Privacy policy

Last Updated: October 21, 2026

1. Who we are

ApplyMate (apply-mate.com) helps people tailor their resume to a job ad. This policy explains what personal data we collect, why, who we share it with and what you can do about it. It covers our website, the free tools on it and the paid resume builder.

The ApplyMate Chrome extension has a short privacy policy of its own, which explains what the extension does on your device.

ApplyMate decides how your data is used, which makes us the "controller" under the GDPR. For anything about your data, email us at contact.applymate@gmail.com.

2. What we collect

2.1 What you give us

  • Account details: your email address, and your name if you sign in with Google or LinkedIn.
  • Your resume and the job ads you upload or paste, and the text we read out of them.
  • Your career record: jobs you add, answers to the questions we ask about your resume, and edits you make. We keep it so your next application starts from what you've already told us.
  • Purchase details from Lemon Squeezy: your email address, country, what you bought and when. We never see your card number.
  • LinkedIn profile URLs you submit to our LinkedIn profile checker.
  • Ratings and feedback you leave on our tools.

2.2 What we collect automatically

  • Device and connection data: IP address, browser type and operating system.
  • Your approximate country, looked up from your IP address on our own servers to show the right price for the LinkedIn profile fixes, and stored with your order when you buy credits (IP geolocation by DB-IP, db-ip.com). The address is not sent anywhere for this.
  • How you use the site: the pages you visit, what you click and where you came from, for example an ad or a search engine. We collect this with Google Analytics and PostHog.
  • Session recordings: PostHog records how pages are used, including what's shown on screen. That can include your resume while you're looking at it. Text you type into form fields is hidden from recordings.

2.3 Information about other people

Our LinkedIn profile checker fetches the public LinkedIn profile at the URL it's given, through HarvestAPI or, as a fallback, Bright Data. We store that profile with its analysis and show the same analysis to anyone who checks the same URL later. If it's your profile and you'd like it removed, email us.

3. How we use it

We use your information for the purposes below. The GDPR needs a legal basis for each, shown in brackets: contract means we need it to give you what you asked for, and legitimate interest means it's needed to run and improve ApplyMate in a way you'd reasonably expect.

  • Run the service: read your resume, tailor it to a job ad, write cover letters and LinkedIn rewrites, and run the free tools. (Contract)
  • Keep your career record, so you don't have to type the same things again. (Contract)
  • Take payments and keep the records tax law requires. (Contract; legal obligation)
  • Send the emails you need: sign-in codes, sign-in links and purchase confirmations. (Contract)
  • Send a few follow-up emails after you sign up or generate a resume, for example to tell you it's ready. If you generate a resume without an account, we send them to the email address on that resume. Every one has an unsubscribe link. (Legitimate interest)
  • Understand how the site is used, fix errors and improve our tools, including improving, in aggregate, how they read resumes. (Legitimate interest)
  • Measure which ads bring people to ApplyMate. (Legitimate interest)
  • Prevent abuse, with daily limits on the free tools and a bot check on our sign-in form. (Legitimate interest)

4. Cookies and tracking

4.1 Our own cookies

These are set by ApplyMate itself:

  • _job_applier_session: keeps you signed in and remembers where you are in a task. Deleted when you close your browser.
  • remember_user_token: keeps you signed in between visits. 2 weeks.
  • locale: remembers the language you picked. 1 year.
  • tool_rater_id: a random ID for your browser. It counts free-tool uses against the daily limits, keeps one rating per browser, remembers your free cover letter, and stands in as an anonymous analytics ID when analytics cookies are blocked. It stays until you clear it.
  • linkedin_checker_token: lets you reopen LinkedIn profile fixes you paid for without an account. 30 days.

4.2 Analytics

  • Google Analytics sets cookies to count visits and see which pages and ads lead to sign-ups and purchases. When you're signed in, it also receives your account ID.
  • PostHog, on servers in the EU, sets a cookie that ties your visits together, makes the session recordings described in section 2.2, and links them to your email address once you sign in, or, if you generate a resume without an account, to the email address on that resume.

4.3 Advertising

The LinkedIn Insight Tag, the Reddit Pixel, Taboola and Outbrain tell us when someone who saw one of our ads visits or buys. These companies may set their own cookies and use them under their own privacy policies.

These tools load when you open the site. You can block or delete cookies in your browser settings or with a content blocker. Blocking the analytics and advertising ones won't stop ApplyMate from working, but blocking all cookies will stop you from staying signed in.

5. Who we share it with

We don't sell your personal data. We share it only with the providers below, who process it for us or run part of the service:

  • Google: Gemini, the AI model that reads and rewrites your resume and writes your cover letters and reports. Google processes it to provide the service to us and doesn't use it to train its models. Google also provides Google sign-in and Google Analytics.
  • LinkedIn: LinkedIn sign-in and ad measurement.
  • Lemon Squeezy: our merchant of record. It takes payments and handles sales tax under its own privacy policy.
  • Fly.io: hosts our servers, database and stored files.
  • PostHog: product analytics, session recordings and our follow-up emails.
  • Resend: delivers sign-in codes and purchase emails.
  • Cloudflare: Turnstile, the bot check on our sign-in form.
  • HarvestAPI and Bright Data: fetch public LinkedIn profiles for the LinkedIn profile checker.
  • Reddit, Taboola and Outbrain: ad measurement.
  • Telegram and Discord: private alerts to our team about sign-ups, purchases and errors. These can include your email address or IP address and feedback you leave on our tools.

We may also disclose information when the law requires it, or to protect our rights or the safety of our users.

6. International transfers

Some of these providers are based in, or store data in, the United States or other countries outside the European Economic Area. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or by the EU-US Data Privacy Framework.

7. How long we keep it

We keep your account, your career record and the resumes you generate until you ask us to delete your account.

We retain the resumes and CVs you upload, including files submitted to our free tools without an account, for as long as we operate the service. We keep them so that you can return to a report you have already run and carry the same document into our resume builder without uploading it again, and we use them in aggregate to improve how our tools read resumes. We also publish anonymised statistics drawn from them in aggregate, such as the share of resumes that include a LinkedIn link. These statistics never include text from any resume or anything that could identify you, and no published figure describes fewer than 10 documents. We do not sell them and we do not share them with third parties except the service providers listed above who process data on our behalf.

LinkedIn profile checks are kept, and reused for anyone who checks the same profile URL, until we're asked to remove them.

We keep purchase records for as long as tax and accounting law requires, even after an account is deleted.

You can ask us to delete an uploaded resume at any time. Reports produced by our free ATS resume checker, our job description keyword finder and our interview questions generator each carry a "delete my resume" control that removes the stored file and its extracted text immediately. For a cover letter, email us and we will remove the file and its text for you. What the report itself says remains: a score, a keyword list, a set of interview questions or a finished cover letter describes or is built from a document rather than containing one, and in the cover letter's case the page holding it is your only copy. To delete an uploaded resume, or your whole account with its resumes, career record and generated documents, email us at contact.applymate@gmail.com.

8. Your rights

Under the GDPR, and similar laws elsewhere, you have the right to:

  • see the personal data we hold about you and get a copy of it
  • have it corrected if it's wrong
  • have it deleted
  • limit how we use it
  • get the data you gave us in a portable format
  • object to how we use it, including to our follow-up emails, which you can also stop with the unsubscribe link in any of them
  • withdraw any consent you've given

To use any of these rights, email us at contact.applymate@gmail.com. We'll reply within one month. If you think we've handled your data wrongly, you can complain to a data protection authority: in Poland that's the President of the Personal Data Protection Office (UODO), or you can go to the authority in your own country.

9. Children

ApplyMate is for people aged 18 and over. We don't knowingly collect personal data from children. If you think a child has given us their data, email us and we'll delete it.

10. Changes to this policy

We update this policy when the product changes. The date at the top shows when it last changed, and the new version applies from that date.

11. Contact us

Questions about this policy or your data? Email us at contact.applymate@gmail.com.