1. Introduction

This Privacy Policy describes how ApplyNow ("we", "us", "our") collects, uses, stores, and shares personal data in connection with the ApplyNow platform and associated services (the "Service"). We are committed to protecting your privacy and processing your personal data in accordance with all applicable laws, including the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

Please read this policy carefully. By using the Service, you acknowledge that you have read and understood how we handle your personal data. If you have any questions, you can contact us at any time using the details in Section 18 below.

2. Data Controller

The data controller responsible for your personal data is the individual operator of ApplyNow, based in Munich, Bavaria, Germany. As the operator is based in Germany, this Service falls under German and EU data protection law. Contact details for the data controller are provided in Section 18.

3. Data We Collect

We collect and process the following categories of personal data:

Account data: your email address, registration date, and authentication metadata (one-time password timestamps, session tokens). This is the primary identifier we use to manage your account.
Payment references: Stripe customer ID, payment intent IDs, the last four digits of your payment card, card brand, and card expiry date. We do not store full card numbers or CVV codes at any point.
Usage data: credit balance, credit transaction records, action logs (such as application generation events, revision events), and associated timestamps.
Resume and application content: PDF or text resume files you upload and job descriptions or other application-related content you submit for processing.
Support communications: the content of messages you send to our support email address, including any personal data you choose to include in those messages.
Technical and device data: IP address, browser type, operating system, and request logs generated automatically when you interact with the Service.

4. Legal Basis for Processing (GDPR Art. 6)

We rely on the following legal bases to process your personal data:

Performance of a contract (Art. 6(1)(b)): The processing of your account data, payment references, usage data, and resume/application content is necessary to enter into and perform the contract with you — specifically to register your account, process purchases of credits, and deliver the AI-generated resume outputs you request.
Legitimate interests (Art. 6(1)(f)): We process technical and device data and usage logs to detect and prevent fraud, abuse, and security incidents, and to maintain the reliability and integrity of the Service. We have assessed that these interests are not overridden by your fundamental rights and freedoms, given the limited scope and sensitivity of the data involved.
Compliance with a legal obligation (Art. 6(1)(c)): We retain payment records for 7 years to comply with German commercial bookkeeping obligations (§ 257 HGB).

5. How We Use Your Data

We use the personal data we collect for the following purposes:

To create and manage your account and authenticate your sessions.
To process your credit purchases and maintain accurate billing records.
To generate tailored resume outputs and revisions in response to your requests.
To provide customer support and respond to enquiries or complaints.
To monitor for, investigate, and prevent fraud, abuse, and security threats.
To comply with our legal and regulatory obligations.
To communicate important service updates, changes to these policies, or other essential operational information. We do not send unsolicited marketing communications.

6. Resume and Application Content

Resume files and job descriptions you submit are processed exclusively for the purpose of generating the AI-assisted output you have requested. We do not use your resume content or job descriptions to train AI models, to build profiles for advertising, or for any purpose beyond delivering the service to you directly.

Resume and application content is transmitted to our AI service provider (see Section 9) solely to produce the requested output and is retained on our systems for up to 30 days after submission, or until you request deletion, whichever comes first.

7. Payment Processing

All payment transactions are processed by Stripe, Inc. ("Stripe"), a third-party payment processor. Stripe acts as an independent data controller for the personal data it collects during payment processing and is subject to its own privacy policy. We do not receive or store your full card number; Stripe provides us only with the payment metadata listed in Section 3 above.

Stripe is certified to the Payment Card Industry Data Security Standard (PCI DSS). We encourage you to review Stripe's privacy policy for details on how they process your payment data.

8. Infrastructure and Security Providers

The Service is hosted on Railway infrastructure ("Railway"), which may process technical metadata in connection with hosting, scaling, and reliability functions. Network traffic may be routed through Cloudflare, Inc. ("Cloudflare"), which provides DDoS protection, CDN, and security filtering services. Both Railway and Cloudflare act as data processors on our behalf, processing data only as necessary to provide their respective infrastructure services.

9. AI Service Provider

To generate AI-powered resume outputs, relevant input data (including your uploaded resume content and job description) is transmitted to OpenAI, Inc. ("OpenAI"), based in the United States. OpenAI acts as a data processor on our behalf and processes your data solely for the purpose of generating the output we request on your behalf.

OpenAI processes data under Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to GDPR Art. 46(2)(c), providing appropriate safeguards for international transfers of personal data from the European Economic Area to the United States. We have entered into a data processing agreement with OpenAI that restricts the use of your data to service delivery only and prohibits its use for model training under our API-based engagement.

10. International Data Transfers

As noted above, some of your personal data is transferred to third-party providers located outside the European Economic Area (EEA), specifically to the United States (OpenAI, Stripe, Cloudflare, Railway). Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V, including Standard Contractual Clauses (SCCs) where applicable. You may request further details about the safeguards in place by contacting us at the address in Section 18.

11. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy or as required by law:

Account data: retained until you request account deletion or your account is terminated, whichever is earlier.
Payment records: retained for 7 years from the date of the transaction to comply with German commercial record-keeping obligations under § 257 HGB.
Resume and application content: retained for up to 30 days after the relevant submission is created, or until you request deletion, whichever comes first.
Usage logs and technical metadata: retained for up to 90 days, after which they are deleted or anonymised.
Support communications: retained for as long as reasonably necessary to resolve your enquiry and for a reasonable period thereafter in case of follow-up, and not ordinarily beyond 2 years.

When retention periods expire, data is securely deleted or anonymised so that it can no longer be associated with you.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

Encryption of data in transit using TLS (HTTPS).
Access controls that restrict access to personal data to authorised personnel only.
Use of reputable third-party infrastructure providers with their own security certifications.
Regular review of access permissions and security configurations.

While we take security seriously, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk. If you become aware of a security incident affecting your account, please contact us immediately.

13. Cookies and Session Data

The Service uses session cookies and authentication tokens that are strictly necessary for the operation of the Service — for example, to keep you logged in between page loads. These are functional cookies and do not require your consent under applicable EU law.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not share session data with advertising networks.

14. Your Rights under GDPR (Arts. 15–22)

If you are located in the European Economic Area (or in a jurisdiction with equivalent data protection laws), you have the following rights regarding your personal data:

Right of access (Art. 15): request a copy of the personal data we hold about you, along with information about how it is processed.
Right to rectification (Art. 16): request correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17): request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent was the legal basis). Note that certain data, such as payment records, must be retained to comply with legal obligations.
Right to restriction of processing (Art. 18): request that we limit the processing of your data in certain circumstances, such as while a dispute about its accuracy is resolved.
Right to data portability (Art. 20): receive the personal data you have provided to us in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to object (Art. 21): object at any time to processing of your personal data that is based on our legitimate interests. We will comply unless we can demonstrate compelling legitimate grounds that override your interests or rights.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. In complex cases or where we receive a high volume of requests, we may extend this period by a further 2 months and will inform you accordingly. We may ask you to verify your identity before processing your request.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe we have not complied with applicable data protection law. As this Service is operated from Bavaria, Germany, the competent lead supervisory authority is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

You may also have the right to lodge a complaint with the supervisory authority in the EU member state where you habitually reside, work, or where an alleged infringement took place.

16. Children

The Service is not directed at or intended for use by children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will take prompt steps to delete it.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, third-party service providers, or applicable law. When we make material changes, we will notify you by email or by a prominent notice on the Service at least 14 days before the changes take effect. The "last updated" date at the top of this page will always reflect the most recent version.

We encourage you to review this policy periodically. Your continued use of the Service after an updated policy takes effect constitutes your acceptance of the revised policy.

18. Contact

For any questions about this Privacy Policy, to exercise your data subject rights, or to raise a privacy concern, please contact us at: [email protected].

We aim to acknowledge all privacy-related enquiries within 5 business days.