Privacy Policy

1. Who we are

"Apply Copilot", "we", "us", and "our" refer to the operator of the Apply Copilot service (the "Service") — a tool that helps job seekers tailor their CVs and cover letters and submit job applications across third-party job platforms. For the purposes of the EU/UK General Data Protection Regulation ("GDPR"), Apply Copilot acts as the data controller of personal data described in this Policy, except where we process data on behalf of an enterprise customer, in which case we act as a processor.

2. Scope of this policy

This Policy applies to personal data we process about visitors to our marketing site, registered users of the Service, recipients of our communications, and individuals whose information is included in materials you submit (for example, references named in your CV).

This Policy does not cover the privacy practices of third-party job boards, applicant tracking systems, or other websites the Service may interact with on your behalf. Each of those services operates under its own privacy policy.

3. Information we collect

3.1 Information you provide to us

• Account data: name, email address, password hash, and authentication identifiers (for example, Google sign-in IDs) that you provide when you register or sign in.
• Profile and CV data: employment history, education, skills, certifications, languages, links to portfolios, and any other information you upload as part of your CV or job-seeker profile.
• Job-application content: cover letters and answers to screener questions generated through the Service, the job listings you select, and the application submissions you authorize.
• Communications: messages you send to our support team, survey responses, and feedback you choose to share.
• Payment data: if you purchase a paid plan, billing details and payment confirmations. Card numbers are processed directly by our payment provider; we do not store full card numbers on our servers.

3.2 Information collected automatically

• Device and log data: IP address, browser type and version, operating system, device identifiers, referring and exit pages, timestamps, and similar telemetry generated when you use the Service.
• Usage data: pages and features you interact with, actions you take in the product (such as which jobs you apply to), and diagnostic information used to detect errors and abuse.
• Cookies and similar technologies: we and our analytics partners place cookies, pixels, and local-storage entries to remember your session, measure performance, and improve the Service. See Section 11 for details.

3.3 Information from third parties

• Identity providers (such as Google) when you choose to sign in via single sign-on. We receive a basic profile and email address from those providers, subject to your authorization.
• Job platforms the Service interacts with on your behalf may return data about the status of your applications.
• Public sources such as the public pages of a target employer, used solely to help tailor the documents we generate for you.

4. How we use your information

We use personal data for the following purposes:

• Provide the Service: create and authenticate your account, generate adaptive CVs and cover letters, auto-fill and submit applications you select, and keep you informed about the status of those applications.
• Personalization: tailor content, recommendations, and language to your profile and the role you are applying for.
• Improve and develop: debug, run analytics, measure feature performance, train and evaluate internal models that power features, and develop new functionality.
• Communications: send transactional notifications, security alerts, product updates, and — with your consent where required — marketing emails. You can opt out of marketing at any time via the unsubscribe link in any such email.
• Safety and integrity: detect and prevent fraud, abuse, scraping, or violations of our Terms of Use, and protect our users and our infrastructure.
• Legal compliance: comply with applicable laws, regulatory obligations, and lawful requests, and to establish, exercise, or defend legal claims.

5. Legal bases for processing (EEA / UK)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

• Performance of a contract — to provide the Service you have signed up for.
• Legitimate interests — to improve and secure the Service, prevent abuse, and grow our business, where those interests are not overridden by your rights and freedoms.
• Consent — for non-essential cookies, certain marketing communications, and any processing for which we specifically ask for your consent.
• Legal obligation — to comply with laws and binding legal requests.

You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. How we share your information

We do not sell your personal data. We share information only as described below.

• Job platforms and employers:when you instruct the Service to submit an application, we transmit the relevant CV, cover letter, profile fields, and screener answers to the target job platform or employer. Once submitted, that data is governed by the recipient's privacy practices.
• Service providers and sub-processors: hosting and cloud infrastructure providers, email delivery services, analytics providers, customer-support tools, and payment processors that help us operate the Service. These vendors are bound by written agreements to use your data only as instructed by us and to protect it.
• AI providers: we use large-language-model providers to generate or refine application content. We send only the data needed to produce the requested output, and we contract with providers that do not train their general-purpose models on our customer inputs.
• Corporate transactions: if we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred to the successor or acquirer, subject to the protections of this Policy.
• Legal and safety: we may disclose information where we believe in good faith that doing so is necessary to comply with law, enforce our Terms, protect the rights, property, or safety of any person, or respond to a lawful request from a public authority.
• With your direction: we may share information when you specifically ask us to (for example, when you connect a third-party integration).

7. International data transfers

We operate globally, which means personal data may be transferred to and processed in countries other than the one in which you live, including the United States. Where we transfer personal data out of the EEA, the UK, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms. You can contact us to request more information about these safeguards.

8. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. The actual retention period depends on the type of data and the purpose for which it is processed:

• Account and profile data — while your account is active, and for a limited period after deletion to satisfy legal and audit requirements.
• Application content— kept in your account until you delete it; submissions transmitted to job platforms remain subject to those platforms' retention policies.
• Logs and security data — typically up to 12 months, unless a longer period is required to investigate an incident.
• Backups — overwritten on a rolling cycle within a reasonable period after deletion from primary systems.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include encryption of data in transit, access controls, network monitoring, and routine security review. No system is perfectly secure, and we cannot guarantee the security of any data you transmit to us. Please use a strong, unique password and keep your sign-in credentials confidential.

10. Your privacy rights

Depending on where you live, you may have the following rights in respect of your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete personal data, subject to legal exceptions.
• Restriction — request that we limit how we process your data.
• Portability — receive certain data in a portable, machine-readable format.
• Objection — object to processing that we carry out on the basis of legitimate interests, including direct marketing.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.
• Complaint — lodge a complaint with your local data-protection authority.

Residents of California and certain other U.S. states have analogous rights under state privacy laws, including the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising.

To exercise any right, contact us at privacy@apply-copilot.com. We will verify your request and respond within the time required by applicable law. You will not be discriminated against for exercising these rights.

11. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, measure traffic, and improve the Service. We group these into:

• Strictly necessary — required to operate the site, such as session and security cookies.
• Performance and analytics — help us understand how the Service is used so we can improve it.
• Functional — remember choices you make.

You can control cookies through your browser settings and, where required, through our in-product cookie controls. Disabling some cookies may affect the functionality of the Service.

12. Automated processing and AI

Several core features of the Service rely on machine-learning models that automatically analyze the job description and your profile to produce a tailored CV, cover letter, and screener answers. These outputs are generated for your review — you choose whether to send them. We do not make decisions that produce legal or similarly significant effects on you without human involvement, and we do not evaluate your suitability for a specific employer. Hiring decisions are made by employers, not by Apply Copilot.

13. Children's privacy

The Service is intended for users who are at least 16 years old (or the higher age required in your country to consent to online services). We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Third-party links and integrations

The Service may contain links to, or integrations with, third-party sites and services. We are not responsible for the content or privacy practices of those third parties. We encourage you to read their privacy policies before sharing personal data with them.

15. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect. The "Effective date" at the top of this Policy indicates when it was last revised. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

16. Contact us

If you have questions about this Policy or our privacy practices, or if you would like to exercise any of your rights, please contact us at privacy@apply-copilot.com. If you are in the EEA or the UK and feel that we have not addressed your concern, you have the right to lodge a complaint with your local supervisory authority.