Updated: August 8, 2026
Zapply LLC ("Zapply," "we," "us," or "our") operates the Zapply Chrome browser extension, the Zapply mobile app (iOS and Android), and the website at zapply.jobs. This Privacy Policy describes how we collect, use, store, and share your personal information when you use our products.
By using Zapply, you agree to the practices described in this policy. If you do not agree, do not use our products.
Zapply LLC is a Texas limited liability company.
Data controller contact: - Email: [email protected] - Address: 13401 Legendary Drive, Apt 5208, Austin, TX 78727, US
For EU/EEA data protection inquiries, you may also contact us at [email protected] with the subject line "Data Protection Inquiry."
When you create a Zapply account and build your profile, you provide:
Employment-screening responses: optional answers about felony or other criminal convictions, and any related details you choose to provide for job-application autofill. Zapply does not obtain criminal-history records or make hiring decisions; you remain responsible for reviewing every answer before submitting an application. These fields are part of the extension/shared profile model and are not currently collected through the mobile app's user interface.
AI-generated content: answers to job application questions generated by our AI assistant based on your profile
Important — Sensitive Data Notice: Your demographic information (gender, ethnicity, race, disability status) and immigration status are special categories of personal data under the EU General Data Protection Regulation (GDPR) Article 9, and sensitive personal information under the California Consumer Privacy Act (CCPA/CPRA). We collect this information only because you voluntarily provide it, and we use it solely to autofill employer Equal Employment Opportunity (EEO) forms on your behalf. See Section 6 for how we handle this data and your rights.
When you use the Zapply extension, we collect:
When you use the Zapply mobile app (iOS and Android), we additionally collect:
The mobile app does not include any advertising, analytics, or crash-reporting SDK. Camera, microphone, location, and contacts are not accessed.
We use your personal information only to provide and improve Zapply's core functionality:
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Autofill job applications on your behalf | All profile data, demographic data, AI-generated answers | Performance of our contract with you (Art. 6(1)(b)) |
| Generate AI-powered answers to application questions | Your profile, resume, and the application question text | Performance of our contract with you (Art. 6(1)(b)) |
| Track and manage your job applications | Application URLs, submission status, employer responses | Performance of our contract with you (Art. 6(1)(b)) |
| Match you with relevant job listings | Work experience, skills, preferences, location | Performance of our contract with you (Art. 6(1)(b)) |
| Process payments | Payment details via Stripe | Performance of our contract with you (Art. 6(1)(b)) |
| Send transactional emails | Email address | Performance of our contract with you (Art. 6(1)(b)) |
| Improve product quality (aggregated analytics) | Usage patterns, error reports, feature engagement | Legitimate interest (Art. 6(1)(f)) |
| Detect and prevent fraud or abuse | Account activity, device information | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations | As required by law | Legal obligation (Art. 6(1)(c)) |
For special category data (demographics, disability, immigration status), we process this data under: - GDPR: Your explicit consent (Article 9(2)(a)). You may withdraw this consent at any time without affecting your ability to use Zapply's core autofill features. See Section 6. - CCPA/CPRA: To provide the services you requested (Cal. Civ. Code §1798.121).
We never: sell your personal information to third parties, use your personal information for targeted advertising, use your personal information to determine creditworthiness, or allow our employees or contractors to access your personal data except as necessary to provide the service or investigate abuse.
Zapply uses Google Gemini (paid tier) to power several AI features. Here is exactly what happens:
Zapply sends the following to Google Gemini, depending on the feature you use: - AI-generated answers to application questions: the text of the application question (from the employer's website), relevant portions of your profile (experience, skills, education), and your resume content when relevant to the question. - Resume-to-profile enrichment: when you upload a resume to build your profile, the resume document and extracted text are sent to Gemini to extract and populate profile fields (work experience, education, skills, etc.). - Profile-to-job scoring: when matching you to job listings, relevant profile data is sent to Gemini to score how well your profile fits a job. - Aggregate analytics categorization: in some cases, aggregated, de-identified category labels (e.g., job-title or industry groupings) are sent to Gemini to normalize analytics. This does not include your individual demographic information.
Because Zapply uses the Gemini API through a Google Cloud project with an active billing account: - Google's current Gemini API Additional Terms for Paid Services state that Google does not use prompts or responses to improve its products. - Those terms state that Google processes prompts and responses under its Data Processing Addendum for Products Where Google Is a Data Processor. - Google may log prompts and responses for a limited period solely to detect and prevent Prohibited Use Policy violations and to make required legal or regulatory disclosures. Google says that this data may be stored transiently or cached in countries where Google or its agents maintain facilities. - Google's terms separately address operational data such as account information, billing history, usage details, safety-filter triggers, errors, and technical identifiers under controller terms and Google's Privacy Policy.
Provider terms may change; the descriptions above reflect Google's current published terms for paid-tier API services.
For users in the European Economic Area (EEA), Switzerland, and the United Kingdom: Google's current Additional Terms require Paid Services when an API Client is made available to users in those regions.
Some answers to job application questions are generated or assisted by artificial intelligence. Zapply clearly indicates which answers are AI-generated within the extension interface before you submit them. You are always responsible for reviewing and approving the accuracy of any information submitted to employers.
| Provider | Purpose | Data Accessed | Location |
|---|---|---|---|
| Google Gemini (AI processor) | Generate AI answers, enrich profiles from resumes, score profiles against jobs, and classify aggregate analytics labels | Profile data, resume/document content, application question text, job data, and aggregate labels as applicable | US (with Google Paid Services DPA terms) |
| OpenAI (AI embeddings) | Generate numeric embeddings from your profile-derived career/skills text to power job matching | Profile-derived career/skills summary text (sent for embedding; not your full resume) | US |
| Supabase (database) | Store all account and profile data | All personal information | US |
| Stripe (payment processing) | Process subscription payments | Payment method details | US |
| PostHog (product analytics) | Understand feature usage and improve product | Page views, clicks, session recordings with configured masking | US |
| Cloudflare (infrastructure) | Serve the application securely, DDoS protection | All backend web requests | US |
| Resend (email delivery) | Send transactional emails (password reset, notifications) | Email address, email content | US |
| Google Firebase / FCM (push delivery, Android) | Deliver job-alert and account notifications | Push token, device name, platform, app version | US |
| Apple / APNs (push delivery, iOS) | Deliver job-alert and account notifications | Push token | US |
We do not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes.
When you use Zapply to autofill and submit a job application, the information you provide in that application is sent directly to the employer's applicant tracking system. This data includes whatever you have entered or approved in the application form. You are responsible for reviewing all information before submission. Zapply is not liable for the accuracy of information you submit to employers.
We may disclose personal information when required by law, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
In connection with any merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and a prominent notice on our website before your personal information becomes subject to a different privacy policy.
Zapply operates a voluntary Campus Ambassador referral program. Here is how it works and what data is involved:
referred_by reference, and the signup is attributed to that CA.referred_by link and referral records to operate attribution, prevent fraud, and administer compensation. The referral design does not disclose referred-user identities to the CA.Certain information in your profile is classified as "special category" under GDPR and "sensitive personal information" under CCPA/CPRA:
We collect this data for one purpose only: to autofill employer EEO (Equal Employment Opportunity) and diversity survey forms on your behalf, when you choose to complete those fields in a job application.
Criminal-history information is handled separately from the demographic and other special-category information described above. If you choose to provide a conviction or felony answer for autofill, we use it only to populate the corresponding employer application question at your direction. We do not run criminal-background checks, infer criminal history, or use this information to rank candidates or make hiring decisions. You should review the exact question, answer, and any jurisdiction-specific disclosure requirements before submission.
The mobile app does not currently collect these fields through its user interface. The Chrome extension/shared profile model may retain and use optional values for employer-form autofill. Request correction or deletion by contacting [email protected]; account deletion controls also apply to associated profile data.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account information | While your account is active + 30 days after deletion request | Account management |
| Profile and resume data | While your account is active + 30 days after deletion request | Service delivery |
| Demographic / special category data | While your account is active + immediate deletion upon consent withdrawal or deletion request | Explicit consent basis |
| Job application history | While your account is active + 1 year after last activity | Application tracking |
| AI-generated answers | While your account is active + 30 days after deletion request | Service delivery |
| Payment records | 7 years | Tax and legal obligations |
| Analytics data (aggregated) | Retained while the product operates; the retention period is set in our analytics provider's project settings and is available on request | Product improvement |
| Server logs | Up to 7 days (Cloudflare Workers Logs) | Security and abuse prevention |
You may request deletion of your account and all associated data at any time by contacting [email protected] or through your account settings.
Regardless of your location, you may: - Access the personal information we hold about you - Correct inaccurate or incomplete personal information - Delete your account and personal information - Export your data in a portable format - Object to processing based on legitimate interest
To exercise any of these rights, contact [email protected] or use your account settings.
Under the California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.), you have the right to:
We do not sell or share your personal information for advertising purposes. We use your sensitive personal information only to provide the services you requested (autofilling job applications, including EEO forms you choose to complete).
Automated Decision-Making Technology (ADMT): Under the California Privacy Protection Agency's regulations effective January 1, 2027, businesses using automated decision-making technology for significant decisions must provide additional consumer rights. Zapply's AI-generated answers are reviewed and approved by you before submission — you are always in the loop. If our use of AI ever changes to include fully automated decisions, we will provide the required notices and opt-out rights at that time.
If you make a request, we will respond within 45 days (with a 45-day extension if reasonably necessary). You may designate an authorized agent to submit requests on your behalf.
Under the General Data Protection Regulation (EU) 2016/679, you have the right to:
You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
If you are a resident of Colorado, Connecticut, Nevada, Utah, or Virginia, you have similar rights under your state's privacy law. Contact [email protected] for details.
We implement industry-standard security measures to protect your personal information:
No system is perfectly secure. If we become aware of a data breach that affects your personal information, we will notify you and the relevant authorities within the timeframes required by applicable law (72 hours under GDPR, without unreasonable delay under state breach notification laws).
Zapply is a US-based company. Your data is processed and stored on servers in the United States. If you are accessing Zapply from the EU/EEA, UK, or elsewhere outside the US, your data will be transferred to the US.
For EU/EEA/UK users: - We rely on applicable transfer mechanisms and provider contractual terms, including Standard Contractual Clauses or equivalent terms where applicable. The applicable mechanism for each provider must be verified before publication. - Google's current Gemini API Additional Terms require Paid Services for API Clients made available to users in the EEA, Switzerland, or the United Kingdom and state that Paid Services prompts and responses are processed under Google's Data Processing Addendum.
Zapply is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will delete it promptly. If you believe a child under 16 has provided us with personal information, contact [email protected].
Zapply uses:
[data-ph-mask] in session recordings; other visible text and captured URLs require separate masking or exclusion controls.The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Specifically:
- We only request permissions that are necessary for Zapply's core autofill and job-tracking functionality
- We do not transfer user data except as necessary to provide Zapply's features, comply with law, protect security, or as part of a merger, acquisition, or sale of assets
- We do not use or transfer user data for personalized or interest-based advertising
- We do not allow humans to access user data except as necessary to provide the service, investigate abuse, or comply with legal obligations — and only with appropriate confidentiality protections
- Zapply's extension requires broad URL access (<all_urls>) because job applications exist on thousands of different employer websites. We access webpage content only when you actively use the autofill feature on a specific job application page
We may update this Privacy Policy from time to time. When we do:
We encourage you to review this page periodically.
If you have questions about this Privacy Policy or your personal data, contact us: