Privacy Policy

Last Updated: 2026-07-10

This Privacy Policy explains how Apply All, Inc. ("ApplyAll," "we," "our," or "us") collects, uses, shares, and protects personal data when you use our website, platform, tenant-branded or white-label versions of the platform, custom-domain experiences, and related services (collectively, the "Services").

ApplyAll is a job application automation service. We apply to jobs on your behalf using the information you provide, supported by artificial intelligence and a human operations team. This policy applies to all users of our Services, including users located in the United Kingdom and European Economic Area.

1. Data Controller

The data controller responsible for your personal data is:

Apply All, Inc.
Los Angeles, CA, United States
Email: privacy@applyall.com

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at privacy@applyall.com.

For Services you access directly from ApplyAll, Apply All, Inc. is the operator of the platform and the controller responsible for the personal data we collect and use for those Services.

For tenant-branded Services, the school, career services organization, coach, staffing firm, employer, or other ApplyAll customer or partner that offers or administers your access (a "Tenant Organization") may also act as an independent controller for personal data it receives or uses. Where applicable, ApplyAll may act as a service provider or processor for that Tenant Organization.

UK and EU Contact

If you are located in the United Kingdom or the European Economic Area, you can exercise your rights and raise concerns by contacting us directly at privacy@applyall.com. Where we are required to appoint a representative in the UK or EU under Article 27 of the UK GDPR or EU GDPR, we will publish the representative's name and contact details in this section.

Tenant Organizations and Branded Services

You may access the Services through a Tenant Organization's branding, program, or custom domain. Apply All, Inc. operates the underlying ApplyAll platform, even when the experience uses the Tenant Organization's name, logo, domain, or support workflow.

2. What Data We Collect

2.1 Data You Provide

When you create an account and use our Services, you provide us with:

Account information: email address, password
Resume and professional information: your resume or CV (as a file and parsed content), including name, phone number, address, work experience, education history, skills, and certifications
Job preferences: desired job titles, preferred locations, salary expectations, remote work preference, employer blocklist
Work authorization: visa sponsorship needs, work authorization status, country of eligibility
Early career information (if applicable): GPA, graduation year and month, preferred coding language, open-source links, transcripts
Communication data: emails sent and received through your ApplyAll proxy inbox, and any messages you send to our support team
Payment information: processed by our third-party payment processor (we do not store card details)

2.1.1 Sensitive Personal Information

Some of the data above is considered sensitive personal information under certain privacy laws (including the California Consumer Privacy Act):

Work authorization and immigration status (e.g., visa sponsorship needs) — used only to answer work-authorization questions on job applications you have asked us to submit and to avoid applying to roles you are not eligible for
Contents of your proxy email inbox — used only to operate the proxy email service: submitting applications, forwarding employer communications to you, and tracking application outcomes (e.g., detecting interview requests and offers)
Academic records (transcripts, GPA, where you provide them) — used only to complete applications that request them

We use sensitive personal information only for the purposes above — that is, to provide the Services you request — and not to infer characteristics about you for unrelated purposes. We do not sell sensitive personal information or use it for cross-context behavioral advertising.

2.2 Data Collected Automatically

When you visit our website, we may collect:

Usage data: pages visited, features used, clicks, and interactions — collected via our product analytics provider (only with your consent)
Device and browser information: browser type, operating system, screen resolution
Referral data: how you arrived at our site (e.g., referral source, partner link)

2.3 Data from Third Parties

We may receive data about job listings from employer career pages, applicant tracking systems, and job boards. We do not purchase personal data about you from third parties.

3. How and Why We Use Your Data (Legal Basis)

Under UK GDPR, we must have a lawful basis for each way we process your personal data. The table below sets out our purposes and legal bases:

Purpose	Legal Basis
Creating and managing your account; providing the job application service	Contractual necessity — processing is necessary to perform our contract with you (Art. 6(1)(b))
Parsing your resume and matching you with relevant job listings using AI	Contractual necessity (Art. 6(1)(b))
Submitting job applications on your behalf and managing your proxy email inbox	Contractual necessity (Art. 6(1)(b))
Classifying emails received in your proxy inbox (using AI providers) to track application outcomes, such as interview requests and offers, and to power features like application status tracking and the Interview Guarantee	Contractual necessity (Art. 6(1)(b))
Processing payments and managing orders	Contractual necessity (Art. 6(1)(b))
Sending transactional emails (password resets, application updates, order confirmations)	Contractual necessity (Art. 6(1)(b))
Analytics and product improvement	Consent (Art. 6(1)(a))
Advertising conversion measurement — sharing a hashed version of your email address with Google Ads after a purchase (see Section 5.6)	Consent (Art. 6(1)(a)) — UK/EEA users are never included unless they opt in; you can change your choice at any time via "Your Privacy Choices" in the site footer
Referral and partner attribution tracking	Legitimate interest — understanding how users find us (Art. 6(1)(f))
Preventing fraud and ensuring platform security	Legitimate interest — protecting our service and users (Art. 6(1)(f))
Responding to legal requests and complying with legal obligations	Legal obligation (Art. 6(1)(c))

Where we rely on consent, you can withdraw it at any time (see Section 7). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Where we rely on legitimate interest, we have assessed that our interests do not override your rights and freedoms. You may object to processing based on legitimate interest at any time by contacting us.

4. Automated Decision-Making and AI

ApplyAll uses artificial intelligence to process your resume, match you with relevant job listings, and assist in preparing job applications. This involves:

Parsing your resume to extract structured information (skills, experience, education)
Comparing your profile against job requirements to identify relevant opportunities
Generating or adapting application materials for specific roles
Researching employers to inform application strategy

These processes are designed to assist — not replace — human decision-making. Our human operations team (ApplySquad) reviews and oversees the application process. The final decision on whether to hire you always rests with the employer, not our AI.

Under UK GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. If you believe any automated decision has significantly affected you, please contact us at privacy@applyall.com to request human review.

5. Who We Share Your Data With

We do not sell your personal data for money. We share your personal data only as necessary to provide the Services, as required by law, or — for one limited category described in Section 5.6 — to measure our own advertising, which you can opt out of at any time:

5.1 Employers and Job Platforms

We submit your resume and application information to employers and applicant tracking systems on your behalf. This is the core purpose of our service.

5.2 Tenant Organizations

If you access the Services through a Tenant Organization, we may share account information, profile and resume information, job preferences, application activity, support communications, and usage information with that Tenant Organization as needed to provide, administer, support, measure, and improve the service or program it offers to you.

5.3 Service Providers (Data Processors)

We use third-party service providers, located primarily in the United States, who process data on our behalf under Data Processing Agreements that restrict their use of your data to providing services to us. They fall into the following categories:

AI and language model providers — for resume parsing, job matching, email classification, and application preparation; they process resume content, job preferences, and proxy-inbox email content
Automated application agents — for filling out and submitting job application forms on your behalf using your resume and profile information
Cloud infrastructure providers — for hosting, database storage, and compute
Location services providers — for resolving and autocompleting the locations you enter in your job preferences
Payment processors — for secure payment handling; we never store your card details
Email delivery providers — for sending account and application-related emails
Proxy inbox providers — for hosting and managing your dedicated application email inbox
Product analytics providers — for understanding how users interact with our platform (consent-based)
Search infrastructure providers — for indexing and searching job listings (job data only)
Document conversion providers — for converting resume file formats
Observability providers — for monitoring service performance and reliability

You may request further information about the recipients of your personal data, including the safeguards used for international transfers, by contacting us at privacy@applyall.com.

5.4 Legal and Regulatory

We may disclose data if required by law, regulation, or legal process, or to protect our rights, privacy, safety, or property.

5.5 Aggregated and De-Identified Data

We may create aggregated and de-identified data from personal data — for example, statistics about job postings, application volumes, response rates, and labor-market trends. This data does not identify you and cannot reasonably be linked to you. We may use, disclose, and license aggregated and de-identified data for any lawful purpose, including analytics, research, benchmarking, and commercial data products. We maintain this data in de-identified form, do not attempt to re-identify it, and contractually prohibit recipients from attempting to re-identify it.

5.6 Advertising Measurement (Google Ads)

When you purchase an ApplyAll package, we may share your email address with Google Ads so Google can measure which of our ads lead to purchases (a feature called Enhanced Conversions). Before it is transmitted, your email address is converted into a hashed (privacy-protected) form by Google's measurement code running in your browser; Google does not receive it in plain text and uses it only to match the purchase to an ad interaction. We share nothing else for this purpose — never your resume, application history, job preferences, or proxy-inbox content.

This sharing is entirely optional and under your control:

If you are in the UK or EEA, we do not share this data unless you have expressly opted in.
You can opt in or out at any time using the Your Privacy Choices link in the footer of any page — no account required — or by emailing privacy@applyall.com.
We honor Global Privacy Control (GPC) browser signals: if your browser sends GPC, we do not share this data, regardless of any saved preference.

Under some US state privacy laws this disclosure may be considered "sharing" of personal information for cross-context behavioral advertising; see Section 8.2 for your opt-out rights.

6. International Data Transfers

ApplyAll is based in the United States. If you are located in the United Kingdom or European Economic Area, your personal data will be transferred to and processed in the United States and potentially other countries where our service providers operate.

We ensure that international transfers of personal data are protected by appropriate safeguards, including:

The UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework), where applicable
Standard Contractual Clauses approved by the UK Information Commissioner's Office
Data Processing Agreements with all service providers that process personal data

You may request a copy of the safeguards we use by contacting us at privacy@applyall.com.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15) — You can request a copy of all personal data we hold about you.
Right to rectification (Art. 16) — You can ask us to correct inaccurate or incomplete data. You can also update most information directly through your account dashboard.
Right to erasure (Art. 17) — You can request deletion of your personal data. You can also delete your account at any time from your dashboard, which permanently removes your personal data and anonymizes associated business records.
Right to restrict processing (Art. 18) — You can ask us to temporarily stop processing your data in certain circumstances (e.g., while we verify the accuracy of your data).
Right to data portability (Art. 20) — You can request your data in a structured, commonly used, machine-readable format. You can currently export your application data as CSV from your account.
Right to object (Art. 21) — You can object to processing based on legitimate interest. We will stop processing unless we demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3)) — Where we process data based on consent (such as analytics cookies), you can withdraw consent at any time via the cookie settings on our website or by contacting us.
Rights related to automated decision-making (Art. 22) — You have the right to request human review of any significant automated decisions. See Section 4.

How to Exercise Your Rights

To exercise any of these rights, email us at privacy@applyall.com. We will respond within one month of receiving your request. If your request is complex or we receive many requests, we may extend this by up to two additional months, and we will inform you of any extension.

We may ask you to verify your identity before fulfilling a request. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive. For tenant-branded accounts, we may coordinate with the applicable Tenant Organization to verify, route, or fulfill your request.

Right to Complain

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office
Website: ico.org.uk
Telephone: 0303 123 1113

8. Your US State Privacy Rights

If you are a resident of California or another US state with a comprehensive consumer privacy law, you have additional rights described in this section. This section supplements the rest of this Privacy Policy. Terms such as "sell," "share," and "sensitive personal information" have the meanings given in the California Consumer Privacy Act ("CCPA," as amended by the CPRA) and equivalent state laws.

8.1 Categories of Personal Information We Collect

In the last 12 months, we have collected the following categories of personal information. The sources, purposes, and recipients for each are described in Sections 2, 3, and 5 of this policy.

Category (CCPA)	Examples	Disclosed To
Identifiers	Name, email address, phone number, postal address	Employers (at your direction), service providers, Tenant Organizations; Google Ads (hashed email for ad measurement, unless you opt out — see Section 8.2)
Professional or employment-related information	Resume, work history, skills, certifications, job preferences, salary expectations	Employers (at your direction), service providers, Tenant Organizations
Education information	Education history, GPA, graduation date, transcripts	Employers (at your direction), service providers
Commercial information	Packages purchased, order history	Service providers (payment processing), Tenant Organizations
Internet or network activity	Pages visited, feature usage (with consent), device and browser information	Service providers (analytics)
Sensitive personal information	Work authorization / immigration status; contents of your proxy email inbox	Employers (at your direction), service providers
Inferences	Job-match relevance derived from your resume and preferences	Service providers; Tenant Organizations (application activity)

We do not sell your personal information for money, and we have not done so in the preceding 12 months. We "share" (as defined by the CPRA) one limited category of personal information: after a purchase, a hashed version of your email address may be disclosed to Google Ads to measure our advertising, as described in Section 5.6. We share nothing else, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

You have the right to opt out of this sharing at any time, and opting out never affects your service:

Use the Your Privacy Choices link in the footer of any page — this works whether or not you have an ApplyAll account, or
Email us at privacy@applyall.com, or
Turn on Global Privacy Control (GPC) in your browser — we treat the GPC signal as a valid opt-out request and will not share your data from that browser while it is active.

8.3 Limits on Sensitive Personal Information

We use sensitive personal information only for the purposes permitted by the CCPA — providing the Services you request and the related purposes described in Section 2.1.1. We do not use or disclose it to infer characteristics about you, so a "Limit the Use of My Sensitive Personal Information" link is not required.

8.4 Your Rights

Right to know / access — request the categories and specific pieces of personal information we have collected about you, the sources, purposes, and recipients.
Right to delete — request deletion of your personal information, subject to legal exceptions. You can also delete your account directly from your dashboard.
Right to correct — request correction of inaccurate personal information. Most profile information can be corrected directly in your dashboard.
Right to portability — request a copy of your personal information in a portable format.
Right to non-discrimination — we will not discriminate against you (e.g., deny services or charge different prices) for exercising any of these rights.

8.5 How to Exercise These Rights

Email us at privacy@applyall.com with your request. We will verify your identity (typically by confirming control of the email address associated with your account) and respond within 45 days, with one 45-day extension where reasonably necessary. You may designate an authorized agent to submit requests on your behalf; we may require proof of the agent's authorization and verification of your identity.

We honor Global Privacy Control (GPC) opt-out preference signals: when your browser sends GPC, we treat it as a valid request to opt out of the sharing described in Section 8.2 and will not share your email address with Google Ads from that browser, regardless of any saved preference. We do not currently respond to the older "Do Not Track" signal.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Account data and profile information: retained while your account is active and deleted when you delete your account
Resume data: retained while your account is active; deleted upon account deletion
Application records: anonymized (disassociated from your identity) upon account deletion and retained in de-identified form for the purposes described in Section 5.5
Payment and order records: anonymized upon account deletion; retained in anonymized form as required for financial record-keeping
Analytics data: retained according to our analytics provider's retention policies; identifiable data is deleted when you delete your account
Proxy email inbox: deleted upon account deletion

You can delete your account at any time from your dashboard. Upon deletion, all personal data is permanently removed and business records are anonymized so they can no longer be linked to you.

10. Cookies and Tracking Technologies

We may set cookies and analytics technologies on ApplyAll domains and, where applicable, on custom domains used by Tenant Organizations to host or administer the Services.

10.1 Essential Cookies

These cookies are necessary for the website to function and cannot be switched off:

Session cookie — authenticates you and keeps you logged in
Cookie consent preference — remembers your cookie choices

10.2 Functional Cookies

These first-party cookies support platform functionality:

Partner program routing — remembers if you arrived via a partner link, to ensure you receive the correct service experience and pricing
Early career mode — remembers if you selected the early career experience

10.3 Attribution Cookies

We set first-party cookies (lasting up to 90 days) that record how you arrived at our site — for example, a partner link, marketing campaign parameters, or an advertising click identifier in the URL — along with the page you landed on and the referring site. We use this information to measure which marketing channels and partners bring users to ApplyAll and to compensate partners for referrals, as described in Section 3 (legitimate interest). These particular cookies are set and read only by us: we do not share their contents with advertising platforms, and we do not use them to track you across other websites or to show you ads. (Google's separate advertising-measurement cookies are described in Section 10.5.) You may object to this processing at any time by contacting us at privacy@applyall.com.

10.4 Analytics Cookies

We use a third-party product analytics service. These cookies are only set with your consent. They help us understand how users interact with our platform so we can improve the experience. You can accept or reject analytics cookies via the cookie banner on our website, and change your preference at any time.

10.5 Advertising Measurement Cookies (Google)

On our marketing and payment pages, Google's measurement code (loaded via Google Tag Manager) may set cookies that help attribute a purchase to one of our ads — for example, recording that you arrived via a Google ad click. These cookies support the conversion measurement described in Section 5.6; they are not used by us to show you ads on other websites. If you opt out of ad measurement data sharing (Section 8.2) or your browser sends a Global Privacy Control signal, we do not share your email address with Google, though Google's cookie-based click measurement may still operate. You can block these cookies entirely through your browser settings or an ad blocker.

10.6 Managing Cookies

You can manage your cookie preferences using the cookie banner that appears when you first visit our site. You can also change your preferences at any time by clearing your browser cookies and revisiting the site. Most browsers also allow you to block or delete cookies through their settings.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Passwords are hashed using Argon2 (industry-leading password hashing)
All data transmitted between your browser and our servers is encrypted via HTTPS/TLS
Database access is restricted and monitored
Session tokens are used for authentication with secure, HTTP-only cookies

No method of transmission over the internet is entirely secure. While we take reasonable precautions, we cannot guarantee absolute security of your data.

12. Children's Privacy

Our Services are not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at privacy@applyall.com and we will promptly delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice on our website before the changes take effect. The "Last Updated" date at the top of this page indicates when this policy was last revised.

We encourage you to review this Privacy Policy periodically for any changes.

14. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us:

Apply All, Inc.
Los Angeles, CA, United States

Privacy enquiries: privacy@applyall.com
General enquiries: team@applyall.com