1. Introduction & Australian Privacy Principles (APPs) Commitment
ApplyLab ("we", "our", or "us") operates the AI Job Application Copilot service. We are committed to protecting the privacy of job seekers, candidates, and visitors. This Privacy Policy sets out how we collect, hold, use, disclosure, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).
By creating an account, uploading career history, pasting job descriptions, or using ApplyLab, you consent to the data practices described in this policy.
2. Information We Collect
To provide tailored resumes, Australian standard cover letters, and interview coaching, we collect the following categories of personal information:
A. Account & Contact Information
Your full name, email address, password hash, and OAuth authentication tokens (e.g. Google Sign-In IDs).
B. Master Career Profile & Professional Data
Employment history (role titles, company names, dates of employment, responsibilities, bulleted achievements), educational background, formal qualifications, licences, skills repository, contact phone numbers, addresses, and any uploaded resume documents (PDF, DOCX).
C. Job Application Data
Target job descriptions pasted or imported from SEEK, LinkedIn, or employer portals, extracted key selection criteria, generated tailored resumes, cover letters, and practice interview responses.
D. Billing & Transaction Information
Subscription status, tier history, and transaction receipts. All payment transactions are processed securely via Stripe Inc. Raw credit card numbers are never stored on ApplyLab servers.
E. Technical & Telemetry Data
IP addresses, browser type, device information, operating system, and authentication session cookies strictly required for platform operation.
3. How We Use Artificial Intelligence & Third-Party LLMs
ApplyLab uses AI models from the following providers, through their paid business APIs:
- Anthropic (Claude) and OpenAI: resume and cover letter writing, resume scoring and review, reading job ads and uploaded resumes, and matching you to job listings.
- Google (Gemini and Cloud Text-to-Speech): interview practice questions, feedback on your answers, application answer suggestions in the browser extension, and reading interview questions aloud.
- Not used for training: under these providers' business API terms, the data we send is not used to train or improve their AI models.
- Limited retention by providers: providers may keep what we send for a limited period to detect misuse of their services, as set out in their terms, and then delete it. They may not use it for any other purpose.
- Strict Fact Grounding (Anti-Hallucination): Our proprietary system prompts require AI model outputs to strictly reference verified facts from your Master Career Profile.
- No Autonomous Legal or Employment Decisions: ApplyLab tools generate draft content for your review. You retain full editorial control over every resume and application document prior to submission.
4. How We Use Your Information
We use your personal information solely for the following business purposes:
- Generating 1-page ATS-optimised resumes and Australian-tailored cover letters.
- Parsing SEEK and LinkedIn job ads to extract selection criteria and calculate match percentages.
- Generating role-specific STAR method interview practice questions and feedback scores.
- Processing subscription payments and managing account billing via Stripe.
- Sending critical technical service updates, security notifications, and billing receipts.
- Preventing platform abuse, fraudulent transactions, and unauthorised access.
- Understanding how ApplyLab is used (which pages and features, and where people get stuck) so we can improve it, and spotting errors.
5. Third-Party Sub-Processors & Infrastructure
We store and process data using vetted, enterprise-grade cloud providers adhering to SOC 2 Type II, ISO 27001, and PCI-DSS standards.
| Sub-Processor | Role & Purpose | Security / Standards |
|---|---|---|
| Supabase / AWS (South Korea) | Database hosting, authentication, user data storage | AES-256 at rest, TLS 1.3 in transit |
| Vercel Inc. | Next.js application hosting & edge runtime | SOC 2 Type II, ISO 27001 |
| Stripe Inc. | Payment processing & customer billing portal | PCI-DSS Level 1 Compliant |
| Anthropic PBC (USA) | AI writing, scoring and document reading (profile, resume, job ad text) | Business API; not used for model training |
| OpenAI (USA) | AI writing and document reading; job matching (profile and job ad text) | Business API; not used for model training |
| Google LLC (USA) | Gemini for interview practice and answer suggestions; Cloud Text-to-Speech for reading questions aloud | Paid business API; not used for model training |
| Cloudflare Inc. (USA) | Turnstile bot check on sign-up, log-in and uploads (IP address and browser signals) | SOC 2 Type II, ISO 27001 |
| PostHog Inc. (EU hosting) | Product analytics and error reports: pages visited, features used, browser and device type, IP address and an account ID. Never your name, email or resume content | Data held in the EU (GDPR) |
| Adzuna (UK) | Job listings for Job Matcher. Receives only the job titles you search for, never your name or contact details | No personal information shared |
6. Data Retention, Export & "Right to Be Forgotten"
We retain your career data for as long as your account remains active. You maintain total ownership over your information:
- Data Export: You can export your full Master Career Profile and generated documents at any time in JSON, PDF, or editable DOCX formats.
- Account Deletion: You can initiate account deletion at any time via your Account settings. Upon confirmation, your account, career profile, resumes, cover letters, applications, interview practice (including question audio) and uploaded files are deleted immediately. Encrypted database backups that may still contain them are overwritten within 30 days.
- Free resume score without an account: if you score a resume before creating an account, we keep the result for 2 days so it can be added to your account when you sign up or log in from the score page in the same browser. If it isn't added by then, it is deleted in our next daily clean-up.
- What we keep after deletion: your email address and how many free-plan uses you had made, so the free allowance can't be reset by deleting and re-creating an account. Billing records are kept by Stripe as required by tax law.
8. International Data Transfers (APP 8 Compliance)
As an Australian entity, we comply with Australian Privacy Principle 8 (Cross-border disclosure of personal information). Our operations are based in Australia, but your account data and files are stored in our database in South Korea (Amazon Web Services, Seoul region), and the other providers listed in section 5 process data in the United States, the European Union and the United Kingdom. In particular, the text sent to our AI providers (Anthropic, OpenAI and Google) is processed in the United States.
Before disclosing personal information to overseas cloud recipients, we ensure that overseas recipients are bound by contractually enforceable obligations to uphold privacy standards substantially similar to the APPs.
9. Contact Information & Privacy Complaints
If you have questions regarding this Privacy Policy, wish to request access to or correction of your personal information, or wish to lodge a privacy complaint, please contact our Data Privacy Officer:
ApplyLab Privacy Officer
Email: applylab.support@gmail.com
Address: ApplyLab Privacy Office, Sydney NSW, Australia
Escalation to OAIC
If you are not satisfied with our response to a privacy complaint, you may escalate your matter to the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992