Kadroflow Inbox

Import the open Gmail or Outlook application into Kadroflow after review, with a PDF or Word CV and optional certificates.

Review and import one open Gmail or Outlook application into Kadroflow with its CV and optional certificates. Detailed description Kadroflow Inbox moves the application email you choose into your Kadroflow workspace without leaving Gmail or Outlook on the web. Open one application email, click the Kadroflow Inbox toolbar button and approve the clear first-use disclosure. The side panel detects the sender's contact details locally. Check the details, pick the job, choose a PDF or Word CV and add optional certificates, then press **Import candidate**. - One open email is handled only after you open the panel and allow access. - The email subject and message body remain in your browser. - Nothing is imported until you confirm the fields and press Import. - Files are checked before upload, and rejected files are explained. - A duplicate-prevention identifier stops the same email creating two candidates. - The revocable Kadroflow pairing expires after 90 days. The extension does not scan folders, monitor a mailbox, download inbox attachments, import in the background, show ads or collect usage analytics. A Kadroflow workspace is required. ## Single purpose Kadroflow Inbox lets a recruiter review and import the one application email currently open in Gmail or Outlook on the web into the recruiter's paired Kadroflow workspace, with a CV and optional certificate files selected from the device. ## Permission justifications - `activeTab` — gives temporary access to the supported inbox tab only after the user clicks the extension toolbar button. The access is used to read the one visible message selected by the user. - `scripting` — runs the packaged local detector (`capture.js`) in that active tab after first-use consent. It suggests the sender's name, email address and phone number for review. No remote code is used. - `sidePanel` — keeps the review form beside the selected email while the user verifies details and chooses files. - `storage` — stores the accepted disclosure version, the Kadroflow API origin and the revocable pairing token on the Chrome profile. It stores no Kadroflow password, inbox password or message content. - Host access to `https://kadroflow.com/*` — calls the pairing, active-job and confirmed-import API. Kadroflow is the only remote server contacted by the extension. The extension requests no persistent Gmail or Outlook host permission, no optional permissions and no remote code. ## Data handling ### Before the user consents No inbox tab is queried, no script is injected and no message data is handled. The first screen explains the local reading and transfer boundary and requires **Allow and continue**. ### Local processing after consent When the user opens the side panel from a supported message, the extension handles: - the visible sender name and address; - the subject; - the visible message body, to detect a probable phone number; - the active message URL, to derive a duplicate-prevention identifier; - the contact fields the user reviews or edits; - the CV and certificate files selected from the device, while checking file type and size. The subject and message body stay in the browser and are not stored by the extension. ### Data sent after Import Only when the user presses **Import candidate**, the extension sends over HTTPS to the paired Kadroflow workspace: - confirmed name, email address and optional phone number; - the selected active job; - the duplicate-prevention identifier derived from the message URL; - the selected CV file; - up to five selected certificate files. Files rejected by the server are reported to the user and are not stored. Accepted candidate data and files follow the workspace's normal access, retention and deletion controls. ### Local storage Chrome local extension storage contains: - consent version; - Kadroflow API origin; - a revocable Kadroflow pairing token and its expiry. The token contains no password, expires after 90 days and can be revoked in Kadroflow or removed by disconnecting. The consent choice can be reopened from the side panel. Uninstalling removes the extension's local storage. ## Privacy practices form — dashboard answers Declare the following data types as handled: - **Personally identifiable information: Yes** — candidate name, email address, optional phone number and identifying information in selected files. - **Authentication information: Yes** — Kadroflow-issued pairing token stored locally; no password. - **Personal communications: Yes** — the one visible application email is processed locally after consent; its subject and body are not transmitted. - **Web history: Yes** — the current message URL is handled and a duplicate-prevention identifier derived from it is transmitted. - **Website content: Yes** — visible Gmail or Outlook message content is processed locally to suggest fields. - **Form data: Yes** — contact details confirmed or edited in the extension are transmitted on Import. - **User-generated content: Yes** — the CV and optional certificate files chosen by the user are transmitted on Import. - **Location: No.** - **Financial and payment information: No.** - **Health information: No.** - **User activity: No** — no clicks, mouse position, keystroke logging, network monitoring or analytics are collected. Certify all required Limited Use statements: - Data is not sold to third parties. - Data is not used or transferred for purposes unrelated to the extension's single purpose. - Data is not used or transferred to determine creditworthiness or for lending. - Data is not used for advertising. - Data is not used to train a general-purpose AI model. - Humans do not read extension-handled data except with the user's affirmative agreement for support/security, when required by law, or in aggregated and anonymized form for internal operations. Privacy policy URL: `https://kadroflow.com/chrome-extension/privacy` ## Store listing assets - Store icon: `addins/chrome-inbox/icons/icon128.png` - Screenshot 1: `docs/chrome-web-store/assets/01-consent-1280x800.png` - Screenshot 2: `docs/chrome-web-store/assets/02-review-1280x800.png` - Screenshot 3: `docs/chrome-web-store/assets/03-success-1280x800.png` - Small promo tile: `docs/chrome-web-store/assets/promo-small-440x280.png` - Marquee promo tile: `docs/chrome-web-store/assets/promo-marquee-1400x560.png` ## Reviewer test instructions 1. Use the reviewer workspace credentials and pairing-code steps supplied in the private **Test instructions** field. Do not put credentials in the public listing. 2. Open a synthetic application email in Gmail or Outlook on the web. 3. Click the Kadroflow Inbox toolbar button. 4. Confirm that the first screen appears before message details are read. Choose **Allow and continue**. 5. Generate a one-time code under Kadroflow **Settings → Connections → Email add-ins**, paste it into the side panel and connect. 6. Confirm the detected name, email and phone remain editable. Choose an active job. 7. Select a PDF or DOCX CV and optional PDF/JPEG/PNG/WebP certificates, then press **Import candidate**. 8. Confirm the success screen and the candidate in Preselection. 9. Open the same email and import again; confirm the existing candidate is returned and no duplicate is created. 10. Under **Connection and privacy**, verify that **Disconnect this inbox** removes the pairing and **Review privacy choice** returns to the disclosure screen.