Privacy Policy

Who we are

Operator: see the Terms.

What we collect

• Account: your name and email address, a one-way hash of your password (never the password itself), and which version of the Terms you accepted and when.
• Resumes you upload (encrypted) and the text read from them.
• Job preferences: target titles, location, work arrangement, salary floor, skills, and optional details such as needing visa sponsorship or holding a security clearance. These are used only to filter your matches and are never shown to employers.
• Your activity: matches, saved and dismissed roles, posting reports, interview-practice sessions and AI reviews.
• Support messages: your name, email address, topic and message.
• Security records: sign-ins, password changes and similar events, with the IP address and browser type involved.
• If you buy application credits: the package, payment status and references (never card numbers), your credit balance and its history, and emails sent to your application address.

Matching works without your photo, date of birth, ID numbers or full home address, so you can leave them out of the resume you upload.

How we use it, and why we’re allowed to

• Running your account, matching you to jobs, reviewing your resume and preparing practice interviews — to provide the service you asked for (contract).
• Account emails (confirmation, welcome, password reset, security notices, purchase receipts, the notice when you delete your account) — needed to run your account (contract).
• Optional emails you switch on (for example “email me when my matches’ AI check is ready”, off by default) — your consent; switch them off any time in Account.
• Security logs, rate limits and abuse prevention — our legitimate interest in keeping your account and the service safe.
• Answering support messages — to deal with your request (contract or legitimate interest).

We do not sell or rent personal data, share it for advertising, or use it to train AI models.

AI processing

Resume reviews, second opinions on matches and interview practice are produced by an open-weight model (Qwen) that runs on hardware the operator controls, reached over a private, encrypted network. Your resume is not sent to third-party AI providers. AI output is automated and can be wrong: we check it for skills and credentials your resume doesn’t mention, but please review every suggestion before relying on it.

Job data

Job postings come from employers’ public job boards (Greenhouse, Lever and Ashby). An employer is shown only after we have checked that its official website links to that job board; the check is recorded and expires after 90 days unless it is renewed. ApplyHalo is not affiliated with or endorsed by these employers.

Who helps us run ApplyHalo

• Cloudflare, Inc. carries all traffic to applyhalo.com: it provides the network connection, encryption (HTTPS) and protection against attacks, and so processes your IP address and the details of each request. Cloudflare acts under its customer data processing addendum.
• Servers: our database, file storage and AI model run on machines the operator controls.
• Email: account emails are sent from our own mail server.
• Payments: Checkout isn’t open yet; once it opens, Stripe, Inc. will process payments for application credit packages; we store only the package, the payment status and references.

No one else receives your personal data, except where the law requires it. Employers receive nothing about you unless you approve an assisted application that needs it.

International transfers

Cloudflare operates data centers around the world, so your requests may pass through countries other than your own. Where the law requires safeguards for such transfers (for example from the EU, EEA or UK), Cloudflare’s data processing addendum provides them through the European Commission’s Standard Contractual Clauses.

Cookies and analytics

We use one essential cookie to keep you signed in (HttpOnly; it ends after 3 days without activity and after 14 days at most). While you confirm a new account, a second essential cookie (24 hours) lets the browser you signed up in finish without asking for your password again. There are no advertising cookies.

How you found us: if you arrive with a campaign tag in the address (utm_source and similar) or from another website, your browser keeps that tag or the other site’s name (never the full address) for this tab only, in session storage rather than a cookie, and sends it with your sign-up. We store it with your account to count which places bring sign-ups. Nothing is kept if your browser sends Global Privacy Control or Do Not Track, and it is deleted with your account.

We don’t use analytics. Our pages also ask Cloudflare not to add its analytics script or change page content.

Do Not Track and Global Privacy Control

We don’t track you across other websites and we don’t sell or share personal data for advertising. If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, we treat it as an opt-out (there is nothing to switch off today: we don’t use analytics).

How long we keep it

• Your account data, resumes, preferences, matches and practice sessions: until you delete them or your account. Each practice session has its own Delete button in the Interview lab, which removes its questions and the job text you entered at once.
• Sign-ups never confirmed: deleted after 7 days.
• Security logs: 1 year; the IP addresses in them are removed after 90 days.
• Signed-in sessions: end after 3 days without activity (14 days at most); their records are deleted 30 days later.
• Support messages: deleted 12 months after they arrive.
• Deleting your account removes your data from our live database and file storage immediately. Encrypted backups are deleted within 16 days. We keep a record that a deletion happened, without your name, email address or IP address.

Your choices and rights

• Download everything we hold about you: Dashboard → Account → “Export my data”.
• Correct your profile and preferences at any time, and delete individual resumes in the Resume page.
• Delete your account: Dashboard → Account → “Delete account”.
• Withdraw consent (for example to sign-up notifications).

Depending on where you live — for example under the EU or UK GDPR, or California’s privacy laws (CCPA/CPRA) — you may also have the right to access, correct, delete or move your data, and to restrict or object to how we use it. To use any of these rights, contact us as described below. We answer within 30 days and may need to confirm that the request comes from you. Using your rights never costs you anything or changes how we treat you.

Complaints: you can complain to a data protection authority — for example your national authority in the EU or EEA, the Information Commissioner’s Office (ICO) in the UK, or the California Privacy Protection Agency. We’d be grateful for the chance to put things right first.

Age

ApplyHalo is for people aged 16 and over. We don’t knowingly collect data from anyone younger; if you think someone under 16 has signed up, contact us and we will delete the account.

Security

Resume files and their text are encrypted at rest (AES-256-GCM). Passwords are stored only as bcrypt hashes. Connections use HTTPS. Uploaded files are read in an isolated process that cannot reach other data. Staff access to application documents is limited to paid, approved applications and is logged. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top, show a notice in the app and email account holders before the change takes effect.

Contact

Use the support form (topic “Privacy or data request”), and a person will read your message.