Privacy Policy
TheEasyApply handles resumes, which are among the most personal documents most people own. This explains exactly what happens to yours.
Last updated 7 August 2026
The short version: your resume is stored so you can edit it, and its text is sent to third-party AI providers when you ask us to tailor it. We do not sell anything, we do not advertise, and you can export or delete everything yourself from Settings → Data & privacy.
1. Who is responsible
TheEasyApply is run by two individuals rather than a company. Under the UK and EU GDPR we are joint data controllers:
- Tanay Van — tanayvan258@gmail.com
- Malhar Lumbhani — malharlumbhani1432@gmail.com
For anything about your data, write to privacy@theeasyapply.com, which reaches both of us. Our postal address is available on request and is provided to supervisory authorities where required.
[PLACEHOLDER — a postal address must be published here before EU launch. See the note in the deployment checklist.]
2. What we collect
Almost all of it is content you typed or uploaded. We do not buy data about you and we do not track you across other websites.
| What | Where it comes from |
|---|---|
| Account identity — email, name, sign-in method | Clerk, our authentication provider. It is not copied into our own database. |
| Resume content — name, email, phone, location, links, work history, education, skills | The PDF you import, or the guided intake you fill in. |
| Job descriptions and company names | Pasted by you when tailoring or tracking an application. |
| Applications — stage, dates, notes, the version you sent | Entered by you in the tracker. |
| Recruiter contact details and a short email excerpt | From an email you paste in when logging an application. |
| Job preferences — target roles, countries, excluded companies | Your job-search settings. |
| Subscription status and Stripe identifiers | Created when you subscribe. We never see or store your card details. |
| IP address and browser user-agent | Sent by your browser. Used for rate limiting, abuse prevention and server logs. |
If you use the signed-out demo, the resume you paste is stored temporarily and unattached to any account. See clause 7.
3. Why we are allowed to use it
- Performance of a contract — storing and rendering your resumes, running the tracker, taking payment. Without this the product cannot work.
- Legitimate interests — keeping the service up, preventing abuse, and fixing crashes. Balanced against your interests; you can object at any time.
- Consent — optional analytics cookies, and product-news email if you switch it on. Withdrawable at any time, and withdrawing is as easy as giving it.
- Legal obligation — keeping invoices and tax records for the period the law requires.
4. AI providers — please read this one
When you tailor a resume, run a match score, use the coach, or parse a pasted recruiter email, the relevant text — which can include your full resume and your name and contact details — is sent to a third-party AI provider for processing.
We use whichever of the following is configured at the time. This list is accurate as of the date above, and we will update it when it changes:
| Provider | Where it processes data |
|---|---|
| xAI (Grok) — currently the default | United States |
| Anthropic (Claude) | United States |
| OpenAI | United States |
| Google (Gemini) | United States |
| DeepSeek | China |
| Moonshot AI | China |
Two of these providers process data in China, which is outside the UK and EEA and has not received an adequacy decision. If that is not acceptable to you, do not use the AI features — importing, editing, exporting and application tracking never call a model, and they remain fully usable.
We rely on each provider's standard terms, which for the vendors above state that API content is not used to train their models. We do not have separate negotiated agreements with them, and we cannot audit them. We are telling you this rather than implying a guarantee we are not in a position to give.
We never send your data to a model for any purpose you did not initiate, and we do not use your resumes to train anything of our own.
5. Who else touches your data
These are our sub-processors. They act on our instructions, and we do not sell or rent personal data to anyone.
| Service | What it does | Where |
|---|---|---|
| Clerk | Authentication and account management | United States |
| MongoDB Atlas | The database holding your resumes and applications | United States |
| Google Cloud | Runs the API; receives server logs including IP addresses | United States |
| Vercel | Hosts the website; optional analytics | United States |
| Cloudflare | Turnstile anti-bot check on signed-out pages; receives your IP | Global |
| Stripe | Payments and subscriptions; card details go to Stripe, never to us | United States |
| Sentry | Crash reports, with request bodies and credentials stripped first | European Union |
| AI providers | See clause 4 | US and China |
Transfers outside the UK/EEA rely on the UK Addendum and the EU Standard Contractual Clauses where the provider offers them.
6. How long we keep it
| Data | Kept for |
|---|---|
| Resumes, applications, preferences | Until you delete them, or until you delete your account |
| Guided-interview drafts | 30 days, then deleted automatically |
| Job leads | 90 days, then deleted automatically |
| Signed-out demo drafts | 24 hours, then deleted automatically |
| Uploaded PDF files | Deleted from disk immediately after parsing |
| Server logs | As retained by Google Cloud Logging, currently 30 days |
| Crash reports | 90 days |
| Invoices and payment records | As long as tax law requires, typically 6–7 years |
Deleting your account removes everything in the first row immediately. Invoices are the exception — we are required to keep those, so your Stripe customer record and its invoice history survive deletion even though the subscription is cancelled.
7. The signed-out demo
You can paste a resume at /demo without an account. That text is stored against a random token, is never indexed or searchable, is not linked to an email address, and deletes itself after 24 hours. If you then create an account, you are offered the chance to claim it — at which point it becomes a normal resume covered by the rest of this policy.
8. Your rights
You can, at any time:
- Get a copy — Settings → Data & privacy → Export. One JSON file with everything we hold.
- Delete everything — Settings → Data & privacy → Delete account. Immediate and irreversible.
- Correct it — edit any resume or application directly, or email us.
- Object or restrict — email us and we will stop the processing in question or explain why we cannot.
- Withdraw consent — cookie preferences are re-openable from the footer of any page.
We answer requests within 30 days. If you are unhappy with how we handled one, you can complain to your local supervisory authority — in the UK that is the ICO, and in the EU it is the authority for your country.
9. Security
Traffic is encrypted in transit. Passwords are handled entirely by Clerk and never reach our servers. Card details are handled entirely by Stripe and never reach our servers. Crash reports have request bodies, cookies and authorisation headers removed before they are sent.
We are two people, not a security department. We are not going to claim a certification we do not have. If you find a vulnerability, email privacy@theeasyapply.com and we will take it seriously.
10. Children
TheEasyApply is for people looking for work and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has an account, tell us and we will delete it.
11. Changes
If we change this in a way that materially affects you — a new category of data, a new purpose, a new AI provider in a new country — we will say so in the product before it takes effect, not only by editing this page.