1. Who We Are
ApplyLuma ("we", "us") operates the applyluma.com platform. We are the data controller for personal data processed through the Service. You can reach us at support@applyluma.com.
2. Data We Collect
- Account data: email address, full name, hashed password
- CV and job data: resumes you upload, job descriptions you add, cover letters you generate
- Usage data: pages visited, features used, timestamps
- Billing data: subscription status (payment details are handled by Stripe and never stored by us)
- Communications: emails we send you (verification, alerts, support)
3. How We Use Your Data
- To provide and improve the Service (legal basis: contract performance)
- To send transactional emails such as email verification and password reset (legal basis: contract performance)
- To send job alert emails, if you enable them (legal basis: consent)
- To process AI features — your CV and job descriptions are sent to OpenAI's API for analysis (legal basis: contract performance)
- To process payments through Stripe (legal basis: contract performance)
- To monitor platform health and prevent abuse (legal basis: legitimate interests)
4. Third-Party Services
We share data with the following processors to operate the Service:
- OpenAI — CV tailoring, cover letter generation, job match scoring
- Stripe — subscription billing and payment processing
- Resend — transactional email delivery
- Railway — backend hosting and database
- Vercel — frontend hosting and (with consent) anonymous usage analytics
- PostHog — (with consent) product analytics for understanding feature usage
We do not sell your personal data to third parties.
5. Data Retention
We retain your data for as long as your account is active. If you delete your account, your personal data is deleted within 30 days, except where we are required to retain it for legal or billing purposes.
6. Your Rights (GDPR)
If you are in the EU/EEA, you have the right to:
- Access — request a copy of the data we hold about you
- Correction — ask us to correct inaccurate data
- Deletion — request deletion of your personal data
- Portability — receive your data in a machine-readable format
- Restriction — ask us to limit how we process your data
- Objection — object to processing based on legitimate interests
- Withdraw consent — at any time, for processing based on consent (e.g. job alert emails)
To exercise any of these rights, email support@applyluma.com. We will respond within 30 days.
7. Cookies
We use two categories of cookies:
- Strictly necessary — httpOnly session cookies (
access_token, refresh_token) and a CSRF security token are required for authentication and cannot be disabled. - Analytics (optional, consent required) — We use PostHog and Vercel Analytics to understand how the app is used and improve it. These are only activated after you click "Accept all" in the cookie banner shown on your first visit. You can withdraw consent at any time by clearing your browser's local storage.
8. Security
We use industry-standard security measures including HTTPS, hashed passwords, JWT authentication, and role-based access control. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or via an in-app notice.