Privacy notice
Last updated: 7 November 2026
ApplyPilot is currently a prototype. It does not submit applications to real employers or job boards.
Information we process
We process information you choose to provide, including identity and contact details, employment history, education, skills, work authorization, salary preferences, application preferences, consent choices and uploaded résumés or certificates.
Pre-account résumé preview
If you request the public résumé preview, the file is checked and its text is sent to the configured Claude service to create a one-time capabilities and role-area summary. ApplyPilot does not add the file, extracted text or preview to its customer database or document storage before sign-in. A short-lived copy may remain in your browser for up to one hour so it can continue through sign-up; you can remove it by choosing “Try another résumé” or creating an account without a résumé. Abuse-prevention counters use a one-way network fingerprint and do not contain résumé content.
How information is used
Your information is used to build your career profile, prepare role matches and application drafts, store your selected documents, display application activity and provide exports you request. We do not sell your personal information.
AI job-agent access
The external job agent is disabled unless you enable it. For up to 90 days, the recorded scopes may allow it to use your career profile, résumé text, screening answers and selected-application status for matching, preparation and tracking. It cannot approve an application. You can revoke access at any time, which cancels incompatible queued or running work. Diversity information, passwords and government identifiers are not included in agent context.
Storage, backups and access
After sign-in, structured records are stored in the primary platform database and documents are kept in private object storage. Approved administrators can access operational tools. Encrypted backup copies may be stored in private object storage and, only when configured, a dedicated Google Drive backup folder. Google Drive is not a live database and Drive edits do not change customer records.
Your controls
You can export your records in CSV or SQL format and permanently delete your account data from the My data area. A SQL export can contain parsed résumé text and must be protected as sensitive. Account deletion removes live profile, application, agent and document records. Encrypted disaster-recovery backups may still contain earlier records; automatic backup expiry and restoration are not enabled in this prototype, and a production restore must honor deletion tombstones.
Retention and production launch
Prototype live data remains until you delete it or the operator removes the prototype environment. Encrypted backups remain until the operator securely deletes them under a documented recovery process. Production launch requires an enforced backup-retention schedule, legal bases, contact details, processor disclosures and appropriate agreements with every AI service provider.
Security
ApplyPilot uses authenticated access, server-side ownership checks, private file storage, request validation, rate limits, security headers and audit records. No internet service can guarantee absolute security; report suspected issues through the operator’s official support channel.