How OwlApply collects, uses, shares and protects personal data on our websites, in the app, in the browser extension and in the AI interview.
This Privacy Policy explains how OwlApply Oy ("OwlApply", "we", "us") processes personal data when you use our websites owlapply.com and app.owlapply.com and the servers behind them, the OwlApply browser extension, the AI interview and the emails we send (together, the "Services").
This version is effective as of October 3, 2026. Our Cookie Policy explains our use of cookies in more detail.
Key points
- •We use your data to provide the Services: the resume builder and ATS checker, job search and job analysis, autofill, cover letters, AI chat and the AI interview.
- •Many features send your resume, profile and job information to AI providers, by default OpenAI. Several of our providers are in the United States.
- •When you are signed in and automatic opening is on, the browser extension sends the text and address of job-related pages you open to us for analysis. When you use autofill, it sends the form's questions, answer options and any values already filled in. It never sends the contents of password fields.
- •We do not train our own AI models on your data. AI results are suggestions: you decide what to send to employers.
- •You can delete your account yourself. Most of your data is deleted 30 days later; the exceptions are listed under "How to delete your data".
- •For any question or request, email [email protected].
Who is responsible for your data
The controller responsible for your personal data is OwlApply Oy, a Finnish limited company (Business ID 3622413-7), Tiistinkallio 6, 02230 Espoo, Finland.
You can contact us about any privacy matter at [email protected]. Our contact person for privacy matters is Tufan Yavaş.
What we collect, why, and on what legal basis
For each kind of personal data below, we explain what we collect, why, the legal basis under the EU General Data Protection Regulation (GDPR) and how long we keep it. The legal bases we rely on are:
- Contract (Art. 6(1)(b) GDPR): the processing is necessary to provide a service you have asked for under our Terms of Service, or to take steps you request before you sign up.
- Legal obligation (Art. 6(1)(c)): the law requires the processing, for example accounting law.
- Legitimate interests (Art. 6(1)(f)): the processing is necessary for an interest we name below, and your interests and rights do not override it. You can object to it; see "Your right to object".
- Consent (Art. 6(1)(a)): you have agreed, for example to analytics cookies or marketing emails. You can withdraw your consent at any time.
- Explicit consent (Art. 9(2)(a)): for sensitive information you choose to give us; see "Sensitive information".
Your account
- What we collect: your email address, your password (stored only as a hash) and, if you add it, your name. If you sign in with Google, Facebook or LinkedIn, we receive from that provider your account ID, name, email address and profile picture. We also keep your plan, subscription status and credits, your referral code and who referred you, the data that keeps you signed in, when you last signed in, whether your email address is verified, when you accepted our Terms of Service and whether you agreed to receive marketing emails.
- Why: to create and run your account, sign you in, keep your account secure and give you the features of your plan.
- Legal basis: contract. We keep the record of your acceptance of the Terms and of your marketing choice so that we can prove them (legal obligation and legitimate interests).
- How long: until you delete your account.
Resumes, cover letters and other documents
- What we collect: resume files you upload (PDF, Word or image files), the text we extract from them, any photo they contain (which we detect and crop automatically) and preview images; the resumes and cover letters you create or edit, including contact details, photo, work history, education, skills, languages, projects, awards, certificates, publications, hobbies, references and custom sections; and each resume's ATS score and language. If you import a LinkedIn profile, we retrieve from LinkedIn the name, headline, experience, education, skills and photo of the profile at the address you enter.
- Why: to provide the resume builder, ATS scores, cover letters, downloads and job matching. For job matching, our job search service converts the text of your resume into a numerical representation that can be compared with job postings.
- Legal basis: contract.
- How long: until you delete the document or your account. Photos in resumes made with the resume builder are currently not removed when you delete your account; see "How to delete your data".
Autofill profile
- What we collect: the details you save for job applications: name, email address, phone number, gender, location, LinkedIn, GitHub and website links, whether you are authorized to work and whether you need visa sponsorship, when you can start, remote-work preference, languages, salary expectations, and your own questions and answers.
- Why: so that the browser extension can fill in application forms for you; see "The browser extension".
- Legal basis: contract; explicit consent for any sensitive information you choose to add.
- How long: until you change or delete it, or delete your account.
Job search, job tracker and follow-ups
- What we collect: your job search preferences; jobs you block in job search; jobs you save in the job tracker (title, company, status, location, link, posting text and the resume and cover letter you used); and the follow-up messages you create.
- Why: to show you matching jobs, help you keep track of your applications and draft follow-up messages. To draft a follow-up message, we send the company, job title, application status, the number of days since you applied, the tone you chose and your name to Google.
- Legal basis: contract.
- How long: until you change or delete them, or delete your account. The list of jobs you blocked is currently not removed when you delete your account; we delete it on request.
AI chat
- What we collect: your conversations with the AI assistants in the web app, including the resume and job information they work with and the changes they make; and the questions you ask in the Ask AI chat in the extension.
- Why: to answer your questions and edit your documents at your request, and to let you continue a conversation or undo a change.
- Legal basis: contract.
- How long: conversations in the web app: until you delete your account. Ask AI conversations in the extension are not stored on our servers; the extension sends your last few messages again with each new question.
AI interview
- What we collect: your voice while the interview runs (microphone only; the camera is not used), the live transcript, the job posting you practice for, a summary of your resume, the language and type of interview, your interview report, and how long the session lasted and how it ended.
- How it works: your audio is streamed through Daily and transcribed live by Deepgram; the interviewer's questions are written by OpenAI and spoken by Google's text-to-speech service. OwlApply does not record your audio.
- Why: to run the practice interview and give you a report.
- Legal basis: contract.
- How long: the transcript and report: until you delete your account. Our interview system also writes technical logs for each session, which can contain parts of the conversation; these are currently not deleted automatically, and we delete them on request.
ATS checker and use without an account
- What we collect: for the free ATS resume checker, the file you upload, a preview image, the information we extract from it (including your contact details), the result and your IP address. For a resume you build without an account, the draft, its layout, any photo and your IP address.
- Why: to check your resume and show you the result, to let you start a resume before signing up, and to prevent abuse.
- Legal basis: contract (steps you ask for before signing up); legitimate interests in preventing abuse (IP address).
- How long: ATS checks are not linked to any account, even if you were signed in, and are kept until you ask us to delete them; send us the link to the check. Drafts made without an account are deleted 30 days after your last change, but a photo in such a draft is currently kept until you ask us to delete it.
Anyone who has the link to an ATS check or to a draft can open it, so share these links only with people you trust.
Payments
- What we collect: Stripe collects your card or other payment details directly; we never see your full card number and do not store card details. Stripe also collects your billing name and address, email address and, if you provide one, your tax ID. We store your Stripe customer and subscription identifiers, your plan and your subscription dates. With each checkout we also pass to Stripe your OwlApply user ID, your Google Analytics identifiers, your sign-up campaign details and any OpenAI ad click reference.
- Why: to take payments, calculate tax, manage your subscription, keep accounting records and understand which channels lead to purchases.
- Legal basis: contract; legal obligation for accounting and tax records; legitimate interests in analyzing purchases.
- How long: subscription details: until you delete your account. Billing and transaction records: as long as Finnish accounting law requires, generally six years after the end of the financial year. For this reason we keep your customer record at Stripe after you delete your account.
Affiliate program
- What we collect: if you join our affiliate program, your payout details (account holder name, bank, account number, IBAN, SWIFT/BIC code or PayPal email address) and your earnings and payouts. When someone visits OwlApply through an affiliate link, we record the visit with their IP address, browser user agent, referring page and country, and set a referral cookie that lasts 30 days.
- Why: to credit referrals correctly and pay commissions.
- Legal basis: contract (affiliates); legitimate interests in crediting referrals correctly (visit records); legal obligation (payment records).
- How long: affiliate details and earnings: until you delete your account; payment records: as required by accounting law (see "Payments"); visit records: until you ask us to delete them.
Messages, feedback and emails
- What we collect: messages you send us by email or through our contact form (name, email address, subject, message and, for the form, your IP address); feedback and survey answers (rating, comments, reasons and, if you give it, your email address), including the feedback form we show when you uninstall the extension; your newsletter subscription (email address and name); and records of the emails we send you (recipient, subject, content details and delivery status).
- Why: to answer you, improve the Services, send service emails (for example about sign-up, password reset, exports and your subscription), send the newsletter or marketing emails you asked for, and keep track of what we sent. Our contact form uses Google reCAPTCHA to block spam.
- Legal basis: legitimate interests in answering enquiries, improving the Services, preventing spam and keeping records of our emails; contract for service emails; consent for the newsletter and marketing emails.
- How long: until you ask us to delete them. You can stop the newsletter and marketing emails at any time in your account settings, through the unsubscribe option we provide or by emailing us.
Activity and security logs
- What we collect: when you use the web app or the extension, our servers log the actions you take, for example creating a resume or updating your autofill profile, with the time, your IP address, browser user agent, referring page, the result and, for many actions, the information you submitted. Passwords and security tokens are removed from these logs, and the form contents the extension sends for autofill are not logged. The web app also reports technical errors to us with the page address (sensitive parts removed), browser details and your user ID. From your IP address we determine your country, to show you the prices for your country and to record where sign-ups come from; we do not collect your precise location.
- Why: to keep the Services secure, detect and investigate abuse and errors, help you when you contact us, and understand how features are used.
- Legal basis: legitimate interests in security, reliability and improving the Services.
- How long: until you delete your account.
How you found us
- What we collect: once, when you sign up: the campaign tags in the link you used, the website that referred you, the first page you visited, how you signed up and your country; and, if you came from an ad, the Google Ads or OpenAI Ads click identifier. We record the Google Ads click identifier from the link even if you declined advertising cookies.
- Why: to understand which marketing channels bring new users and purchases, and to credit partners correctly.
- Legal basis: legitimate interests.
- How long: until you delete your account. The copy passed to Stripe with a purchase is kept with the billing records.
Analytics and advertising
On owlapply.com and app.owlapply.com we use Google Analytics (usage statistics, linked to your OwlApply user ID when you are signed in), Microsoft Clarity (recordings of page sessions and heatmaps that show how pages are used) and Google Ads (measuring purchases that follow an ad click). Where our cookie banner is shown, which includes the whole EEA, these tools may use cookies only after you accept them, and you can change your choice at any time. Legal basis: consent. Details are in our Cookie Policy.
Our websites also load OpenAI's advertising measurement tag. It reports page views and key actions (signing up, starting a checkout, sending our contact or newsletter form, uploading a resume) to OpenAI and, when you are signed in, a hashed form of your email address and your OwlApply user ID. This tag is currently loaded directly, not through the cookie banner.
Our servers also send conversion reports. When you create an account, we report this to OpenAI's advertising platform with a hashed form of your email address, user ID and first and last name, together with your IP address, browser user agent and any OpenAI ad click reference. When you buy a subscription, we send the same details plus the billing country, city, region and postal code from checkout, and we report the purchase to Google Analytics with your user ID and Google Analytics identifier. These reports do not depend on your cookie choices.
We use the OpenAI tag and the conversion reports to measure whether our advertising leads to sign-ups and purchases. Legal basis: legitimate interests; you can object at any time (see "Your right to object"). Google, Microsoft and OpenAI keep this data according to their own terms and our account settings.
Improving the Services and statistics
- What we use: data from the Services, such as ATS check results, analyzed job postings and AI interview transcripts.
- Why: to test and improve our features, for example by running real job postings and interview transcripts through a new version of a feature to check its quality before release, and to compile aggregate statistics, such as how common certain resume problems are. We publish only aggregate figures that do not identify anyone. We do not train our own AI models on your data.
- Legal basis: legitimate interests in improving the Services and informing job seekers.
- How long: for the periods described in this policy; published statistics contain no personal data.
The browser extension
The OwlApply browser extension analyzes job postings and fills in job applications on other websites. This is how it handles data:
- Where it acts: the extension's scripts run on the pages you visit, but they act only on pages whose address looks job-related, such as job postings and application forms, or where you open the extension yourself.
- Automatic analysis: if automatic opening is on (the default) and you are signed in, the extension opens its panel on such a page and sends the page's job text and its address to OwlApply for analysis, without any further click. This can include pages that turn out not to be job postings, such as application forms or candidate portals. The same happens when you open the panel yourself. You can turn automatic opening off for a single site or everywhere.
- Autofill: when you start autofill, the extension sends the form's questions, their answer options and any values already in the fields to OwlApply. We send them, together with your autofill profile and resume, to our AI provider (OpenAI by default), and the extension enters the answers into the form. Unless you turn these options off, it also attaches your resume and cover letter to file upload fields. Check every answer before you submit an application.
- Passwords: what autofill sends never includes password fields. The extension types into a password field only the sign-up password you saved, and only on the employer sites described in the next section.
- Posting cache: the text and address of each analyzed page and the result of the analysis are kept in a shared cache of postings that is not linked to your account, so that the same posting does not have to be analyzed twice. The cache currently has no fixed deletion date. Match results between a posting and your resume are stored with a reference to that resume.
- On your device: your extension settings, site rules, sign-in tokens and similar preferences are stored in your browser, in the extension's own storage. The posting shown in a tab is kept only until you close that tab.
- Cookies: the extension uses its cookies permission only to keep you signed in to OwlApply. It does not read other websites' cookies.
- No third-party trackers: the extension contains no third-party analytics or advertising code. Apart from OwlApply's servers, it loads only resources of the site you are on (for example that page's stylesheets, to fit the page beside the panel) and, on Dayforce, the two documents described in the next section. When you uninstall it, it opens a short feedback page on our website.
- Your choices: you can turn automatic opening off for a site or everywhere, sign out, or uninstall the extension at any time. Uninstalling deletes everything the extension stored in your browser; data already sent to us is handled as described in this policy.
Legal basis: contract for the features you use; legitimate interests in running the Services efficiently for the posting cache.
Sign-up information for employer sites
Many employers' application systems (for example Workday, iCIMS, SAP SuccessFactors, UKG Pro, Taleo and BrassRing) require an account before you can apply. You can save one email address and one password in the extension for creating these accounts and signing in to them.
- You enter them only on the extension's own settings page.
- They are stored only in the browser where you save them, encrypted with AES-GCM using a key that cannot be exported and is kept by the extension.
- Next to them, encrypted the same way, the extension keeps a list of the employer sites where these details already have an account: those where it created the account, where you signed in with them through the extension, or where the site said the email is already registered. The extension uses this list only to sign you in on those sites instead of trying to create a second account. The list stays in your browser, is never sent to OwlApply, and is deleted when you change the saved email.
- They are never sent to OwlApply's servers or to AI providers, never written to logs and never included in the form data that autofill sends for AI answers.
- The extension types them only into the matching fields of those employer sites, and only when you start this from the extension panel.
- When you ask the extension to create an account, it accepts the employer's privacy notice or terms for you where the site asks for it (usually by ticking its checkbox or pressing its accept button; on Dayforce it first opens the privacy statement and terms in background tabs, as that site requires). Security checks such as CAPTCHAs, codes the site sends you, phone verification and security questions are always left to you: the extension fills in the rest of the form and waits. The account is created, or you are signed in, only when you press Create Account or Sign In yourself, either on the site or on the extension's button that presses it for you. Read the employer's terms and privacy notice before you do so.
- The account is created with the employer, or with the company that runs its application system, and that company's privacy notice applies to it.
- Removing the sign-up information on the settings page, or uninstalling the extension, deletes it together with the list of employer sites.
We recommend a password that you do not use anywhere else.
How we use AI
Many features of the Services use AI models from external providers. What a provider receives depends on the feature: usually your resume, including the contact details in it, and, depending on the feature, your autofill profile, the job posting, the questions on a form, your messages or your speech.
- OpenAI, our default provider: autofill answers, cover letters, rewriting and translating resumes, writing summaries and bullet points, keywords and summaries of job postings, the AI assistants in the web app, and the AI interview (interviewer, resume summary and report).
- Google (Gemini): reading uploaded resumes, including in the ATS checker and without an account, and drafting follow-up messages.
- Groq: the Ask AI chat in the extension, which receives your last few messages, your resume and the posting.
- OpenRouter and the model providers it routes requests to: deciding whether a page is a job posting, extracting its details and rating how well your resume fits it. OpenRouter is also our backup when another AI provider is unavailable; your request may then be handled by a different model provider.
- Deepgram (speech-to-text) and Google (text-to-speech): the AI interview.
We do not train our own AI models on your data. Each provider handles the data under its own terms. OpenAI's API, which we use, does not use data sent through it to train OpenAI's models by default and may keep it for up to 30 days to monitor abuse. Deepgram's standard terms allow it to use the audio it processes to improve its speech recognition models. The terms of the other providers differ; ask us if you would like details.
AI results are suggestions. Fit scores, suggestions on whether to apply, generated answers and documents are produced automatically, but you decide what to use and what to send to an employer. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI output can be wrong, so check it before you use it.
To find and fix errors, we trace requests to some of our AI features with LangSmith, a service of LangChain, in its EU region. Fields that directly identify you are replaced with pseudonymous codes, and the traces are deleted after 14 days.
Sensitive information
We do not ask for special categories of personal data, such as information about your health, ethnic origin, religion, political opinions, trade union membership or sexual orientation. If you include such information in a resume, in your autofill profile or in your own questions and answers, we process it only to provide the feature you use it in, on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by entering it. You can withdraw your consent at any time by deleting the information. Include it only if you really need to.
Application forms often ask optional equal opportunity questions, for example about ethnicity, disability, veteran status or religion. Our autofill is instructed to answer them only from what you entered yourself and otherwise to choose the option to decline. Check these answers before you submit.
Information about other people
If your resume contains information about other people, such as the names and contact details of your references, make sure they agree to you sharing it. We use such information only as part of your resume. Use the LinkedIn import only for your own profile.
Job postings that the extension analyzes sometimes include a recruiter's name or contact details. These remain part of the posting text in the posting cache (legitimate interests in providing job analysis).
If we hold information about you because someone else gave it to us, you can contact us to exercise your rights.
Where your data comes from
Most of the data we process comes from you. We also receive data:
- from the websites where you use the extension: the text and address of job-related pages, and the questions and existing values of application forms;
- from Google, Facebook or LinkedIn, if you sign in with them: your account ID, name, email address and profile picture;
- from LinkedIn, if you import a profile: the profile details described under "Resumes, cover letters and other documents";
- from Stripe: the status of your payments and subscription and, for purchases, your billing location;
- from the link that brought you to us and from your IP address: campaign tags, the referring website, ad click identifiers and your country.
Do you have to give us your data?
To create an account you need an email address and a password, or a Google, Facebook or LinkedIn account, and you must accept our Terms of Service. To buy a subscription you must give Stripe your payment and billing details. Everything else is optional, but some features do not work without certain data: for example, autofill needs your profile and the AI interview needs your microphone. You are not required by law to give us personal data.
Who receives your data
We use the companies below to provide the Services. Most of them process personal data on our behalf, only to provide their service to us. Some may also use it for their own purposes under their own privacy policies, in particular the sign-in providers, the advertising platforms and, as explained under "How we use AI", Deepgram.
| Company | Purpose | Location |
|---|---|---|
| OpenAI | AI features; our default AI provider (see "How we use AI") | United States |
| OpenAI | Advertising measurement: the tag on our websites and conversion reports from our servers | United States |
| AI: reading resumes and drafting follow-up messages (Gemini); the interviewer's voice in the AI interview | United States | |
| Sign-in with Google, Google Analytics, Google Ads, spam protection on our contact form, fonts in the web app | United States | |
| Groq | AI: the Ask AI chat in the extension | United States |
| OpenRouter | AI: job posting analysis and resume fit rating through the model providers it routes requests to (currently including Groq, Novita, CoreWeave, DeepInfra and TypeSafe); backup when another AI provider is unavailable | United States |
| Deepgram | Speech-to-text in the AI interview | United States |
| Daily | Live audio connection for the AI interview | United States |
| LangChain (LangSmith) | Tracing of AI requests to find and fix errors | EU data region |
| Stripe | Payments, subscriptions, invoices and tax calculation | Ireland, United States |
| Cloudflare | Security and delivery for all our websites and services, file storage and backups | United States, global network |
| netcup | Hosting of our main servers and databases | Austria |
| Contabo | Hosting of our job search and job matching service | Germany |
| Hostinger | Sending and receiving our email | EU (Lithuania, Cyprus) |
| CookieScript (Objectis) | Cookie banner and your consent choices | Lithuania |
| Microsoft | Microsoft Clarity session recordings and heatmaps on our websites | United States |
| Meta | Sign-in with Facebook, if you use it | United States |
| Sign-in with LinkedIn, if you use it | United States |
We also disclose personal data to employers and the companies that run their application systems when you apply for a job (they receive what you submit and handle it under their own privacy notices); to authorities when the law requires us to; and to a buyer or successor if our business, or part of it, is sold, merged or reorganized.
Transfers outside the EEA
Our own servers, our email provider and our AI error tracing are in the EU. The recipients in the United States are OpenAI, Google, Groq, OpenRouter and the model providers it routes requests to, Deepgram, Daily, Stripe, Cloudflare (whose network operates worldwide), Microsoft, Meta and LinkedIn.
Where a recipient is certified under the EU–U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for that framework. Otherwise it relies on the European Commission's Standard Contractual Clauses. You can ask us which safeguard applies to a recipient and for a copy of it.
How long we keep your data
We keep personal data only as long as we need it for the purposes described above, unless the law requires us to keep it longer. "Until you delete your account" means until your account is deleted at the end of the 30-day period that starts when you request deletion.
| Data | How long |
|---|---|
| Resumes, cover letters, autofill profile, job tracker entries and follow-ups | Until you delete them or your account |
| Account, job search preferences, AI chat history, AI interview transcripts and reports, activity logs, sign-up details, affiliate details | Until you delete your account |
| AI interview audio | Not recorded by us |
| Analyzed job postings (shared cache) | No fixed deletion date at present; not linked to your account |
| ATS checks | Until you ask us to delete them |
| Resume drafts made without an account | 30 days after your last change; a photo in the draft until you ask us to delete it |
| Photos in resumes made with the resume builder | Not yet deleted with your account; deleted on request |
| AI interview technical logs, messages and feedback you sent us, newsletter subscription, records of emails we sent you, jobs you blocked, affiliate link visits | Until you ask us to delete them |
| Billing and accounting records | As long as Finnish accounting law requires, generally six years after the end of the financial year |
| Data the extension stores in your browser | Until you remove it or uninstall the extension |
| AI error traces | 14 days |
| Copies held by AI providers | Under each provider's terms, for example up to 30 days at OpenAI |
| Analytics and advertising data | Under the provider's terms and our account settings; see the Cookie Policy for cookies |
| Backups | Up to about 70 days |
Backups: we back up our databases regularly. Data you delete can remain in these backups for up to about 70 days, until the backups themselves are deleted.
Your rights
Under the GDPR you have the right to:
- Access your data: find out whether we process it and receive a copy.
- Rectification: have inaccurate or incomplete data corrected. You can change most of your data yourself in the app.
- Erasure: have your data deleted. You can delete your account yourself; see "How to delete your data".
- Restriction: have the use of your data limited in certain cases, for example while we check whether it is accurate.
- Portability: receive the data you gave us, where we process it on the basis of contract or consent, in a structured, commonly used and machine-readable format, or have it sent to another provider where this is technically feasible.
- Object to processing based on legitimate interests and to direct marketing; see below.
- Withdraw consent at any time, without affecting processing that took place before. For cookies, use the cookie settings; for marketing emails, use your account settings or the unsubscribe option.
To exercise your rights, email [email protected]. Requests for access, a copy of your data, correction or objection are handled by email.
We may ask you to confirm your identity, for example by writing from the email address of your account. We respond within one month. If a request is complex or we receive many requests, we may extend this by up to two further months; if so, we will tell you within the first month and explain why. Requests are free of charge. If a request is manifestly unfounded or excessive, we may refuse it or charge a reasonable fee, and we will explain why.
Your right to object
You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, such as activity logs, sign-up attribution, advertising measurement and the use of data to improve the Services. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving reasons, and we will stop. To object, email [email protected].
How to delete your data
You can delete your OwlApply account yourself at any time:
- Sign in and go to Profile Settings.
- Find the Delete account section at the bottom of the page.
- Click Delete account, type your email address to confirm, then click Schedule deletion.
Your account is then scheduled for deletion, and you have 30 days to change your mind: return to the same screen and click Keep my account. Scheduling deletion also turns off the automatic renewal of your subscription, so you are not charged again; keeping your account does not turn it back on. After 30 days your account is deleted. This cannot be undone.
With your account we delete your profile and sign-in details, resumes (including uploaded files and previews), cover letters, autofill profile, job search preferences, job tracker entries and follow-ups, AI interview transcripts and reports, AI chat history, sign-up details, activity logs and affiliate records.
The following data is not deleted with your account:
- Billing and accounting records, including your customer record at Stripe, which Finnish accounting law requires us to keep.
- Backups, for up to about 70 days.
- Checks made with the free ATS resume checker, which are not linked to any account. Send us the link to a check and we will delete it.
- The shared cache of analyzed job postings and analysis results, which is not linked to your account, and aggregate statistics that do not identify you.
- At present also: photos in resumes made with the resume builder, records of the emails we sent you, messages and feedback you sent us, your newsletter subscription, the list of jobs you blocked in job search, and technical logs of your AI interviews. We delete these on request.
- Copies held by our providers under their own retention rules, for example up to 30 days at OpenAI and 14 days in our AI error traces.
If you cannot sign in, or want any of the data above deleted, email [email protected].
Right to lodge a complaint
If you believe that we process your personal data in breach of data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en) or with the supervisory authority of the EU country where you live or work, or where the alleged breach took place. We would be glad if you contacted us first, so that we can try to resolve the issue.
Security
We use technical and organizational measures to protect personal data, including:
- encryption in transit (HTTPS) for all connections to our websites, app and servers, including those from the extension;
- passwords stored only as hashes, and card details handled by Stripe without reaching us;
- access to our servers and databases limited to the people who need it to run the Services;
- encryption on your device for sign-up information saved in the extension.
No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay, as the GDPR requires.
Children
The Services are intended for adults. Our Terms of Service require users to be at least 18 years old, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We update this policy when our Services or the law change. The effective date of the current version is stated at the top. If we make material changes, we will tell you by email or in the app.
Contact us
For questions about this policy or your personal data, email [email protected] or write to OwlApply Oy, Tiistinkallio 6, 02230 Espoo, Finland.