Privacy Policy — ApplyAI

This Privacy Policy explains how ApplyAI ("we", "us") handles personal data when you use our website and Service. We act as the data controller for the information described below.

1. Data we collect

Account data: email address, hashed password or OAuth identifier (Google / Apple), sign-in timestamps.
Content you provide: CV PDFs you upload, job descriptions you paste, and the generated outputs (tailored CVs, cover letters, interview prep).
Billing data: subscription status, plan, billing period. Card details are collected and stored by Stripe — we never see or store them.
Usage data: basic logs (IP, user agent, page/feature accessed) used to operate and secure the Service.

2. How we use it

To provide the Service (generate and store your applications).
To authenticate you and secure your account.
To process subscriptions and prevent fraud.
To send service-related emails (sign-in, password reset, billing).
To comply with legal obligations.

3. Legal bases (UK/EU GDPR)

We rely on (a) contract to deliver the Service you've signed up for; (b) legitimate interests for security, fraud prevention, and product improvement; and (c) legal obligation for tax and accounting records.

4. Sub-processors

We share data only with vendors who help us run the Service:

Supabase — authentication, database, file storage (EU/US).
Cloudflare — hosting and edge runtime.
Stripe — payments, tax calculation, billing portal.
Google AI (Gemini) via our AI gateway — generates the tailored content from the CV and job description you submit. Inputs are sent for the purpose of generation only.

5. Retention

We keep account data while your account is active. CVs and generated applications stay until you delete them; Free accounts are auto-pruned to the 3 most recent applications. Billing records are retained for up to 7 years to meet tax obligations. You can delete your account at any time by contacting support — this removes your content within 30 days, subject to legal retention requirements.

6. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, port your data, and object to processing. Contact support@apply-ai.store to exercise these rights. You may also complain to the UK ICO or your local supervisory authority.

7. Cookies

We use strictly necessary cookies and local storage for authentication, session, and security. We do not use advertising cookies.

8. International transfers

Some sub-processors may process data outside the UK/EEA. Where this happens, we rely on Standard Contractual Clauses or other adequate safeguards.

9. Security

Data is encrypted in transit (TLS) and at rest. Database access is restricted by row-level security policies so users only ever read their own data.

10. Children

The Service is not intended for users under 16.

11. Changes & contact

We will post any changes here and update the "Last updated" date. Contact: support@apply-ai.store.