Privacy Policy

1. Summary

Here is a high-level overview of our data practices. Details follow in the sections below.

• We collect only the data needed to provide and improve the Service.
• We use your data to deliver the Service, process payments, ensure security, and improve reliability.
• We do not sell your personal data. We do not use your resume content for advertising.
• We name the current service providers that help us operate the platform below.
• You can download current application account data in Account Settings and request broader access, correction, or deletion.
• Section 6 names every provider that processes your data and where it processes it; section 7 explains the safeguards we rely on for transfers outside the EU/EEA.
• Your document content goes to our AI providers only when you use an AI feature, and we do not train our own models on it.

2. Data Controller

The controller responsible for the personal data described in this policy is JobApply.io, hello@jobapply.io.

Privacy questions and requests: hello@jobapply.io

3. What Personal Data We Collect

3.1 Data You Provide Directly

• Account data: name, email address, authentication identifiers (including magic-link tokens), and profile preferences.
• Document content: resume/CV text, cover letter text, work experience, education history, skills, language proficiency, certifications, and any other information you add to your documents. We keep the original file or pasted text of each imported CV privately, for your future edits and to improve how we read CVs, until you delete that CV or your account, or ask JobApply.io to delete it; originals imported without an account are kept for 12 months.
• Profile photo: if you choose to upload a photo for your resume/CV.
• Billing data: subscription plan, billing cycle, invoice metadata, and payment method information (processed and stored by our payment provider; we do not store full card numbers). For a purchase with Link in India we also keep the offer you accepted, the payment method type, the country of the card next to the country we detected for your visit, and a keyed hash of the card fingerprint, to enforce one free trial per person.
• Support communications: messages, attachments, email address, name if provided, and widget/session metadata from support requests you submit, including through PostHog support chat.
• Feedback and surveys: any responses you provide when we ask for feedback on the Service.

Google Ads measurement cookies are set by default; switch them off in Cookie settings. With Advertising consent, Google Ireland Limited may receive campaign, conversion, device, page, and referral data, and — when a trial or subscription is activated — one conversion event carrying your PayPal subscription identifier, the subscription status, and the document format you were exporting when you subscribed (for a purchase with Link in India, the Stripe subscription identifier when the free trial starts), as described in section 6 and our Cookie Policy.

Sensitive details in your documents. A CV can easily carry special-category data: health information, religious or philosophical beliefs, trade-union membership, political opinions, ethnic origin, or sexual orientation, and a profile photo can suggest some of them. Please leave that information out unless you need it in the document. If you do include it, we process it only as part of the document you asked us to store, edit and export, on the basis of your explicit consent, which you give by typing or uploading it (GDPR Art. 9(2)(a)). You can withdraw that consent at any time by deleting the document or the photo; editing alone does not change the original you imported. Deleting your account removes it with the rest of your data.

3.2 Data Collected Automatically

• Usage data: pages visited, features used, actions taken (such as document creation, template selection, and exports), timestamps, and session duration.
• Device and browser data: device type, operating system, browser type and version, screen resolution, and preferred language.
• Network data: IP address, approximate geographic location (city/country level), and referral URL.
• Error reports: when something fails, the error message and stack trace, the request method, a shortened route, and a status code, tied to an opaque account identifier rather than your email address. In your browser this is collected only while Analytics is on, with email addresses and tokens removed; on our servers it is collected whenever an error occurs.
• Cookies and similar technologies: see our Cookie Policy for details.
• Editor security ID: a random first-party device ID used only to limit email changes and welcome re-sends, detect stolen tokens and restore your CV after sign-in; replaced every 30 days, never shared with third parties or linked to analytics or ads.

3.3 Authentication Data

Current sign-in uses email magic links. We receive the email address you enter and the authentication and session identifiers returned by Supabase Authentication. We do not currently offer Google or LinkedIn sign-in.

There is a second way an account comes into existence. When you enter your email address to start a document from a template and that address has no account yet, we create an account for that address straight away and sign that browser in, without sending a magic link first. If the address already has an account, nothing is created and we email a magic link for sign-in instead.

If you enter a new address on the upgrade screen, we create its account when you start checkout. On successful return from PayPal, we sign that browser in.

3.4 Data We Receive From Third Parties

Some personal data reaches us from PayPal rather than from you. When you subscribe, PayPal sends us messages about your subscription, and we store each message as it arrives as a billing audit record. Those messages carry the subscription and transaction identifiers, the status, the amounts and the dates, and the payer details held on the PayPal account, which can include the name, the PayPal account email address, and the phone number on that account. Where the PayPal account email differs from your sign-in email, we also store the two addresses together as a record of the mismatch.

For a purchase with Link in India, the same kind of data reaches us from Stripe. Stripe sends us messages about the checkout, the subscription, its invoices and refunds, and we keep a billing audit record of each message. Those messages carry the identifiers, the status, the amounts and the dates, the payment method type, the country of the card and a card fingerprint, and the order details Link shares with us, which can include the name, email address and billing address given at checkout. Link is the merchant of record for that purchase and handles your payment details under its own privacy policy.

Before you pay, we share your checkout email with Stripe to prepare payment; Stripe may keep it even if you never pay.

A checkout with Link also carries, as payment metadata that we send to Stripe and Link, how you reached us, so that we can measure which ad led to a purchase: while Analytics is on, the UTM tags and the page you first landed on, and, only if you gave Advertising consent, the Google click identifiers (gclid, wbraid or gbraid). Without the matching consent, none of these is sent.

We use that data to match the payment to your account, to keep your subscription status and access in step, and to investigate disputes and fraud. The legal bases are contract performance (Art. 6(1)(b)) for the subscription itself and our legitimate interest (Art. 6(1)(f)) in keeping an accurate billing record. We keep it as described in section 8, we share it only with the providers named in section 6, and the rights in section 10 apply to it in the same way. PayPal's own privacy notice explains what PayPal does with your data, and Stripe's and Link's privacy policies explain what they do with yours.

4. How We Use Your Data

We use your personal data for the following purposes:

• Provide the Service: create and manage your account, save and render your documents, apply templates, generate PDF exports, and deliver AI-assisted writing features.
• Process payments: handle subscriptions, renewals, invoices, and refunds through our payment provider.
• Communicate with you: send only service emails about your account — your welcome email, one-time sign-in links, the confirmation when a subscription starts, receipts, and notices about billing problems and refunds — and answer your support requests. In a free trial with Link we email a reminder 3 days before the first monthly charge, and Link, not us, sends the receipts and refund notices for that purchase.
• Reminder emails, only with your consent: if you tick the reminder box, which is never ticked for you, we send at most one reminder to finish your CV and at most one reminder when you leave checkout without paying. You can withdraw that consent at any time in Account Settings or with the one-click unsubscribe link in the reminder itself, and we then send no more reminders. We keep a record of your choice — when you gave or withdrew it, where (for example the sign-up form or Account Settings) and which version of the reminder text you saw — for as long as your account exists, and delete it with your account. Apart from these two reminders, we do not send marketing or promotional email.
• Ensure security: detect and prevent fraud, abuse, unauthorized access, and other harmful activities.
• Improve the Service: analyze usage patterns, measure feature performance, identify bugs, and develop new features. While Analytics is on, which it is by default, PostHog records your visits and what you do in the Service, such as the buttons you click and the pricing, checkout and trial steps you reach, under the PostHog identifier described in our Cookie Policy, and links that record to your account once you sign in. Separately, this purpose also includes counting, as totals only, how many visitors reach our pricing, checkout and trial steps, including visitors who arrive from our ads. These counts come from our server request logs, not from cookies.
• Comply with legal obligations: meet accounting, tax, and regulatory requirements.
• Enforce our Terms: investigate and address violations of our Terms of Service and Acceptable Use policies.

5. Legal Bases for Processing (EU/EEA)

If you are located in the EU/EEA, we rely on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract performance (Art. 6(1)(b)): processing necessary to provide the Service, manage your account, process payments, and deliver your documents.
• Legitimate interests (Art. 6(1)(f)): improving the Service, ensuring security, preventing fraud, and analyzing usage to enhance product quality. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a)): where required, such as for advertising measurement cookies, certain AI features and reminder emails. You can withdraw consent at any time. Product analytics is on by default and we treat your use of the Service as agreement to it; you can switch it off at any time in Cookie settings.
• Legal obligation (Art. 6(1)(c)): processing required to comply with applicable laws, such as tax and accounting regulations.

Your email address is the one thing we require: we cannot create an account or provide the Service without it, so if you do not give us one, you cannot use the Service. Everything else is optional. Document content, a profile photo and a phone number are yours to add or leave out, and leaving them out only limits the parts of the Service that need them.

6. Who We Share Data With

We do not sell your personal data. The table below names the service providers configured in the current Service and describes the data involved in each service.

Current service providers and subprocessors

Other recipients may include:

• Legal and regulatory authorities: if required by law, legal process, or government request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy commitments.

7. International Data Transfers

Section 6 names where each provider processes your data. Your account, your documents and your authentication data are held in the European Union (Supabase, AWS eu-west-1 in Ireland), and product analytics and session replay stay in PostHog's EU cloud. The website and application front ends, the API server, transactional email, error reporting and the AI providers process data in the United States.

Where a provider processes data outside the EU/EEA (Vercel, Railway, SendGrid, Sentry, OpenRouter, OpenAI, Anthropic), we rely on that provider's EU-U.S. Data Privacy Framework certification where it holds one and otherwise on the Standard Contractual Clauses incorporated in the provider's data-processing terms. Each provider processes personal data under its own standard data-processing terms.

PayPal and Google contract with EU customers through their EU entities, PayPal (Europe) S.à r.l. et Cie, S.C.A. and Google Ireland Limited, and may process data outside the EU/EEA under their own terms. Stripe and Link process payment data for purchases with Link in the United States and other countries under their own privacy policies.

8. Data Retention

We keep your account and your documents for as long as your account exists, except CV originals (section 3.1). Deleting your account in Account Settings deletes the JobApply.io application records for that account and removes the local browser workspace once local cleanup can complete.

Some identifiers survive that deletion: a keyed hash (HMAC) of your account email address, a keyed hash of your user ID, and — if you ever had a subscription — a keyed hash of your PayPal subscription identifier (for a purchase with Link, your Stripe subscription identifier), together with the dates on which each deletion step completed. After a card payment with Link, a keyed hash of the card fingerprint is kept too. They are kept with no fixed end date and are used for two purposes only: enforcing one free trial per person, and making sure a late sign-in, billing sync or provider webhook cannot resurrect a deleted account. A keyed hash cannot be turned back into your email address or your subscription, and none of them is used to contact you or to build a profile of you.

The record of each AI request, including the model's answer, is removed by routine housekeeping 30 days after the request finishes. The review session behind a tailored resume — the job description you pasted and the changes the AI proposed — is removed 90 days after you last change it; the same session for a cover letter is kept with that cover letter until you delete the letter or your account.

Guest CV import results (the extracted text) expire after 24 hours; originals follow section 3.1.

The record of your reminder-email choice (section 4) is kept for as long as your account exists and is deleted with it.

Billing records, including the provider messages described in section 3.4, are kept for as long as your account exists and are deleted with it. A provider message we were never able to match to an account is not linked to you and is not part of that deletion. Records held by the providers named in section 6, including their own backups and logs, are kept under those providers' terms.

Our API server's request logs, which record the IP address, browser type and the address requested, are kept by our hosting provider for 30 days. Session recordings are kept by PostHog, our analytics provider, in the EU for 30 days. We may keep copies of some recordings for up to 90 days to improve the product, then delete them.

9. Data Security

These are the protections built into the Service itself. Sign-in uses one-time email links, so there is no password of yours for us to store or lose. The keys that reach our payment, email, database and AI providers stay on our servers and are never sent to your browser. Error reports raised on our servers have the request body, cookies, authorization headers and query string removed before they are sent, and identify you by an opaque account identifier rather than your email address. Session replay never records passwords, sign-in codes, payment details or hidden fields.

We do not claim more than that here: the organizational controls of each provider are the ones described in that provider's own terms, and no method of transmission or storage can be guaranteed to be completely secure. If you think your account or your data has been compromised, write to hello@jobapply.io.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your personal data, subject to legal retention requirements. Deleting your account leaves behind only the keyed hashes and deletion dates described in section 8.
• Right to restrict processing: request that we limit how we use your data in certain circumstances.
• Right to data portability: request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to object: object to processing based on legitimate interests, including profiling and direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: you have the right to file a complaint with a data protection supervisory authority, such as the Danish Data Protection Agency (Datatilsynet).

While signed in, open Account Settings, then under Your Subscription use Download my data to download current account, document, AI-session, sync, and billing data stored in the JobApply.io application database as JSON. This self-service download does not include records held only by payment, authentication, email, analytics, AI, or hosting providers, or operational server logs.

To request access to those additional records, or to exercise any other right, contact us at hello@jobapply.io with the email address associated with your account. We will respond within 30 days (or sooner if required by law). We may ask for verification of your identity before processing certain requests.

11. Children's Privacy

The Service is not directed to individuals under the age of 16 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us.

12. AI Features and Data Processing

When you use AI-assisted features (such as CV import, content suggestions, or rewriting tools), the Service sends content needed for the requested feature to OpenRouter, which forwards it to the configured downstream model provider.

• AI requests may include document text and images you submit. If that content contains your name, email address, phone number, or other personal data, those details may be sent as part of the request.
• We do not use your document content to train AI models owned by JobApply.io.
• OpenRouter routes the request to OpenAI by default, and to Anthropic automatically when the default model fails, so either of them can receive the content of your request. Both process it in the United States, each under its own standard data-processing terms; section 7 explains the transfer safeguards we rely on.
• You may choose not to use AI features; they are optional and do not affect core document functionality.

13. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects or significantly affects you. AI suggestions are recommendations only and require your review and approval before use.

14. Do Not Track

Some browsers offer a "Do Not Track" signal. There is no uniform standard for how websites should respond to this signal. We currently do not respond to DNT signals but respect opt-out choices made through cookie settings and our consent mechanisms.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date. If changes are material, we will provide prominent notice (for example, by email or an in-app notification) before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In Denmark, this is the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk.