Information you provide directly

• Account: email, phone, name, and authentication credentials via Google OAuth, email magic link, or phone one-time password.
• Profile: resume content, work history, education, skills, languages, certifications, portfolio links, and professional achievements.
• Job preferences: target roles, locations, salary expectations, work arrangements, and the rules that govern which applications we submit for you.
• Vault credentials: usernames and passwords for third-party job platforms (LinkedIn, company career portals, applicant tracking systems) that you choose to connect. Encrypted at rest using AES-256 and decrypted only inside the isolated environment that runs your browser agent session.
• Payment information: billing name, country, and card details. Card numbers are stored by our payment processor; we receive only a token and the last four digits.
• Communications: messages you send us, support tickets, and survey responses.

Information we generate while you use the Service

• Application records: which jobs were discovered, which were applied to, submission outcomes, screenshots of the browser agent's actions, and timestamps.
• AI-generated content: answers and cover letters our models produce from your profile for a specific application.
• Usage data: feature interactions, session duration, and error reports.

Information collected automatically

• Device and technical data: IP address, browser type, operating system, language, approximate location from IP.
• Cookies and similar technologies (see the Cookies section further down).

What we do with your data

• Operate the Service, including discovering relevant jobs and submitting applications on your behalf.
• Personalize your experience and improve the accuracy of job matching and AI-generated answers.
• Communicate with you about your account, applications, Service updates, and support.
• Process subscriptions, payments, renewals, refunds, and tax compliance.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Measure and improve product performance, including through privacy-preserving analytics.
• Comply with legal obligations and enforce our Terms of Service.

AI and automated processing

The Service uses artificial intelligence and a browser agent to read job postings, generate application answers from your profile, and fill in and submit application forms.

• We do not use your personal information to train general-purpose AI models. All model inference runs on infrastructure we control (RunPod GPU hosts); we do not use any third-party AI provider like OpenAI or Anthropic.
• The Service does not make legally or similarly significant decisions about you. It acts on your instructions, under the rules you configure, to submit applications you have authorized.
• You can review, edit, or delete any AI-generated content, pause the autopilot at any time, and turn off AI-assisted answers in your settings.
• If you are a California resident, you have the right to opt out of automated decision-making technology used to make significant decisions about you. Contact hello@applying.sucks to exercise this right.
• If you are in the EEA or UK, you have the right under GDPR Article 22 not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The Service is designed so that you authorize each category of application activity and can intervene at any time.

Legal bases (EEA / UK)

• Performance of a contract with you, to deliver the Service, including submitting applications on your behalf.
• Legitimate interests, to secure the Service, prevent fraud and abuse, measure and improve features, and communicate with you about your account.
• Consent, for optional features such as connecting your Gmail account, non-essential analytics cookies, or marketing communications. You can withdraw consent at any time.
• Compliance with a legal obligation, for example tax, accounting, or lawful-disclosure requirements.

Employers and job platforms

When you authorize the Service to apply on your behalf, we submit the information from your profile (plus any answers you or the AI generated) to the specific employer or job platform hosting that application. Those third parties become independent controllers of the information they receive and process it under their own privacy policies.

Service providers (subprocessors)

We use trusted vendors under written data processing agreements:

• Supabase: authentication, database, and object storage.
• Amazon Web Services: cloud infrastructure, storage, and content delivery.
• RunPod: hosted GPU inference for our self-managed AI models.
• Stripe: payment processing and billing.
• Google: Google OAuth sign-in and optional Gmail integration.
• Twilio: phone one-time-password delivery (via Supabase Auth).
• Capsolver: CAPTCHA solving for automated application flows.
• PostHog (EU instance, hosted in Frankfurt): product analytics, session replays for the authenticated app, and feature experimentation.
• Tawk.to: embedded live chat widget inside the authenticated app.

Legal, safety, and compliance

We may disclose personal information when required by law, subpoena, or governmental authority, or when we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others, to prevent fraud, or to enforce our Terms of Service.

Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any material change that results.

International transfers

We and our subprocessors may process personal information in countries other than the one in which you live, including the United States. When transferring personal data out of the EEA, UK, or Switzerland, we rely on valid transfer mechanisms, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU-U.S. Data Privacy Framework where applicable. You can request a copy of the relevant transfer safeguards by writing to hello@applying.sucks.

Other services you authorize

You can connect the Service, at your direction, to Gmail, Google Calendar, LinkedIn, and job-platform accounts. We access only the data needed for the feature you enabled, handle tokens in accordance with the provider's requirements (including the Google API Services User Data Policy), and do not use data obtained through these connections for advertising. Revoke any connection at any time from your account settings or the provider's permissions page.

Security

We use technical and organizational measures including TLS encryption in transit, encryption at rest, AES-256 encryption for Vault credentials, scoped access controls, least-privilege service accounts, secret rotation, isolated execution environments for browser agent sessions, and continuous monitoring. If we become aware of a personal data breach, we will notify the competent supervisory authority and you where required by law, without undue delay and, where feasible, within 72 hours of becoming aware. No system is perfectly secure.

Retention periods

• Account, profile, and preferences: while your account is active, plus up to 30 days after deletion.
• Application history: up to 24 months after the application was submitted, then deleted or de-identified.
• Vault credentials: until you remove them or delete your account.
• Billing records: as required by tax and accounting laws (typically 6–10 years).
• Security logs: up to 12 months, or longer if needed to investigate an incident.
• Backups: up to 35 days after deletion from primary systems.

Cookies and tracking

• Strictly necessary: keep you signed in, secure your session, and remember preferences on the website and the authenticated app.
• Product analytics: inside the authenticated app (app.applying.sucks) we use PostHog (EU instance) to understand feature usage, reproduce bugs via session replay, and run experiments.
• Live chat: inside the authenticated app we embed Tawk.to so you can message us for support; it sets its own cookies to remember the chat session.

We do not use advertising cookies, retargeting pixels, or cross-site behavioral tracking. The public marketing site at applying.sucks does not set analytics cookies. You can manage non-essential cookies through your browser settings, and we honor Global Privacy Control signals as an opt-out where that right applies. We are working on a granular cookie-consent banner for users in the EU/EEA and California; until it is live you can email hello@applying.sucks to opt out of product analytics and we will disable PostHog tracking for your account.

Privacy of minors

The Service is not directed to, and we do not knowingly collect personal information from, individuals under 18. If you believe a minor has provided us with personal information, contact hello@applying.sucks and we will delete it promptly.

Changes and contact

We may update this Privacy Policy. If changes are material we will notify you by email or through the Service and update the "Last updated" date at the top. Continued use after the update constitutes acceptance.

Questions? Write to hello@applying.sucks or by post to Marc Amorós, Josep Irla 117, 08195 Sant Cugat del Vallès, Spain.