Privacy policy

1. Who we are

ApplyStory is an AI-first hiring platform operated by ApplyStory. When you use our website or the product, ApplyStory is the data controller for account and website data, and the data processor for candidate application data on behalf of the hiring company you applied to.

2. What we collect

• Account data: name, email, company, password hash, authentication provider metadata.
• Application data: candidate name, email, answers, uploaded files, and recorded video or screen submissions.
• Derived data: transcripts, AI-generated summaries, scores and search embeddings.
• Usage data: pages visited, searches, Copilot queries, feature toggles, IP address, and user agent.
• Billing data: plan, invoices and payment tokens. Card numbers are handled directly by Stripe and never touch our servers.

3. How we use it

• Deliver the hiring workflow (posting jobs, receiving applications, reviewing candidates).
• Run AI transcription, scoring and search over application content to help recruiters shortlist faster.
• Send transactional emails such as application confirmations, team invites and password resets.
• Bill recruiters based on plan and top-up usage.
• Prevent fraud, abuse and unauthorized access.

4. Legal bases (EEA / UK)

We process personal data under one of the following legal bases: performance of a contract (running the service you signed up for), our legitimate interests (security, product improvement, service communications), your consent (optional analytics and marketing emails) and compliance with legal obligations (tax, accounting, responding to lawful requests).

5. Sharing and sub-processors

We do not sell personal data. We share limited data with sub-processors that power the product: hosting and database (Supabase, Cloudflare), AI inference (Google, OpenAI), email delivery (Resend), and payments (Stripe). Candidate submissions are only visible to the hiring company that received them and to ApplyStory staff strictly for support and abuse investigations.

6. International transfers

Personal data may be processed in the United States or other countries where our sub-processors operate. Transfers rely on Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

7. Retention

Application content is retained while the associated job is active, and for a reasonable period after for hiring records unless the hiring company deletes it earlier. Deleting an account removes associated candidate submissions. Backups follow our standard rotation and are purged on schedule.

8. Your rights

Depending on your location, you have rights of access, rectification, erasure, restriction, portability and objection. You can exercise them by emailing privacy@applystory.com. Candidates can also contact the hiring company they applied to directly. You have the right to complain to your local supervisory authority.

9. Security

We use encryption in transit and at rest, row-level security on every tenant table, least-privilege access controls and audit logging. No system is perfectly secure, but we treat this as a first-class engineering concern.

10. Changes

We will update this policy from time to time. Material changes will be announced by email or in-product notice.

11. Contact

Questions? Reach us at privacy@applystory.com.