How OwlApply collects, uses, shares and protects personal data on our websites, in the app, in the browser extension and in the AI interview.
This Privacy Policy explains how OwlApply Oy ("OwlApply", "we", "us") processes personal data when you use our websites owlapply.com and app.owlapply.com, the OwlApply browser extension, the AI interview and the emails we send (together, the "Services").
This version is effective as of October 10, 2026. Our Cookie Policy explains our use of cookies in more detail.
Key points
- •We use your data to provide the Services: the resume builder and ATS checker, job search, the browser extension, cover letters, AI chat and the AI interview.
- •Many features send your resume, profile and job information to AI providers such as OpenAI and Google. Several of our providers are in the United States.
- •When you are signed in, the browser extension sends job-related pages you open, and the forms you ask it to fill, to us for analysis. It never sends the contents of password fields.
- •We do not train our own AI models on your data. AI results are suggestions: you decide what to send to employers.
- •You can delete your account yourself at any time. For any question or request, email [email protected].
Who we are
The controller responsible for your personal data is OwlApply Oy, a Finnish limited company (Business ID 3622413-7), Tiistinkallio 6, 02230 Espoo, Finland.
You can contact us about any privacy matter at [email protected]. Our contact person for privacy matters is Tufan Yavaş.
What we collect
We collect the information you give us, the information that is created when you use the Services, and some information from other sources:
- Account details: your email address, your password (stored only as a hash) and your name if you add it, your plan, subscription and credits, and your marketing email choice. If you sign in with Google, Facebook or LinkedIn, we receive your account ID, name, email address and profile picture from that provider.
- Resumes, cover letters and documents: files you upload, the resumes and cover letters you create (including any photo and the work history, education and other details in them) and their ATS scores. If you import a LinkedIn profile, we retrieve its name, headline, experience, education, skills and photo from LinkedIn.
- Autofill profile: the details you save for job applications, such as your contact details, work authorization, availability, salary expectations and your own questions and answers.
- Job search and tracker: your job search preferences, the jobs you save or block, and the follow-up messages you create.
- AI chat and AI interview: your conversations with our AI assistants and, in the AI interview, your voice while the interview runs (microphone only; we do not record your audio), the live transcript and your interview report.
- Payments: our payment processor collects your payment and billing details directly; we never see your full card number. We keep your subscription details and dates.
- Affiliate program: if you join it, your payout details and earnings. When someone visits OwlApply through an affiliate link, we record the visit (IP address, browser, referring page and country) and set a referral cookie for 30 days.
- Messages and feedback: what you send us by email, through our contact form or in surveys and feedback forms, your newsletter subscription, and records of the emails we send you.
- Usage and device data: the actions you take in the web app and the extension, with the time, your IP address and browser details, and technical error reports. From your IP address we determine your country; we do not collect your precise location.
- How you found us: when you sign up, the campaign tags and ad click identifiers in the link you used, the referring website and the first page you visited. We record these from the link even if you declined advertising cookies.
- Use without an account: files you check with the free ATS resume checker and resume drafts you start before signing up, with your IP address. Anyone who has the link to an ATS check or a draft can open it, so share these links only with people you trust.
Apart from what you give us, we receive data from the websites where you use the extension, from Google, Facebook or LinkedIn if you sign in with them or import a LinkedIn profile, from our payment processor (the status of your payments and your billing location), and from the link that brought you to us.
To create an account you need an email address and a password (or a Google, Facebook or LinkedIn account) and must accept our Terms of Service; to buy a subscription you must give our payment processor your payment details. Everything else is optional, but some features need certain data, for example autofill needs your profile and the AI interview needs your microphone. You are not required by law to give us personal data.
How we use your data and our legal bases
Under the EU General Data Protection Regulation (GDPR), we use your data for the following purposes and on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Services you use: your account, documents, ATS scores, job search and matching, the extension, cover letters, AI chat, the AI interview, and service emails such as password resets | Contract (Art. 6(1)(b)) |
| Taking payments, managing subscriptions, tax and accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Keeping a record of your acceptance of the Terms and of your marketing choice | Legal obligation; legitimate interests |
| Security, preventing abuse and spam, and finding and fixing errors | Legitimate interests (Art. 6(1)(f)) |
| Answering your messages, handling feedback and keeping records of the emails we send | Legitimate interests |
| Understanding which channels bring sign-ups and purchases, and crediting affiliates and partners | Legitimate interests; contract for affiliates |
| Analytics and advertising cookies | Consent (Art. 6(1)(a)) |
| Measuring our advertising and building advertising audiences | Legitimate interests |
| Improving the Services and publishing aggregate statistics | Legitimate interests |
| Newsletter and marketing emails | Consent |
| Sensitive information you choose to include (see "Sensitive information") | Explicit consent (Art. 9(2)(a)) |
Where we rely on legitimate interests, our interest is the one named in the table, and you can object (see "Your right to object"). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
To improve the Services we test new versions of our features on real data, such as ATS check results, analyzed job postings and AI interview transcripts, and we compile statistics such as how common certain resume problems are. We publish only aggregate figures that do not identify anyone.
Cookies, analytics and advertising
We use analytics and advertising tools from partners such as Google, Microsoft, Meta and OpenAI to understand how our websites are used (for example through statistics, session recordings and heatmaps) and to measure and improve our advertising. Where our cookie banner is shown, which includes the whole EEA, these tools use cookies only after you accept them; at present, OpenAI's advertising measurement tag is an exception. You can change your choice at any time in the cookie settings. Details are in our Cookie Policy.
To measure our advertising and show relevant ads, we may share information with our advertising partners, such as a hashed form of your email address and other contact details, and the sign-ups and purchases you make. We may also use it to build advertising audiences, for example so that our ads are not shown to existing customers, or are shown to people similar to them. Our advertising partners handle this information under their own terms.
We do this on the basis of our legitimate interests. You can object at any time; we will then stop and remove you from our advertising audiences.
The browser extension
The OwlApply browser extension analyzes job postings and fills in job applications on other websites:
- Job pages: it acts only on pages whose address looks job-related, or where you open it yourself. If you are signed in and automatic opening is on (the default), it sends the text and address of such a page to us for analysis. This can include pages that turn out not to be job postings. You can turn automatic opening off for a site or everywhere.
- Autofill: when you start autofill, it sends the form's questions, answer options and any values already filled in. We send them, with your autofill profile and resume, to our AI provider, and the extension enters the answers. It can also attach your resume and cover letter. Check every answer before you submit.
- Passwords: the extension never sends the contents of password fields. If you save sign-up details for employer application sites (one email address and password), they stay in your browser, encrypted, and are never sent to OwlApply or to AI providers. The extension enters them only on those employer sites, when you start it from the panel. When it creates an account for you, it accepts the employer's terms or privacy notice where the site asks for it, and the account is created only when you press the button to confirm. That employer's privacy notice then applies.
- Posting cache: analyzed postings and their results are kept in a shared cache that is not linked to your account, so the same posting is not analyzed twice. Postings can include a recruiter's name or contact details.
- Nothing else: the extension contains no third-party analytics or advertising code, and uses its cookies permission only to keep you signed in to OwlApply. Your settings stay in your browser, and uninstalling the extension deletes them.
Legal basis: contract for the features you use; legitimate interests in running the Services efficiently for the posting cache.
How we use AI
Many features use AI models from external providers, such as OpenAI (our default provider) and Google, and other AI model providers, in some cases through a service that routes requests between them. Depending on the feature, a provider receives your resume (including the contact details in it), your autofill profile, the job posting, the questions on a form, your messages or, in the AI interview, your speech, which a speech-to-text service transcribes live.
We do not train our own AI models on your data. Each provider handles the data under its own terms; some may keep it for a limited time to monitor abuse, and some, such as our speech-to-text provider for the AI interview, may use it to improve their own models. Ask us if you would like details.
AI results are suggestions. Fit scores, generated answers and documents are produced automatically, but you decide what to use and what to send to an employer. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI output can be wrong, so check it before you use it.
Sensitive information and information about others
We do not ask for special categories of personal data, such as information about your health, ethnic origin, religion or sexual orientation. If you include such information in a resume, your autofill profile or your own answers, we process it only to provide that feature, on the basis of your explicit consent, which you give by entering it and can withdraw by deleting it. For optional equal opportunity questions on application forms, our autofill answers only from what you entered and otherwise chooses the option to decline.
If your resume contains information about other people, such as your references, make sure they agree to you sharing it. Use the LinkedIn import only for your own profile. If we hold information about you because someone else gave it to us, you can contact us to exercise your rights.
Who we share your data with
We share personal data with the following categories of recipients:
- Service providers that process it on our behalf: hosting in the EU, security, content delivery and file storage (such as Cloudflare), email, our cookie banner and tools that help us find and fix errors.
- AI providers such as OpenAI and Google, and the speech services used in the AI interview (see "How we use AI").
- Payment processors such as Stripe, for payments, subscriptions, invoices and tax.
- Analytics and advertising partners such as Google, Meta, Microsoft and OpenAI (see "Cookies, analytics and advertising").
- Sign-in providers (Google, Facebook, LinkedIn), if you use them.
- Employers and the companies that run their application systems, when you apply for a job; they receive what you submit and handle it under their own privacy notices.
- Authorities when the law requires us to, and a buyer or successor if our business, or part of it, is sold, merged or reorganized.
Sign-in providers, advertising partners and some AI providers may also use the data for their own purposes under their own privacy policies.
Transfers outside the EEA
Our own servers and our email provider are in the EU. Several recipients are in the United States, including our AI providers, our payment processor, our analytics, advertising and sign-in partners, our security and content delivery provider and the services used in the AI interview. Where a recipient is certified under the EU–U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for that framework; otherwise it relies on the European Commission's Standard Contractual Clauses. You can ask us which safeguard applies to a recipient and for a copy of it.
How long we keep your data
We keep personal data only as long as we need it for the purposes above, unless the law requires us to keep it longer:
- Your account data, documents and activity are kept until you delete them or your account. Your account is deleted 30 days after you request deletion.
- Billing and accounting records are kept as long as Finnish accounting law requires, generally six years after the end of the financial year, including your customer record at our payment processor.
- Resume drafts made without an account are deleted 30 days after your last change.
- Some data is not linked to your account or is not yet deleted with it, such as free ATS checks, the shared posting cache, photos in resumes, messages and feedback you sent us, records of emails we sent you and technical logs of AI interviews. We delete these on request; the posting cache has no fixed deletion date.
- Deleted data can remain in our backups for up to about 70 days. Copies held by our providers are kept under their own terms.
How to delete your account
Sign in, go to Profile Settings and use Delete account at the bottom of the page. You then have 30 days to change your mind by clicking Keep my account. Scheduling deletion also turns off the automatic renewal of your subscription. After 30 days your account is deleted, and this cannot be undone. If you cannot sign in, or want other data deleted, email [email protected].
Your rights
Under the GDPR you have the right to:
- access your data and receive a copy;
- correct inaccurate or incomplete data (you can change most of it yourself in the app);
- delete your data;
- restrict how we use your data in certain cases;
- receive the data you gave us in a machine-readable format, or have it sent to another provider (portability);
- object to processing based on legitimate interests and to direct marketing (see below);
- withdraw your consent at any time: use the cookie settings for cookies and your account settings or the unsubscribe option for marketing emails.
To exercise your rights, email [email protected]. We may ask you to confirm your identity, for example by writing from your account's email address. We respond within one month; if a request is complex or we receive many, we may extend this by up to two further months and will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.
Your right to object
You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, such as activity logs, sign-up attribution, advertising measurement, advertising audiences and the use of data to improve the Services. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving reasons, and we will stop. To object, email [email protected].
Complaints
If you believe we process your personal data in breach of data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en) or with the supervisory authority of the EU country where you live or work, or where the alleged breach took place. We would be glad if you contacted us first, so that we can try to resolve the issue.
Security
We protect personal data with technical and organizational measures, including encryption in transit for all connections, passwords stored only as hashes, card details handled by our payment processor without reaching us, and access to our systems limited to the people who need it. No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.
Children
The Services are intended for adults. Our Terms of Service require users to be at least 18 years old, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We update this policy when our Services or the law change. The effective date of the current version is stated at the top. If we make material changes, we will tell you by email or in the app.
Contact us
For questions about this policy or your personal data, email [email protected] or write to OwlApply Oy, Tiistinkallio 6, 02230 Espoo, Finland.