Privacy Policy

ApplyCruise is the Data Fiduciary for the personal data described here. Our grievance contact is on the Contact page.

Account data. Your email address, a salted hash of your password (never the password itself), email-verification and password-reset tokens, and sign-in timestamps.

Your résumé and profile. The résumé file you upload and the text extracted from it; your name, phone number, location, years of experience, skills, current and expected salary, notice period, and the target roles you enter during onboarding. This is the data submitted to employers on your behalf.

Application activity. Which postings we found, how each was scored, whether an application was submitted, and the answers given to employer questionnaires — including answers you supply yourself, which we keep so the same question is not asked twice.

Job-site sessions. See clause 3.

Payment data. Plan, amount, period, and the Razorpay order and payment identifiers. Card numbers, UPI handles and bank credentials are handled entirely by Razorpay and never reach our servers.

Technical data. IP address and request metadata, used for rate-limiting and abuse prevention, and server logs of the automation so failures can be diagnosed. Those logs may contain job titles, employer names and page screenshots from your applications.

• To provide the service you asked for: finding, screening and submitting job applications, and answering employer questions on your behalf. This is processing for a specified purpose to which you consented at sign-up.
• To operate your account: authentication, email verification, password reset, and support.
• To take payment and enforce plan limits.
• To keep the service safe: rate-limiting, fraud and abuse prevention.
• To meet legal obligations, including tax and accounting records.

We do not sell personal data, we do not share it for advertising, and we do not use your résumé or your answers to train our own models.

We use the following processors. Each receives only what its function requires.

We may also disclose data where legally compelled, or to establish or defend a legal claim.

The AI providers we use to answer employer questionnaires and tailor résumés operate outside India. Using the service means résumé extracts and job descriptions are transmitted to them for processing. We send only what the task needs, and we do not permit them to use your content to train their models where their terms allow us to make that election.

Resend, which sends our emails, and Cloudflare, whose network carries every request to and from the site, also operate outside India, so your email address and the data in your requests may be processed outside India too.

• Traffic is served over TLS.
• Passwords are stored as PBKDF2 hashes; verification codes and reset tokens are stored hashed and compared in constant time.
• Résumé text and uploaded résumé files are encrypted at rest. The plaintext copy the automation needs exists only while a run is in progress and is removed when it ends.
• Each account's data — application history, answers, job-site profile — lives in its own directory, and an automation run is started with only that account's information in its environment.
• Sign-in streaming is gated by a short-lived token bound to one account and one site, revoked as soon as the attempt ends.
• Sign-up, sign-in, verification and password reset are rate-limited per IP address and per account.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board as the DPDP Act requires.

• Account and profile data: until you delete your account.
• Résumé and application history: until you delete them, or your account.
• Job-site sessions: a site's cookies, the data it stored in the browser and our copy of its sign-in cookies, until you disconnect it (clause 3 says when each is removed); the rest of the browser profile, until you delete your account.
• Automation logs and diagnostic screenshots: pruned automatically, typically within 7 days.
• Payment and tax records: retained as long as Indian tax law requires, even after account deletion.

Deleting your account removes your personal data from live systems promptly. Backups are rotated and any residual copy ages out with them.

Under the DPDP Act you may:

• Ask what personal data we hold about you and how it has been processed.
• Have inaccurate or incomplete data corrected or completed.
• Have your data erased, unless we must keep it by law.
• Withdraw consent — which means we stop applying on your behalf, and you can delete your account.
• Nominate someone to exercise these rights if you die or become incapacitated.
• Complain to our Grievance Officer, and escalate to the Data Protection Board of India if unsatisfied.

Most of this is self-service in the app: your résumé and profile are editable, sites can be disconnected, and the account can be deleted. For anything else, write to our Grievance Officer — see Contact. We respond within 30 days.

We use browser storage to keep you signed in and to remember interface preferences such as filters and dismissed hints. We do not use advertising cookies or third-party trackers.

The service is not for anyone under 18 and we do not knowingly process a child’s data. If you believe a child has created an account, contact us and we will delete it.

We will post any update here and change the date at the top. Material changes will be notified by email or in the app before taking effect.