Skip to content
ApplyRunner

Privacy Policy

What we collect, why we collect it, who sees it, and the control you have over it.

Last updated October 18, 2026

Summary

  • We use your information to find jobs for you and apply to them on your behalf, in the mode you choose.
  • We send an employer only what its application form asks for, and only for jobs you have authorized.
  • We do not sell or share your personal information for advertising, and we do not use it to train AI models.
  • We never use AI to guess facts such as work authorization, sponsorship or salary. Those come only from you.
  • You can see, correct, export or delete your information at any time.

This summary is for convenience. The full policy below controls.

Contents

1. Who we are and what this policy covers

This Privacy Policy explains how ApplyRunner LLC ("ApplyRunner", "we", "us" or "our") collects, uses, discloses and protects personal information when you visit our website, create an account, or use our job-matching and application service, Penny (our career assistant) or our free career tools, such as the skills gap assessment (together, the "Service").

For the personal information described in this policy, ApplyRunner is the "controller" (or "business") that decides how and why it is processed. When we submit an application to an employer, that employer, and the hiring system it uses, become independent controllers of the copy they receive. Their own privacy policies govern what they do with it.

This policy does not cover third-party websites, hiring systems or services, even where the Service links to or submits information through them. By using the Service, you acknowledge that you have read this policy. Where the law requires your consent, we ask for it separately.

2. Information we collect

2.1 Information you give us

  • Account information: your name, email address, password or sign-in credentials, and account settings.
  • Resume and career information: the resume you upload and the text we extract from it, such as work history, education, skills, certifications and links to profiles or portfolios.
  • Job preferences: target titles, locations, remote or on-site preference, salary expectations, company preferences, and the companies or roles you exclude.
  • Answer bank: facts you confirm for use in applications, such as contact details, work authorization, need for visa sponsorship, earliest start date, willingness to relocate, notice period and, only if you choose to give them, voluntary self-identification answers (see Section 3).
  • Automation settings: the mode you choose (Review, Hybrid or Auto), your minimum match score and your daily application limit.
  • Conversations with Penny: the questions you ask Penny, our career assistant, and its replies, saved to your account so you can return to them.
  • Skills assessments: your answers to a skills gap assessment and, if you are signed in and choose to save it, the result.
  • Communications: messages you send us, including support requests and feedback.
  • Payment information: when you buy a paid plan, our payment processor, Stripe, Inc., collects your card details directly. We receive only limited details, such as the card brand, the last four digits, the billing country and the status of payments. We do not store full card numbers.

2.2 Information we create when you use the Service

  • Match scores and the reasons behind them for each job we find.
  • Tailored resumes: versions of your resume reworded or reordered for a particular job, using only content you supplied.
  • Draft answers to free-text questions on application forms, written from your own information.
  • Application records: for each job, the posting, the questions asked, the answers and resume version sent, the time of submission, and the result reported back by the hiring system.

2.3 Information collected automatically

  • Device and log data: IP address, browser type, operating system, pages requested, the date and time of requests, and error logs.
  • Cookies and similar technologies: described in Section 13.

2.4 Information from other sources

  • Public job postings: we collect job listings from public careers pages and from job-listing providers. These postings concern employers, not you, but we combine them with your preferences to find matches.
  • Hiring systems: confirmations or status information returned when an application is submitted.
  • Sign-in providers: if you sign in through a third party, we receive the details that provider shares with your permission, usually your name and email address.

2.5 Free tools without an account

You can take a skills gap assessment without an account. If you upload a resume to get suggestions, we read it in memory to make them and do not store the file or its text. To prevent abuse, we count how many suggestions are made from your IP address each day.

You are not required to give us any information. But without a resume and the answers an application asks for, we cannot apply to jobs for you.

3. Sensitive information

Some information you may give us is treated as sensitive or special-category information under certain laws. We handle it with extra care:

  • Voluntary self-identification: employers in some countries ask optional questions about gender, race or ethnicity, veteran status or disability. Giving these answers is entirely your choice. If you do not, we answer "decline to answer" wherever the form allows it. Where you give them, we use them only to answer those same questions on applications you authorize, and only with your explicit consent, which you can withdraw at any time.
  • Immigration information: your work authorization and sponsorship needs are used only to answer the questions on applications that ask for them.
  • Account credentials: any credentials you store with us are encrypted and used only to carry out the actions you have asked for.

We do not use sensitive information to infer characteristics about you, to rank or filter jobs, or for any purpose other than the one you gave it for.

4. How we use information and our legal bases

We use personal information only for the purposes below. Where the GDPR or UK GDPR applies, we rely on the legal basis shown.

  • To provide the Service: to build your profile, find and score jobs, tailor your resume, draft answers, submit applications you have authorized, and keep your application records. Legal basis: performance of our contract with you.
  • To manage your account and billing: to create and secure your account, process payments, and send service and billing notices. Legal basis: contract; legal obligation (tax and accounting).
  • To process sensitive information as described in Section 3. Legal basis: your explicit consent.
  • To keep the Service safe and reliable: to prevent fraud and abuse, enforce our Terms, debug errors and protect our users and systems. Legal basis: our legitimate interest in a secure service.
  • To improve the Service: to understand which features are used and where applications fail, using aggregated or de-identified data wherever possible. Legal basis: our legitimate interest in improving the Service.
  • To respond to you: to answer support requests and feedback. Legal basis: contract; legitimate interest.
  • To meet legal duties: to comply with law, respond to lawful requests, and establish or defend legal claims. Legal basis: legal obligation; legitimate interest.
  • Product updates: to send optional product news, only where you have agreed or where the law otherwise allows. You can opt out at any time using the link in each message. Legal basis: consent or legitimate interest.

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they are not overridden. You can ask us for details of that assessment. We will not use your information for a new purpose that is incompatible with these purposes without telling you and, where required, asking for your consent.

5. AI and automated processing

  • What AI does: we use AI models to read your resume, score how well jobs match you, reword and reorder your resume for a job, draft answers to free-text questions using your own information, suggest skills assessment answers from a resume you upload (each with a quote from it, for you to confirm), and answer your questions to Penny.
  • What AI does not do: AI never invents or guesses factual answers. Work authorization, sponsorship, salary, start date, self-identification and similar answers come only from your answer bank. If we do not have an answer, the application waits for you. Resume tailoring never adds skills, titles, employers, dates or numbers.
  • Penny: Penny answers using only your own profile, resume, matches and applications, which it reads when you ask. It cannot send applications or change your information, and it does not give legal, immigration or financial advice. Its replies can contain mistakes, so check anything important.
  • No training on your data: we do not use your personal information to train AI models, and our AI providers are contractually prohibited from doing so.
  • Your control: match scores help decide which jobs are applied to, within the settings you choose. In Review mode nothing is sent without your approval. In every mode you can see each answer that was sent, and you can pause automation at any time.
  • Decisions about you: ApplyRunner does not make hiring decisions. Employers, and the systems they use, decide how to assess applications. Those systems may use their own automated tools, under their own policies.

6. How we disclose information

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We disclose it only as follows:

  • Employers and their hiring systems: when an application is authorized under your chosen mode, we send the employer, through its hiring system (such as Greenhouse, Lever or Ashby), the information its form asks for. We do not send information the form does not request.
  • Service providers (processors): companies that process information on our behalf under written contracts that limit their use of it to providing services to us and require them to protect it. They currently include:
    • Anthropic, PBC: AI processing.
    • MongoDB, Inc.: database hosting.
    • Apify Technologies s.r.o.: collection of public job listings. Apify does not receive your resume or answer bank.
    • Amazon Web Services, Inc.: application hosting, filling and sending applications, and transactional email.
    • Stripe, Inc.: payments.
    We will keep this list current and update it before adding a new provider that receives personal information.
  • Legal and safety reasons: where we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of you, our users, the public or ApplyRunner. Where the law allows, we will tell you about a request for your information before disclosing it.
  • Business transfers: if ApplyRunner is involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction. The recipient must honor this policy, and we will notify you before your information becomes subject to a different policy.
  • With your direction: to anyone else, when you ask us to.

We may disclose aggregated or de-identified information that cannot reasonably be used to identify you. We will not attempt to re-identify it.

7. International transfers

We are based in the United States, and our service providers may process information in the United States and other countries whose data protection laws may differ from yours. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision, the EU Standard Contractual Clauses (with the UK Addendum where relevant), or another lawful transfer mechanism. You can ask us for a copy of the relevant safeguards.

8. How long we keep information

  • Account, profile, resume and answer bank: for as long as your account is open. Deleted at once when you delete your account.
  • Application records: for as long as your account is open, so you can see what was sent. Deleted with your account.
  • Penny conversations and saved assessment results: until you delete them or your account.
  • Resumes uploaded to a free tool without an account: not stored; read only to make the suggestions.
  • Voluntary self-identification answers: deleted as soon as you remove them or withdraw consent, and in any case with your account.
  • Billing records: for as long as tax and accounting law requires, usually 7 years.
  • Security and server logs: up to 30 days, unless needed to investigate an incident.
  • Backups: deleted information may remain in encrypted backups for up to 35 days before being overwritten. It is not used during that time.

We may keep information longer where the law requires it or to establish, exercise or defend legal claims, and only for as long as that need lasts. Applications already sent to an employer are kept by that employer under its own policies. We cannot delete them, but we can tell you which employers received your information.

9. Security

We use administrative, technical and physical safeguards suited to the sensitivity of the information. These include encryption in transit (TLS) and, for your resume, answer bank and stored credentials, encryption at rest using AES-256-GCM. Access is limited to people and systems that need it. We submit applications under your own name and email address, and we do not use CAPTCHA solvers, proxy networks or fake accounts. See Security.

No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

10. Your rights and choices

10.1 Controls available to everyone

  • Access and correction: view and edit your profile, resume and answer bank at any time in your account.
  • Export: download your information in a commonly used, machine-readable format.
  • Deletion: delete individual answers or your whole account.
  • Automation: switch to Review mode or pause automation at any time.
  • Consent: withdraw consent for sensitive information at any time. This does not affect processing that already took place.
  • Marketing: unsubscribe from optional emails. We will still send messages needed to run your account.

10.2 Legal rights

Depending on where you live, you may also have the right to:

  • know what personal information we hold about you and how we use and disclose it;
  • obtain a copy of it;
  • have it corrected or deleted;
  • receive it in a portable format;
  • object to or restrict certain processing;
  • opt out of sale, sharing for targeted advertising, or profiling with legal or similarly significant effects (we do none of these);
  • limit the use of sensitive personal information (we already use it only as Section 3 describes); and
  • appeal our decision on a request.

10.3 How to make a request

Email [email protected] from the address on your account. To protect you, we will verify your identity before acting, usually by confirming control of that email address. You may use an authorized agent; we may ask the agent for proof of authority and ask you to confirm your identity directly. We will respond within the time the law requires: 45 days under U.S. state laws and one month under the GDPR, which may be extended where the law allows. We will not discriminate against you, or charge you more, for exercising your rights.

If we decline your request, we will explain why. Where you have a right to appeal, reply to our decision with "Appeal" in the subject line, and we will respond within the time the law requires. If you are not satisfied, you may contact your state attorney general or your local data protection authority.

11. Additional notice for U.S. state residents

This section applies to residents of California and other U.S. states with comprehensive privacy laws. In the past 12 months, we have collected the following categories of personal information, from the sources described in Section 2, for the purposes described in Section 4:

  • Identifiers: name, email, phone number, IP address. Disclosed to: employers you apply to, service providers.
  • Professional or employment information: resume, work history, preferences. Disclosed to: employers you apply to, service providers.
  • Education information: degrees and schools on your resume. Disclosed to: employers you apply to, service providers.
  • Commercial information: plan and payment history. Disclosed to: payment processor.
  • Internet activity: log and device data. Disclosed to: hosting provider.
  • Inferences: match scores and skills assessment results. Disclosed to: no one outside our service providers.
  • Sensitive personal information: account credentials; and, only if you choose to give them, immigration status and self-identification answers. Disclosed to: employers you apply to, as described in Section 3, and service providers.

We do not sell or share personal information, have not done so in the past 12 months, and have no actual knowledge of selling or sharing information of anyone under 16. We use sensitive personal information only for purposes permitted without a right to limit under California regulations. Retention periods are in Section 8.

12. Additional notice for the EEA, UK and Switzerland

The controller is ApplyRunner LLC. We have not appointed a data protection officer or an EU or UK representative; contact us at [email protected]. You have the rights listed in Section 10.2, including the right to object to processing based on legitimate interests. You may lodge a complaint with the supervisory authority where you live or work, or where an alleged infringement occurred. We would appreciate the chance to address your concern first.

13. Cookies and similar technologies

We use only cookies and local storage that are strictly necessary to run the Service, such as keeping you signed in and remembering your settings. We do not use advertising cookies or cross-site tracking. If we add analytics or any non-essential cookies, we will update this policy first and, where the law requires, ask for your consent. We honor Global Privacy Control signals as a request to opt out of sale and sharing, which we do not do in any case.

14. Children

The Service is for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new "Last updated" date. If a change is material, we will email you at least 30 days before it takes effect. We will not apply a material change to information collected earlier without your consent where the law requires it.

16. How to contact us

Privacy questions and requests: [email protected]
Postal address: ApplyRunner LLC, 2248 Broadway #2068, New York, NY 10024, United States

For anything else, see Contact.