Privacy Policy

Last updated: 16 August 2026

AutoApply exists to apply to jobs for you. That only works if we hold your career information and pass it to the employers you choose, so this page says what we collect, why, who receives it, how long we keep it, and how to take it out or delete it. AutoApply is operated from India by Rakib Ansari, and we are responsible for the data described below.

1. What we collect

• Account: your email address, and your password stored only as a cryptographic hash we cannot reverse. Sign in with Google instead and we receive the email address on that account, nothing more.
• Career profile: your resume file and the text we pull out of it, plus your name, phone, location, links such as LinkedIn or GitHub, and the career facts and screening answers you save. Notice period, expected salary and work authorization are the usual ones.
• Equal-opportunity answers, only if you choose to enter them: gender, race or ethnicity, veteran status, disability status and pronouns. US and UK application forms ask for these, so Settings has a field for each with a "Prefer not to say" option. They are special category data, so we treat them that way: stored for one purpose, filling the forms you told us to fill, never used for matching or scoring, held back from every AI request, and leaving all of them blank costs you nothing here. They reach an employer only inside an application you asked us to send.
• Applications: which jobs you applied to, when, what was submitted, the exact answer given to each question, and how it went.
• Payments: your plan and your payment records. Card and UPI details are entered on Razorpay's side and never touch our servers.
• Technical: server logs holding an IP address, a timestamp and the endpoint called, used for security and for working out what broke. We run no advertising and no cross-site tracking. There is no non-essential cookie to consent to either: the only two we set are the one that keeps you signed in and a short-lived one used while you sign in with Google. Our own product counters, things like signups and resumes uploaded, are rows in our database rather than a third-party tag.

2. Why we collect it (and the legal basis)

• To match you with jobs and fill in application forms. The basis is your consent, ticked at signup and withdrawable at any time by deleting your account.
• To run your account, take payment, and send the email the service needs: address verification, password resets, the alerts you asked for, and a note when an application is waiting on you.
• To keep the Service standing up. Rate limiting and abuse prevention use the technical data above.
• To meet a legal obligation, which is what the payment records are for.

We have never sold personal data and do not intend to. Your resume goes nowhere except to the recipients named next.

3. Who your data reaches

Each of them processes data only to provide its service to us, and no other third party receives your personal data. We do not train models on it. What a provider does with the traffic we send is governed by that provider's own terms.

Once an application reaches an employer, that employer is responsible for it under their own privacy policy. What they do with it after that is outside this policy and outside our hands.

Forwarded verification codes, if you switch that on

Some employers email you a code before they will accept an application. Under Settings you can switch on a feature that gives you a private forwarding address at our domain and asks you to build one Gmail filter that sends those employer emails to it. It is off unless you set it up, and you can undo it from Settings or by deleting the filter in Gmail.

• We receive only what your own filter sends us. We have no access to your mailbox, no Google sign-in, and no way to read anything you did not forward.
• A forwarded email from any sender other than the employer systems we recognise is discarded without being read.
• We take one verification code out of the message, use it to finish the application you already asked for, and keep nothing. The message is not stored, and its contents are not written to our logs.
• If we cannot tell which application a code belongs to, we do nothing and the application waits for you, exactly as it does with this feature switched off.

4. Where we keep it, and for how long

• It sits in one database on one server in the European Union, encrypted in transit. Passwords are hashed, and stored provider credentials are encrypted at rest. The Security page has the mechanics.
• Some recipients in section 3 process data outside India and outside the EU. That is how the AI providers and the email sender work, and using the Service means you are content with it.
• We keep your data while your account exists. Delete the account and it is erased straight away, except for the three records named in section 5: payment records, the free-allowance hash, and one admin-only copy of the account kept for the service's records. Backups, which only the server's administrative account can read, roll off within seven days.
• An application already delivered to an employer lives in that employer's systems under their policy. We cannot recall it, and deleting your account here does not reach it.

5. Your rights

These work today, from Settings → Privacy. None of them needs an email to us or our permission.

• Get a copy. Export downloads one file holding your account, profile, preferences, saved answers, applications, alerts, saved searches and payment records.
• Delete. Deleting your account erases it immediately, and cancels any live subscription first so nothing can keep charging an account that no longer exists. Three records survive the deletion, described just below.
• Correct. Every fact we hold about you is editable in Profile, and editing it there is how you correct it.
• Withdraw consent. Turn off automatic submission, stop applying, or delete the account. Consent is exactly as easy to take back as it was to give.
• Nominate someone. India's DPDP Act lets you name a person to exercise these rights for you if you die or become unable to act. Tell the grievance officer in section 6 and we record it against your account.

Three things survive deletion on purpose, and you should know all three before you press it. Payment records stay, because financial records have to. A one-way keyed hash of your email address also stays, carrying a single number: how much of the lifetime free allowance that address has used. The hash cannot be turned back into an address and identifies nobody. It is there so the free allowance cannot be reset by deleting an account and signing up again.

The third is a copy of the account itself. Before the wipe we keep one snapshot holding your account details, your profile, the text of your resume (the resume file itself is deleted), and the answers you saved for application forms. Only the service administrator can read it. It is kept for the service's records: our own account of who we applied for and with what details. The delete screen tells you this before you confirm.

6. Grievances (India DPDP Act)

For anything about your data, a question or a complaint, write to the grievance officer at [email protected] with "Grievance" in the subject. We acknowledge within 72 hours and aim to close it within 30 days. If our answer does not satisfy you, you can take the matter to the Data Protection Board of India.

Should a breach ever affect your personal data, we will tell you and the relevant authority as the law requires.

7. What we need from you

This runs both ways. What we hold is what you gave us, and we fill employers' forms with exactly that, so the details need to be true and they need to stay current. The DPDP Act puts the same duty on you in its own words: no false particulars, and no impersonating anyone. Keep your password to yourself. If something we hold about you is wrong, Settings is where you fix it.

8. Children

The Service is for people old enough to work and to hold an account. It is not built for children and we do not knowingly collect their data. If you think a child has an account here, write to the address in section 6 and we will remove it.

9. Changes

When this policy changes, the date at the top changes with it, and anything material is announced in the product or by email. The version on this page is always the current one.

Contact: [email protected]. How this is protected in practice: Security.