1. Who We Are

ApplyFast (“we,” “us,” “our”) operates the ApplyFast platform at applyfast.app(“the Platform”). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Platform.

2. Data We Collect

2.1 Information You Provide

Account data: email address and password when you create an account (or OAuth profile data if you sign up with Google)
Resume data:the resume you upload (PDF or DOCX) and the structured data extracted from it — skills, work experience, education, and contact information
Job preferences: target job titles, preferred locations, experience level, salary range, and industries
Visa status: your immigration status (F1-OPT, CPT, H1B, Green Card, Citizen, or Other) used for visa-aware job filtering
Application history: jobs you save, apply to, and track through the Platform
Payment data:processed securely by Stripe — we receive a transaction reference and confirmation status but never your full card number or bank details

2.2 Information Collected Automatically

Usage data: pages viewed, features used, jobs evaluated, and applications submitted
Device and browser data: IP address, browser type, operating system, and language preferences
Cookies and local storage: session tokens for authentication, preferences, and anonymous analytics identifiers
Bot protection data: we use Cloudflare Turnstile on forms to distinguish real users from automated traffic

3. How We Use Your Data

We use your personal data to:

Create and maintain your account, authenticate sessions, and secure access to your data
Parse your resume and extract structured professional data for AI job matching
Scan job boards and evaluate listings against your profile, preferences, and visa status
Generate tailored resumes and cover letters for specific job applications
Submit job applications on your behalf (Pro tier, with your explicit approval)
Track your application pipeline and provide status updates
Process subscription payments and manage billing
Send transactional emails: account verification, password resets, and application status updates
Improve the Platform through aggregated, anonymized usage analytics

We do not sell your personal data. We do not use your data for third-party advertising. We do not share your resume or professional information with employers unless you explicitly authorize an application submission.

4. Third-Party Services

We use trusted third-party services to operate the Platform. These providers process data on our behalf and are contractually required to protect it:

Supabase: authentication, database hosting, and row-level security for your account and application data
Vercel: application hosting and edge delivery
Stripe:payment processing for subscription billing — we never see your full payment details
Resend: transactional email delivery (verification codes, password resets, application updates)
Google AI (Gemini): resume parsing, job matching, and application preparation using AI models
JSearch (RapidAPI): job board aggregation to search across LinkedIn, Indeed, Glassdoor, and other job platforms
Apify: supplemental job board data enrichment (company details, ratings)
Cloudflare Turnstile: bot protection on form submissions

We do not share your personal data with any third party beyond what is necessary to operate the Platform.

5. Cookies and Tracking

We use the following types of cookies:

Essential cookies:authentication session tokens required for the Platform to function — these cannot be disabled
Preference cookies: remember your settings such as theme preference (light/dark mode) and locale
Analytics cookies:help us understand how the Platform is used in aggregate — no personal identification

We do not use advertising or tracking cookies. We do not participate in cross-site tracking or retargeting networks.

6. Data Retention

Active account: all data retained while your account is active
Account deletion: all personal data (resume, applications, preferences, visa status) deleted within 30 days. Anonymized usage analytics are retained.
Inactive free accounts: warning email sent at 5 months of inactivity. Account and data deleted at 6 months if no login occurs.
Payment records: retained for 7 years to comply with financial record-keeping requirements

7. Your Rights

You have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you
Correction: request correction of inaccurate or incomplete data
Deletion:request deletion of your personal data (subject to legal retention obligations) — you can also delete your account directly from Settings
Export: request your data in a structured, machine-readable format
Objection: object to processing based on legitimate interest

To exercise any of these rights, email us at privacy@applyfast.app. We will respond within 30 days.

8. Data Security

We implement industry-standard security measures to protect your data:

All data in transit is encrypted using TLS (HTTPS)
Database access is restricted by row-level security policies — users can only access their own data
Authentication sessions use secure, HTTP-only cookies
Passwords are hashed using industry-standard algorithms — we never store passwords in plain text
Payment processing is handled entirely by Stripe, a PCI DSS-compliant provider
Resume files are stored in access-controlled storage buckets with per-user isolation

9. International Transfers

Your data may be processed in locations outside your home country, including regions where our infrastructure providers operate (United States, European Union). We ensure that any international transfer of personal data is protected by appropriate safeguards.

10. Children’s Privacy

The Platform is not intended for anyone under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from someone under 13, we will delete it promptly. Users between 13 and 18 should use the Platform with parental or guardian awareness.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Platform. The “last updated” date at the top of this page reflects the most recent revision.

13. About the Co-Pilot Chrome Extension

When you install the ApplyFast Co-Pilot Chrome extension, it runs only on job application sites we support. The supported sites are: Workday (*.myworkdayjobs.com), iCIMS (*.icims.com), Taleo (*.taleo.net), BambooHR (*.bamboohr.com), JazzHR (*.jazzhr.com), Jobvite (*.jobvite.com), SmartRecruiters (*.smartrecruiters.com), Greenhouse (boards.greenhouse.io, job-boards.greenhouse.io), Lever (jobs.lever.co), and Ashby (jobs.ashbyhq.com).

On those sites, the extension:

Reads the application form fields and job description on the page you are viewing.
Does not read any other site, any background tabs, any pages without an application form, or any personal data outside the form.
Sends to our servers only the field labels and job metadata, so we can help you fill them. Field values stay in your browser until you choose to submit them. Answer text is sent to our AI provider only when you click the Smart Suggest button.
Stores locally your sign-in token (the same one the website uses) and your preferences. The token is wiped automatically when you close the browser.
Never presses Submit for you. You always click the Submit button on the application site yourself.

To remove the extension at any time, go to chrome://extensions in your browser and click Remove next to ApplyFast Co-Pilot.

14. Contact

For any privacy-related questions or to exercise your data rights, contact us at privacy@applyfast.app.