1. Controller and contact
The controller for personal data processed through ApplyOpt is Christoffer Puleston, Fabriksvägen 16, Figeholm, Sweden. You can contact the controller about privacy, account deletion, or your data rights at [email protected].
No data protection officer has been appointed. If you are in the EEA or UK, you may also complain to your supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY).
2. Data we process
- Account data, including your email address and authentication identifiers.
- Content you submit to the tool: country, role, interview question, answer, selected level, and AI-generated output.
- Service and security data, such as token balance, request timestamps, technical logs, and IP-derived rate-limit information.
- Messages and email address you provide through the contact form.
- For any historic or future payment: Stripe's payment status and transaction identifiers. Card details are handled by Stripe, not ApplyOpt.
Please do not submit special-category or highly sensitive personal data, such as health information, ethnicity, religion, political opinions, union membership, biometric data, or personal data about other people.
3. Why we use data and our legal bases
- Providing the service: account access, AI-assisted answer improvement, saved history, and token balances. Legal basis: performance of a contract or steps taken at your request.
- Security and abuse prevention: detecting misuse, protecting accounts, and rate limiting. Legal basis: legitimate interests in operating a secure service.
- Contact and support: responding to questions you send us. Legal basis: legitimate interests or steps requested by you.
- Legal records: retaining information where tax, accounting, or other law requires it. Legal basis: legal obligation.
- Optional cookies or similar technologies: only where required consent has been obtained.
4. Processors and international transfers
ApplyOpt uses service providers to operate the product: Supabase for authentication and database infrastructure, OpenAI for AI processing, Vercel for hosting, Stripe for payments when paid purchases are enabled, and an SMTP email provider for contact messages. They process data only as needed to provide their services to ApplyOpt.
These providers may process data outside the EEA/UK. Where a transfer is made, it is intended to rely on an adequacy decision or appropriate contractual safeguards, such as the European Commission's standard contractual clauses. Provider agreements and transfer settings are reviewed before paid launch.
5. Retention
Account data and optimization history are retained while your account is active, then deleted or anonymised after a verified deletion request unless a longer period is required by law. Contact messages are retained only as long as needed to handle the request. Security logs are retained only for the period needed to protect and troubleshoot the service.
Accounting records, if applicable, are retained for the period required by Swedish law. You can request deletion by emailing us; we may first need to verify that the request comes from the account holder.
6. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, and portability of your personal data, and may withdraw consent where processing is based on consent. Email us at [email protected] to make a request.
7. AI-assisted service
ApplyOpt sends the text you submit to an AI provider to generate a draft improvement. The service does not make employment, hiring, credit, insurance, or other decisions producing legal or similarly significant effects about you. You must review the output and decide whether to use it.
8. Cookies
ApplyOpt uses necessary local storage and authentication technology to keep you signed in and display your token balance. We do not knowingly use advertising cookies. If non-essential analytics or marketing technologies are introduced, we will provide notice and obtain consent where required before activating them.
9. Changes
Material changes will be published here with a new version and effective date. Where required, we will also notify registered users before the change takes effect.