Privacy policy

This policy describes how AutoApply handles personal data. It is written to be read rather than to be legally impressive, and it describes what the service actually does today. Where something is not yet settled, it says so.

If anything here is unclear, write to karentia@maoertech.cn.

The short version

To apply for jobs on your behalf, we need the same information an employer's application form needs — and we send it to those employers. That is the whole purpose of the service, and it is the main thing that happens to your data. We do not sell it, and we do not have your job-board account passwords.

Who is responsible for your data

AutoApply is the controller of the personal data described here. Contact for any privacy question or request: karentia@maoertech.cn.

What we collect

Account details. Your email address and name. If you sign in with Google, we receive your email address, name and profile picture from Google. If you use a password, we store a cryptographic hash of it, never the password itself.

Your job-search profile. The résumé file you upload and the text extracted from it; your contact details, location, and links you provide; your work authorisation status, notice period and salary expectations; and any additional material you give us to write from.

Your search criteria. Job titles, locations, remote preferences, salary floor, company size, companies to exclude, and the answers you save to common application questions.

Application records. For every application: the job posting and a snapshot of it as it appeared, the exact information submitted, the time of submission, and the confirmation page or email we received.

Employer replies. We create a forwarding address for you and read the replies sent to it, in order to update the status of your applications and include them in your reports. Those messages are personal data and are stored with your account.

Billing information. Handled by Stripe. We receive the subscription status, plan, and the last four digits and brand of the card for your reference. We never receive or store full card numbers.

Technical logs. Server logs containing IP address, user agent, timestamps and error information, kept for security and debugging.

What we do not collect

• Passwords for LinkedIn, Indeed or any other job board. We do not ask for them and the service does not use them.
• Your email mailbox. We read replies sent to the forwarding address we create. We do not connect to, or read, your own inbox.
• Special-category data (health, religion, political opinions and so on) is not something we ask for. If you choose to put it in your résumé or in an answer, it will be submitted to employers along with the rest.

Why we are allowed to use it

Under the GDPR and equivalent laws, our legal bases are:

• Performance of a contract — everything needed to run your account, match jobs, submit applications, store evidence and send your reports. This is the bulk of it.
• Legitimate interests — security logging, fraud and abuse prevention, and debugging. We limit these to what is necessary and keep them short-lived.
• Legal obligation — keeping billing records for the period tax law requires.
• Consent — for anything optional we ask you about separately, such as being contacted about a product change you asked to hear about. You can withdraw consent at any time.

Who we send it to

Employers you apply to, and the systems they use. This is the point of the service. Everything you submit becomes theirs to process under their own privacy policies, including the applicant tracking systems they run (for example Greenhouse, Lever, Ashby, Workday, SmartRecruiters). We cannot delete an application on your behalf once it has been submitted; you would need to ask that employer.

AI model providers. To write answers to employers' open questions, tailor a résumé, or draft a cover letter, the relevant parts of your profile and the job posting are sent to a third-party large-language-model provider. This is a real transfer of your personal data to a third party and you should know about it. We use providers that do not train their models on data sent through their business APIs.

A web search provider. The "recruiter contact" tool looks for hiring contacts that companies have published publicly. When you use that tool, the company name and job title you typed are sent to a third-party search API so we can retrieve public pages. Nothing from your résumé or your profile is included in that query, and the tool is only used when you ask for it.

Infrastructure providers, acting as processors under contract:

• Hosting and application delivery.
• A managed Postgres database.
• File storage for résumés and evidence.
• An email delivery provider, for reports and for receiving employer replies.
• Stripe, for payments.

Nobody else. We do not sell personal data, we do not share it with advertisers, and we do not use your résumé to train anything of our own.

Where your data is

Our infrastructure providers operate in the United States and the European Union. If you are in the EU, the UK or another jurisdiction with transfer restrictions, transfers outside your region rely on the standard contractual clauses in our agreements with those providers.

The employers you apply to may be anywhere, because that is where the jobs are.

How long we keep it

• Account and profile data: while your account exists. Deleting the account removes it immediately — there is no grace period and no soft-deleted copy.
• Application records and evidence: for as long as your account exists, because their whole purpose is that you can check them later. Deleted with your account.
• Employer replies: parsed status and metadata remain with application records; the raw MIME original is retained for 30 days for classification diagnostics, then deleted while the parsed record remains.
• Billing records: as long as tax and accounting law requires, typically several years, and separately from your profile.
• Server logs: 30 days.

Backups are retained for a short period and overwritten on a rolling basis, so deleted data can persist in backups for a little longer before being cycled out.

Your rights

Wherever you live, you can ask us to:

• Give you a copy of what we hold about you.
• Correct anything that is wrong.
• Delete your account and the data attached to it.
• Export your data in a portable format.
• Restrict or object to specific processing.

Two of these you can do yourself, right now, from Settings → Your data: download a machine-readable copy of everything we hold about you, and delete your account. Deleting removes your profile, copilots, applications and evidence, your stored CV and the raw employer replies, and cancels any active subscription immediately.

For anything else — correction, restriction, objection — write to karentia@maoertech.cn from the address on your account and we will action it. We aim to respond within 30 days, which is the deadline the GDPR sets.

Two honest limits: we cannot retract applications already submitted to employers, and we cannot delete data an employer now holds — you would need to contact them.

If you are in the EU or UK and think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first.

Cookies

We use cookies that are necessary for the service: a session cookie to keep you signed in, and a security cookie to prevent cross-site request forgery. We do not use advertising cookies or third-party tracking pixels on the site.

Automated decisions

Matching and scoring jobs against your criteria is automated, and answers to employers' questions are drafted automatically. Those decisions determine which jobs are applied to on your behalf; they have no legal effect on you, and you can switch a copilot to review mode so nothing is submitted without your approval. Every match shows the reasoning behind it.

Decisions about your application are made by the employer, not by us.

Children

The service is not for people under 18, and we do not knowingly collect data from them.

Changes

If this policy changes in a way that affects you materially, we will email the address on your account before the change takes effect. The date at the top always shows the current version.