Last updated: October 8, 2026
ApplyArc is operated by ApplyArc Ltd, a company registered in England and Wales (Company Number: 16619519), registered with the Information Commissioner's Office (ICO Reference: ZC027406). Our only website is applyarc.com; this policy does not apply to applyarc.io, an unrelated service with no connection to ApplyArc Ltd. We ("we", "our", "us") are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use our job tracking application on applyarc.com or in the ApplyArc app for iPhone. We comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Email and name from your sign-in, and a profile picture if you upload one
Jobs saved, notes, application status, reminders
Resume/CV content you upload, stored securely to power the AI tools (matching, cover letters, resume analysis). Delete it anytime from Resume Profile, or with your account in Settings.
Pages visited, features used, and session duration when you accept optional analytics
Our servers record actions you take, such as signing in, running an AI tool (with the company and job title it was for), or changing your plan or payment, with your internal account ID. We use them to run, secure, and improve ApplyArc. They are collected whether or not you accept optional analytics and never used for advertising. The copy in Application Insights is kept for 90 days. A history of your sign-ins, AI tool runs, and plan and payment changes is also kept with your account for security, fraud prevention, and payment disputes, and deleted when you delete your account.
For each sign-in: the IP address, approximate city and country, and which ApplyArc app you used. When you sign up: the IP address, browser, language, and referring page. While you use your account, periodically (usually once a day): the IP address and browser type. Kept with your account for security and fraud prevention, and deleted when you delete your account.
For emails we send to your account while it is active, we keep your email address, each email's subject and a short excerpt, its delivery status (delivered, bounced, blocked, or failed), whether you reported it as spam, and whether it was opened or clicked, with the link clicked and the browser used. We use this to measure and improve our emails and to see what you received when you contact support. Kept for 180 days.
Browser type, IP address, device type
Processed by Stripe (we don't store card details)
Notes you send through the in-product 'Something wrong? Tell us' form, plus whether you asked for a reply and where you sent it from: the surface, page, and tool you were using. Kept with your account regardless of your analytics choice, included in your data export, deleted when you delete your account.
Optional analytics stay unloaded until you accept them. First-party storage needed for sign-in, security, saved work, caching, and preferences remains on because it supports features you request.
If you accept analytics, Google Analytics measures page views, sessions, and product events using first-party cookies and pseudonymous browser identifiers. For signed-in users, we may send an internal account ID and plan attributes to understand feature use across sessions. We disable advertising storage, Google signals, and ad personalisation. The Google tag is not loaded before consent.
We use Microsoft Clarity to see how you use and interact with ApplyArc through behavioral metrics, heatmaps, and session replay, so we can improve our product. Clarity stays unloaded until you accept analytics. After consent it may use pseudonymous browser identifiers and, for signed-in users, an internal account ID plus account name or email to link a replay for support, security, and product analysis. We send advertising storage as denied. We do not sell this data or use it to serve ads. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.
We use Sentry to monitor application errors and improve reliability. Sentry collects technical data about errors including stack traces, browser information, routes, and user actions leading to the error. For signed-in users, we attach the internal account ID, not the account name or email, so related faults can be investigated. We scrub sensitive URL parameters and do not intentionally send CV, job, or AI output content in error events. Our servers also report their own errors to Sentry. These reports do not attach your account, but log lines recorded just before an error can include your internal account ID. For more information, see Sentry's Privacy Policy.
If you accept analytics, Application Insights records page views, feature interactions, clicks, API performance, and error diagnostics. It uses pseudonymous request and session identifiers and may receive an internal account ID for signed-in users. Its SDK cookie storage is disabled. Separately, our servers send Application Insights the service records and error diagnostics described above, linked to your internal account ID, whether or not you accept optional analytics. These are kept for 90 days. For more information, see the Microsoft Privacy Statement.
Your account data is stored securely in Microsoft Azure data centers in North Europe, with a replica in UK South. We implement industry-standard security measures:
Request a copy of your data (Settings → Export Data)
Delete your account and data (Settings → Delete Account)
Export your data in a machine-readable format
Change optional analytics choices from the Cookie Policy
California Residents (CCPA): You have the right to know what personal information is collected and to request deletion. We do not sell or share your personal information with third parties for monetary consideration. To exercise your rights, contact privacy@applyarc.com.
UK & EU residents: You also have the right to lodge a complaint with a data protection supervisory authority. In the UK that is the Information Commissioner's Office (ICO) at ico.org.uk. We would genuinely rather put it right ourselves first, so please email privacy@applyarc.com and give us the chance.
Your account data is stored in the EU (Azure North Europe), with a replica in the UK (Azure UK South). Emails are sent through Azure Communication Services, which stores its data in the United States. AI requests go to an Azure OpenAI resource in Sweden Central. If it is unavailable, text generation fails over to a resource in East US 2; search embeddings use Sweden Central only. Their models run as Global Standard deployments, so Microsoft may process a request in any region where it runs the model. When our service providers transfer your data outside the UK or EU for us, their data processing terms use the European Commission's Standard Contractual Clauses, with the UK Information Commissioner's International Data Transfer Addendum for data from the UK. Microsoft Clarity is the exception: Microsoft acts as an independent controller of Clarity data, under the Microsoft Privacy Statement.
The ApplyArc app in ChatGPT runs anonymously on Azure Container Apps. There is no account or login, and the app does not connect a tool request to an ApplyArc profile.
The app receives the job posting, resume or CV text you choose to send, an optional tone or hiring manager name, and, for the resume score tool, one attached PDF or DOCX resume if you provide one. It uses that content only to run the tool you requested.
When you attach a PDF (up to 10 pages) or DOCX (up to 4 MB) resume, ChatGPT stores the file and the app downloads it from OpenAI's file storage over HTTPS only for that tool call. Microsoft Azure AI Document Intelligence extracts the text and the app requests early deletion of the analysis data. Microsoft automatically deletes the submitted document and results within 24 hours at the latest. The app keeps neither the file nor the text once the tool call finishes. The restricted-data refusals below apply to file text the same as pasted text.
The result contains the requested guidance and the exact quotes, offsets and evidence IDs needed to link claims to the text you supplied, whether pasted or extracted from your attached resume. It does not return account, session, trace, request, timestamp, model or token data.
OpenAI sends the selected tool inputs and receives the result inside ChatGPT. Microsoft Azure Container Apps hosts the server, Microsoft Azure OpenAI processes the model request, and Microsoft Azure AI Document Intelligence extracts text from an attached resume file when you provide one.
The ApplyArc runtime does not persist tool inputs or results. Public production does not emit custom per-tool usage events. Azure keeps standard platform health, latency, failure and scaling metrics; they do not include submitted job or CV text or tool output. Previously collected aggregate operational records age out under the Log Analytics workspace's 30-day retention. Azure OpenAI requests set store: false to disable Responses API application-state storage for the request. ApplyArc does not add browser analytics, cookies or advertising telemetry to the card.
ChatGPT may keep the rendered result in its own widget state so reopening the conversation can redraw the card. That state lives inside ChatGPT under OpenAI's data controls. ApplyArc's servers never receive or retrieve it.
The Azure OpenAI resource is in Sweden Central, but the deployments are Global Standard, and Microsoft routes Global inference to datacentres outside the home region for speed and availability. Prompts may therefore be processed in any geography where Microsoft deploys the model. Only the location of processing changes; Microsoft's data protection and compliance commitments still apply.
store: false does not disable Microsoft's separate abuse monitoring. Content that Microsoft's safety systems flag may be placed in a separate abuse-monitoring store and reviewed by a small number of authorised Microsoft employees. Because the resource sits in the European Economic Area, Microsoft states that any such review is carried out by employees located in the EEA.
Do not paste passwords, access keys, payment card details, government IDs or health records. The tools refuse detected credentials, payment cards, government IDs and text carrying a common patient record identifier such as an MRN or NHS number, before a model call. Detection is pattern-based and cannot catch every clinical note, so do not paste patient information. Describing your own healthcare career is fine; a patient's record is not.
You choose what text ChatGPT sends. You can stop using the app or delete the conversation in ChatGPT. ApplyArc cannot retrieve or delete a ChatGPT conversation because the app has no account link.
Support requests should name the tool and describe the problem without copying the job posting, CV, generated result or restricted data into email. See our support page.
For privacy inquiries or to exercise your rights: privacy@applyarc.com
We will respond to all legitimate requests within 30 days.