Privacy Policy
This is a translation for convenience. The Ukrainian version is the binding one.
The short version
- Your CV is yours. We use it only to provide PlainApply to you.
- We don't sell data, don't show ads in the app, and don't let AI providers train on your CV.
- No cookie banner, because we don't use tracking cookies.
- Your data is stored in the EU (Germany).
- Export everything or delete your account yourself, any time, in Settings.
- Questions: support@plainapply.com — we reply within 24 hours.
1. Who is responsible for your data
The controller is Фізична особа-підприємець Вереніч Іван Володимирович (Ivan Volodymyrovych Verenich), РНОКПП 3146204555, apt. 55, 45 Mineralna St., Irpin, Bucha District, Kyiv Oblast, 08202, Ukraine ("we"). Contact for every privacy question: support@plainapply.com.
2. What we collect, why, and on what legal basis
| Data | Why | Legal basis (GDPR / Ukrainian law) |
|---|---|---|
| Account: email, name, Google account ID (if you sign in with Google) | Sign-in, receipts, service emails | Contract |
| Your content: CVs (contact details, work history, education, skills, optional photo), uploaded files, Searches, Vacancies, Applications, Rounds, notes | The service you asked for | Contract |
| AI actions: the text sent to an AI model and the result; which model ran it; Credits spent | Running AI actions; returning Credits when they fail; keeping track of which text was AI-suggested | Contract |
| Voice recordings (Generate CV) | Turning speech into text | Contract. Deleted right after transcription |
| Own AI Keys | Running AI actions on your provider account during a Pass | Contract. Stored encrypted |
| Payments: what you bought, amount, date, payment status, card country type (Ukrainian or foreign), fiscal receipt. Never card numbers | Granting Credits and Passes, refunds, tax records | Contract; legal obligation (tax and fiscal law) |
| Product usage: which screens and buttons are used, counted without cookies; never CV text, names or emails | Improving the product | Legitimate interest. Opt out in Settings |
| Session recordings (only if you opt in) — all text inputs and CV content masked | Finding confusing parts of the interface | Consent; withdraw any time in Settings |
| Technical and security data: IP address, device and browser type, error reports (without CV text), sign-in history, abuse signals | Security, fraud prevention, fixing errors | Legitimate interest |
| Support conversations (email, Telegram) | Answering you | Contract; legitimate interest |
| Marketing source: the ad campaign or link that brought you (UTM tags), recorded at signup | Knowing which channels work | Legitimate interest |
| Product-news emails (only if you opt in) | Telling you about new features | Consent; one-click unsubscribe in every email |
We never ask for health data, religion, political views, ethnic origin or other special categories of data. Employers don't need them; please don't put them in your CV.
Guest drafts
If you use the editor without an account, your draft is stored only in your browser. It reaches our servers only when you sign up.
What we use your content for — and not
- We do: store it, show it to you, send it to an AI provider when you run an AI action, export it to PDF.
- We don't: sell it, share it with employers or recruiters, use it for advertising, or use it to train AI models.
- Support staff see your CVs, Applications or Vacancies only if you explicitly allow it in a support conversation, only for that conversation, and every access is logged. Without your permission support sees only your email, signup date, purchases, Credit history and technical errors.
- Anonymised statistics: we may publish aggregated numbers about job searching (e.g. average response time), only when at least 50 people are behind each number and no person or company can be identified. Opt out in Settings.
3. AI providers
| Provider | When | Where data is processed | Training on your data |
|---|---|---|---|
| Google (Gemini via Vertex AI) | AI actions on PlainApply's AI | EU (Frankfurt, Germany) | No |
| OpenAI | AI actions on PlainApply's AI; voice transcription | USA | No (API terms) |
With an Own AI Key your CV text goes to the provider you chose (OpenAI, Anthropic, Google or DeepSeek) under your own agreement with that provider, and that provider's privacy terms apply. DeepSeek processes data in China; we show a warning before you save a DeepSeek key, and we never use DeepSeek for PlainApply's own AI.
4. Who else processes your data
We use these service providers ("processors"). Each processes data only on our instructions, under a data-processing agreement.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | EU (Frankfurt, Germany) |
| Hetzner Online | App servers, encrypted backup copies | EU (Germany) |
| Cloudflare | Domain name system, network protection | Global network |
| Google Cloud | Sign in with Google; Gemini AI | EU (Frankfurt) for AI |
| OpenAI | AI actions, voice transcription | USA |
| Resend | Sending emails (sign-in links, receipts, reminders) | EU |
| Zoho | Support mailbox | EU |
| PostHog | Cookieless product analytics; opt-in session recordings | EU |
| Sentry | Error reports (no CV text) | EU |
| Universal Bank (monobank) | Card payments in UAH, fiscal receipts | Ukraine |
| Telegram | Community group and channel, if you join them | Telegram's own terms apply |
5. Transfers outside the EU and Ukraine
Your data is stored in the EU. Some providers are companies based in the USA (e.g. Supabase, Cloudflare, OpenAI, Sentry). Where data may reach the USA or another country without an adequacy decision, the transfer is protected by the EU Standard Contractual Clauses in the provider's data-processing agreement, or the provider's certification under the EU–US Data Privacy Framework. Transfers between the EU and Ukraine follow the same safeguards.
6. How long we keep data
| Data | Kept |
|---|---|
| Account, CVs, Applications, notes, files | Until you delete them or your account |
| Uploaded original files | Until you delete them (any time) |
| Voice recordings | Deleted immediately after transcription; only the text is kept |
| Own AI Keys | Until you delete the key or your account |
| Payment records and fiscal receipts | As long as Ukrainian tax law requires (at least 1,095 days, Tax Code of Ukraine, art. 44.3) — kept even after account deletion, with the minimum data needed |
| Product analytics | 12 months |
| Error reports | 30 days |
| Support conversations | 24 months |
| Session recordings | Up to 30 days |
When you delete your account: it disappears from the app at once; database rows and files are deleted within 24 hours; daily backups roll off within 7 days and weekly encrypted backups within 4 weeks. You get a confirmation email.
7. Cookies and browser storage
We use only what is strictly necessary:
- a sign-in cookie that keeps you logged in;
- browser storage for your guest draft and interface settings.
Product analytics run without cookies and without storing anything on your device. We don't use advertising cookies, tracking pixels or click IDs, so there is no cookie banner. Our emails contain no open-tracking pixels.
8. Security
Data is encrypted in transit (HTTPS) and at rest. Own AI Keys are encrypted with AES-256-GCM before storage, decrypted only by the server that runs AI actions, never shown again after saving (only the last 4 characters), and every use is logged. Access to your data is limited per account at the database level. Critical accounts are protected by two-factor authentication. Error logs never contain CV text.
If a breach puts your data at risk, we will notify the competent data-protection authorities within 72 hours and tell you without delay when the risk to you is high.
9. Your rights
You have the right to:
- access your data and get a copy — Settings → Export my data (JSON + PDFs);
- correct it — edit it in the app;
- delete it — Settings → Delete account;
- restrict or object to processing based on legitimate interest — including analytics and anonymised statistics (toggles in Settings);
- withdraw consent at any time (session recordings, product-news emails), without affecting earlier processing;
- data portability — the export is in a machine-readable format;
- complain to a supervisory authority.
Under Ukrainian law (Law "On Personal Data Protection", art. 8) you also have the right to know the sources, purposes and recipients of your data and to have unlawful processing stopped.
How to ask: use the self-service options or write to support@plainapply.com from your account email (or confirm a link we send to it). We answer within 24 hours and complete requests within 30 days at the latest — usually the same day.
Complaints:
- Ukraine: Ukrainian Parliament Commissioner for Human Rights — https://ombudsman.gov.ua
- EU: the data-protection authority of the country where you live — list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
10. Children
PlainApply is for people aged 16 and over. We don't knowingly collect data from younger children; if you believe a child under 16 has an account, write to us and we will delete it.
11. Automated decisions
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. AI features suggest text and reports; you decide what to use. We don't rank or assess people for employers.
12. Changes
We will email you before any change that reduces your privacy, and keep earlier versions available under "Previous versions" on this page.