Data processing agreement
Last updated July 21, 2026. This DPA supplements our Terms of service and applies whenever ApplyStory processes personal data on behalf of a customer.
1. Roles of the parties
You (the customer) are the data controller for personal data you upload or that candidates submit through your ApplyStory workspace. ApplyStory acts as data processor and processes that personal data only on documented instructions from you, which include your use of the service and these terms.
2. Scope and duration
This DPA applies for the duration of your subscription. Categories of data subjects include your candidates and team members. Categories of personal data include contact details, application content (text, files, video, screen recordings), transcripts, AI-generated scores and usage metadata.
3. Sub-processors
We use a limited set of sub-processors to deliver the service: hosting and database (Supabase, Cloudflare), AI inference (Google, OpenAI via secure APIs), email delivery (Resend), and payments (Stripe). A current list is available on request. We remain responsible for our sub-processors and require equivalent data protection commitments from each of them.
4. Security
We maintain technical and organizational measures including encryption in transit, encryption at rest, role-based access controls, row-level security on every tenant table, audit logging, least-privilege access, and regular reviews of security posture.
5. International transfers
Where personal data is transferred outside the EEA or the UK, transfers are covered by Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.
6. Data subject requests
We assist you in fulfilling data subject rights (access, rectification, deletion, portability) through in-product controls and support. You can delete jobs, applications and accounts at any time from the dashboard.
7. Data breach notification
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and provide the information you need to meet your own notification obligations.
8. Deletion and return
On termination, we delete customer personal data within a reasonable period unless retention is required by law. Backups follow our standard rotation and are purged on schedule.
9. Contact
To execute a counter-signed DPA, or for privacy questions, email privacy@applystory.com.