Privacy policy

1. Introduction

japply.io ("japply", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services at japply.io.

The data controller is Herizon Oy (Business ID 3418543-7), PL 30, 02211 Espoo, Finland. You can reach us about privacy matters at [email protected].

2. Information we collect

Account information

When you create an account, we collect your email address and, optionally, your full name. If you sign in with Google, we receive your name and email from Google.

Resume and application data

We store the content you create using our platform, including resumes, cover letters, interview preparation data, and job application tracking information. This data is stored securely in your account and is only accessible by you. Generated cover letters, quick-apply applications, interview preps and interview simulations are saved to your account automatically. You can delete them at any time, and they are deleted with your account.

Payment information

Payment processing is handled by Stripe. We do not store your credit card numbers or payment details on our servers. Stripe's privacy policy governs the collection and use of your payment information. Stripe retains payment records according to its own policy, so some payment records may remain with Stripe after you delete your account.

Usage data

We collect usage events to improve our services, including pages visited, features used, and general interaction patterns. When you are signed in, these events are linked to your account ID. We do not track individual behavior across other websites.

3. How we use your information

• To provide and maintain our services
• To process your transactions and send purchase confirmations
• To generate AI-powered content (resumes, cover letters, interview questions) using Anthropic's Claude API
• To send transactional emails (account creation, password reset, purchase receipts)
• To send marketing emails (job matches, tips and product updates) only if you have opted in. The legal basis is your consent, which you can withdraw at any time with the unsubscribe link in each email or in your account settings
• To improve our services and user experience

Legal bases (GDPR Art. 6)

• Contract: creating and running your account, providing the Service you ask for (resumes, AI features, applications) and processing purchases
• Legitimate interest: keeping the Service secure and preventing abuse, privacy-friendly analytics, and error monitoring. You can object at any time (see Your Rights)
• Consent: marketing emails, which you can withdraw at any time
• Legal obligation: bookkeeping and tax records for purchases

4. AI processing

When you use our AI features, your resume content and job descriptions are sent to Anthropic's Claude API for processing. Anthropic does not use data submitted through their API to train their models. Cover letters, quick-apply applications, interview preps and interview simulations you generate are saved to your account automatically; other AI output is not stored unless you save it.

5. Data sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with:

• Hetzner Online GmbH: server hosting (Nuremberg, Germany). Our application and database run on infrastructure we operate ourselves; Hetzner provides the servers.
• Anthropic: AI content generation (resume content, including any contact details you put in it, for import parsing and the AI generators)
• Stripe: payment processing
• Resend: delivery of transactional emails and, if you have opted in, marketing emails
• Cloudflare: CDN and DDoS protection; traffic to japply.io passes through their network
• Glyphex (glyphex.io): privacy-friendly website analytics (page views and general usage), without cookies
• PostHog (posthog.com, EU): product analytics and session recordings with all form inputs masked, stored in the EU; the identifier is kept in memory only, with no cookies
• Edgelord (edgelord.tech): our error-monitoring service and feedback widget, which receives error reports and any feedback you choose to send

6. Data security

We implement industry-standard security measures including:

• Encrypted data transmission (HTTPS/TLS)
• Ownership checks on every request that reads or writes your data, so one account cannot reach another's records
• Passwords stored only as salted hashes; sessions issued and validated server-side
• No storage of payment credentials

7. Your rights

You have the right to:

• Access your personal data through your account settings
• Export your resumes as PDF, DOCX, or TXT files
• Delete your account and all associated data at any time from Settings
• Correct any inaccurate information in your profile
• Data portability: receive the data you provided in a structured, commonly used format
• Restrict the processing of your data in the cases set out in the GDPR
• Object to processing based on legitimate interest, and withdraw consent to marketing at any time

To use these rights, contact [email protected]. You also have the right to lodge a complaint with a supervisory authority. In Finland this is the Data Protection Ombudsman (tietosuoja.fi).

Providing your email address is necessary to create an account. Everything else you enter is optional, but some features need it to work.

8. Data retention

We retain your data for as long as your account is active. When you delete your account, all your data (resumes, cover letters, applications, tokens, profile, feedback messages) is permanently deleted within 30 days.

9. Cookies

We use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies. Our analytics (Glyphex and PostHog) do not use cookies.

Your browser's local storage holds your theme preference (light/dark mode), unsaved resume drafts and the state of some tools, so your work is not lost if you leave the page. A random anonymous identifier used for our own usage events is kept in session storage and is removed when you close the tab. You can clear local and session storage in your browser settings at any time.

Marketing emails, if you have opted in, contain click-tracking links that tell us whether an email was opened or a link was clicked.

10. International users

japply.io serves users in multiple countries and supports 6 languages (English, Finnish, German, French, Spanish, Swedish). Our servers are located in Germany (Hetzner, Nuremberg), within the EU. Some of our sub-processors (Anthropic, Stripe, Resend and Cloudflare) process data outside the EU under their respective transfer safeguards. Your data is processed in accordance with GDPR principles regardless of your location.

11. Children's privacy

Our services are not directed to individuals under 16. We do not knowingly collect information from children under 16.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our website.

13. Contact

For privacy-related questions, contact us at [email protected].