the Service;
• facilitate your invitations to contacts who you want to invite to join the Service;
• enable security features of the Service, such as by sending you security codes via email or SMS, and remembering devices from which you have previously logged in;
• communicate with you about the Service, including by sending Service-related announcements, updates, security alerts, and support and administrative messages;
• communicate with you about events or contests in which you participate;
• understand your needs and interests, and personalize your experience with the Service and our communications; and
• provide support for the Service, and respond to your requests, questions and feedback

Research and development. We may use your personal information for research and development purposes, including to analyze and improve the Service and our business and to develop new products and services. As part of these activities, we may create aggregated, de- identified and/or anonymized data from personal information we collect. We make personal information into de-identified or anonymized data by removing information that makes the data personally identifiable to you. We may use this aggregated, de-identified or otherwise anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.

Automated decision-making and profiling. Massive uses automated tools to analyze your skills, experience, job preferences, and application history in order to (a) identify job opportunities that may match your profile, (b) automatically prepare your application materials, and (c) automatically submit job applications on your behalf. These activities may materially affect your job application outcomes. You may contact us at dan@usemassive.com to request human review or to opt out of certain automated processing where required by applicable law. Where required by law, you may request to opt out of our automated decision-making technologies by contacting us at dan@usemassive.com.

AI processing and automated application submissions. We use artificial intelligence and machine-learning tools to generate resumes, cover letters, and answers to application questions, and to identify jobs that may be relevant to you. We also use your personal information to automatically prepare and submit job applications on your behalf, including transmitting application materials into external applicant tracking systems operated by employers or job boards.

Training and improving machine-learning models. We may use your personal information, including job application data, resume content, and usage data, to train and improve our AI and machine- learning systems. We take reasonable steps to de-identify or pseudonymize this information when feasible.

Phone Number Verification. We may use your mobile phone number to send you text messages for verification and informational purposes. By providing your number and opting in, you consent to receive these messages.

Message and data rates may apply. You may opt out of receiving text messages at any time by replying STOP. Consent to receive text messages is not a condition of purchase. We comply with all applicable text messaging laws and regulations, including the Telephone Consumer Protection Act (TCPA) and international equivalents.

Marketing and advertising. We, our service providers and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes

• Direct marketing. We may send you direct marketing communications and may personalize these messages based on your needs and interests. You may opt-out of our marketing communications as described in the Opt-out of marketing section below
• Interest-based advertising. Our third- party advertising partners may use cookies and similar technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other online services over time, and use that information to serve online ads that they think will interest you

This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms.

Service improvement and analytics. We may use your personal information to analyze your usage of the Service, improve the Service, improve the rest of our business, help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails, and to develop new products and services.

Compliance and protection. We may use your personal information to

• comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, investigations or requests from government authorities;
• protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
• audit our internal processes for compliance with legal and contractual requirements or our internal policies;
• enforce the terms and conditions that govern the Service; and
• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft

With your consent. In some cases, we may specifically ask for your consent to collect, use or share your personal information, such as when required by law.

Cookies and similar technologies. In addition to the other uses included in this section, we may use the Cookies and similar technologies described above for the following purposes: - Technical operation. To allow the technical operation of the Service, such as by remembering your selections and preferences as you navigate the site, and whether you are logged in when you visit password protected areas of the Service.

Functionality. To enhance the performance and functionality of our services.

Advertising. To help our third-party advertising partners collect information about how you use the Service and other online services over time, which they use to show you ads on other online services they believe will interest you and measure how the ads perform.

Analytics. To help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails.

For example, we use Google Analytics for this purpose. You can learn more about Google Analytics and how to prevent the use of Google Analytics relating to your use of our sites here: https://tools.google.com/dlpage/gaoptout?hl=en.

How we share your personal information

We may share your personal information with the following parties and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection.

Affiliates.

Our corporate parent, subsidiaries, and affiliates.

Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as hosting, information technology, customer support, email delivery, marketing, automated application submissions, consumer research and website analytics).

Job submission partners. Third parties that facilitate your job submissions and who may use your personal information for their own purposes.

Proxy email recipients. If you use a Massive-managed proxy email address, we share communications sent through that address with the intended recipients (such as employers, recruiters, or job platforms). We may also receive replies through the proxy email system and process those communications on your behalf.

Mobile Information. We do not share your mobile information, including text messaging opt-in data and consent, with any third parties or affiliates for marketing or promotional purposes.

Payment processors. Any payment card information you use to make a purchase on the Service is collected and processed directly by our payment processors, such as Stripe. Stripe may use your payment data in accordance with its privacy policy, https://stripe.com/privacy.

Advertising partners. Third-party advertising companies for the interest-based advertising purposes described above.

Potential employers. Potential employers and job boards to facilitate submission of your job applications.

Business and marketing partners. Third parties with whom we co-sponsor events or promotions, with whom we jointly offer products or services, or whose products or services may be of interest to you.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the Compliance and protection purposes described above.

Employer applicant tracking systems. To facilitate automated job submissions, we may transmit your personal information, resume, cover letter, and answers to application questions directly into employer applicant tracking systems or third-party job application platforms.

Business transferees. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in Massive, financing of Massive, public stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares), for example, we may need to share certain personal information with prospective counterparties and their advisers. We may also disclose your personal information to an acquirer, successor, or assignee of Massive as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties as one of our business assets.

Google user data. Notwithstanding any other provision of this section, data Massive obtains from your connected Google account through the Gmail integration is not shared with the Advertising partners, Job submission partners, Business and marketing partners, or Authorities and others categories described above for any purpose other than (i) compliance with applicable law and valid legal process, or (ii) as strictly necessary subprocessors to operate the integration on Massive’s behalf. See the “Google API Services User Data Policy” section below for the full Limited Use treatment of Google user data.

Google API Services User Data Policy

Massive’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, with respect to data Massive obtains from Google APIs through the Gmail integration: Massive uses Google user data only to provide and improve the user-facing job- application features you explicitly opted in to: sending application emails from your connected Gmail, receiving and threading recruiter replies, and surfacing them in the Massive interface. Massive does not use, transfer, or allow Google user data to be used for training, evaluating, or improving generalized artificial-intelligence or machine-learning models. The “Training and improving machine-learning models” provision elsewhere in this Privacy Policy and the license-to-content provision in the Massive Terms of Use do not apply to Google user data. Massive does not use or transfer Google user data for advertising of any kind, including retargeted, interest-based, contextual, or personalized advertising. The “Marketing and advertising” and “Advertising partners” provisions elsewhere in this Privacy Policy do not apply to Google user data. Massive does not sell or transfer Google user data to third parties, except to subprocessors strictly necessary to operate the integration (for example, our cloud hosting provider for storage and message routing) and only under written data-protection agreements consistent with this policy. The categories listed in the “How we share your personal information” section above (advertising partners, job submission partners, business and marketing partners, and the like) do not receive Google user data. Massive does not allow humans to read Google user data, except: (i) with your explicit consent for specific messages — for example, if you ask our support team to investigate a particular message; (ii) as necessary to investigate abuse or for security purposes; (iii) where required to comply with applicable law or valid legal process; or (iv) in aggregated and anonymized form for internal operations, and only when reasonably necessary.

Your choices

Access or update your information. If you have registered for an account with us through the Service, you may review and update certain account information by logging into the account.

Opt-out of communications. You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us at support@usemassive.com. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails. You can opt out of receiving text messages from us at any time by replying “STOP” to any message you receive.

This will unsubscribe you from future text communications.

Cookies.

Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Service may not work properly. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org. You can also configure your device to prevent images from loading to prevent web beacons from functioning.

Disconnect the Gmail integration. You can disconnect your connected Google account at any time from your Massive account settings. You can also revoke Massive’s access directly from your Google account at https://myaccount.google.com/permissions. When you disconnect, Massive revokes the OAuth tokens with Google, deletes the encrypted tokens stored on Massive’s systems, cancels the Gmail push-notification subscription, and stops reading or sending mail through that account. Messages already received through the integration follow Massive’s standard data retention rules (see “Data retention” below) unless you separately request deletion using the contact information in “How to contact us”. Blocking images/clear gifs: Most browsers and devices allow you to configure your device to prevent images from loading. To do this, follow the instructions in your particular browser or device settings.

Advertising choices. You may be able to limit use of your information for interest-based advertising through the following settings/options/tools

• Browser settings. Changing your internet web browser settings to block third-party cookies
• Privacy browsers/plug-ins. Using privacy browsers and/or ad-blocking browser plug-ins that let you block tracking technologies
• Platform settings. Google and Facebook offer opt-out features that let you opt-out of use of your information for interest-based advertising. You may be able to exercise that option at the following websites:
• Google: https://adssettings.google.com/
• Facebook: https://www.facebook.com/about/ads
• Ad industry tools. Opting out of interest-based ads from companies that participate in the following industry opt-out programs:
• Network Advertising Initiative: http://www.networkadvertising.org/managing/opt_out.asp
• Digital Advertising Alliance: optout.aboutads.info. AppChoices mobile app, available at https://www.youradchoices.com/appchoices, which will allow you to opt-out of interest-based ads in mobile apps served by participating members of the Digital Advertising Alliance

Mobile settings. Using your mobile device settings to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes. You will need to apply these opt-out settings on each device and browser from which you wish to limit the use of your information for interest-based advertising purposes. We cannot offer any assurances as to whether the companies we work with participate in the opt-out programs described above.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Declining to provide information. We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.

Other sites and services

The Service may contain links to websites, mobile applications, and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.

Security

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

Data retention. We retain personal information for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. We may retain certain information for longer periods as required by law or for legitimate business purposes (such as fraud prevention, analytics, or machine-learning model training). Communications transmitted through a Massive-managed proxy email address may be retained for operational and security purposes, but are not retained longer than necessary to fulfill these purposes unless required by law. OAuth access tokens, refresh tokens, the Gmail history checkpoint, and the Gmail push-notification subscription record associated with a connected Google account are deleted from Massive’s systems within thirty (30) days of disconnection or refresh-token revocation, whichever is sooner.

International data transfer

We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.

Children

The Service is not intended for use by anyone under 16 years of age. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that we have collected personal information through the Service from a child without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Service after the effective date of any modified Privacy Policy indicates your acknowledging that the modified Privacy Policy applies to your interactions with the Service and our business.

How to contact us

Email: dan@usemassive.com Mail: Do a Huddle, Inc 122 w 26th St, suite 1103, New York, New York 10001 Phone: (917) 832-3342

California Privacy Rights Notice

Right to know, delete, correct, and limit. California residents may request that we (a) disclose what personal information we have collected, (b) delete personal information, (c) correct inaccurate personal information, (d) opt out of “sharing” for cross-context behavioral advertising, and (e) limit the use of sensitive personal information.

Sale or sharing of personal information. We do not “sell” personal information for monetary compensation. However, we may “share” personal information for cross-context behavioral advertising. You may opt out by contacting us at dan@usemassive.com.

Notice of financial incentives. We do not offer programs that involve financial incentives for personal information.

Retention. See our “Data retention” section above for how long we store each category of personal information.

How to submit a request. California residents can submit requests to know, delete, correct, or limit their personal information by emailing us at dan@usemassive.com.

Verification. We may need to verify your identity before processing your request, including by confirming information associated with your account or your interactions with us.

Authorized agents. You may authorize another person to submit a request on your behalf, subject to proof of authorization.

Opt-out preference signals. We recognize and honor browser-based opt-out signals where required by law, including Global Privacy Control (GPC) signals.

Use of sensitive personal information. We do not use or disclose sensitive personal information for any purpose that requires a “Right to Limit” under California law.

Appeals. If we deny your request, you may appeal our decision by contacting us at dan@usemassive.com.