Privacy Policy — AppliHawk

1. Who We Are

AppliHawk ("we", "us", "our") is a job application tracking tool operated by Murali Kavassery as a sole-trader project currently in public beta. This service is not incorporated.

Data controller contact: [email protected]

2. Data We Collect

Account data: email address, name (optional), password (hashed — never stored in plain text)
Application data: job titles, company names, job descriptions, application status, notes, deadlines, salary ranges
Candidate profile data: skills, work experience, education, salary expectations, location preferences — parsed from resumes you upload. Raw resume files are discarded immediately after parsing; only structured data is retained.
AI-generated data: suitability scores and action suggestions generated by our AI provider from your profile and job data
Usage data: AI feature usage logs (feature name, token count, cost, timestamp) for quota enforcement and cost management
Security data: hashed authentication tokens, login timestamps, IP address (for rate limiting and fraud prevention)
Consent records: timestamps and versions of consent you have given

We do not collect payment card data. We do not currently run display advertising or advertising trackers. We do not sell your data.

We track clicks on affiliate links internally (timestamp and link identifier only) to attribute commissions. This data is not shared with any ad network or third party.

3. How We Use Your Data

To provide and improve the AppliHawk service
To authenticate your identity and secure your account
To send transactional emails (account verification, password reset, application reminders) — only with your consent
To power AI features: your job description text and profile data is sent to Google Gemini API to generate suitability scores and action suggestions
To enforce AI usage quotas and prevent abuse
To display contextually relevant affiliate links inside the authenticated app (resume services, interview prep) — links are clearly labelled
To comply with legal obligations

⚠️ AI Disclaimer: AI-generated suitability scores, action suggestions, and parsed job data are informational only and are not professional career, legal, or employment advice. Scores are estimates based on text similarity — they do not account for all factors relevant to hiring decisions and must not be relied upon as such.

4. Legal Basis for Processing (GDPR)

Contract: account data and application data — necessary to provide the service
Consent: AI features, marketing emails, analytics — you can withdraw consent at any time in Settings
Legitimate interests: security logging, fraud prevention, service improvement, affiliate commission attribution (click tracking on affiliate links — link identifier and timestamp only), and anonymous aggregate page-visit statistics on public pages (daily counters by page, country, referrer domain, and browser family — no IP addresses, cookies, or visitor identifiers are stored)

5. Data Processors (Sub-processors)

We share your data with the following third-party processors to operate the service. Each processor has its own privacy policy governing their handling of data.

Processor	Purpose	Data shared	Location
Railway	Application hosting, database, background task queue	All user data stored in the database	USA
Cloudflare	CDN, DNS, DDoS protection for frontend	Request metadata (IP, URL, headers)	Global
Resend	Transactional email delivery	Email address, email content	USA
Google Gemini API	AI-powered resume parsing, suitability scoring, action suggestions	Job descriptions, candidate profile data (skills, experience, education, salary expectations)	USA / Global
RapidAPI / JSearch	Job search results	Search query terms you enter	USA
Affiliate networks (none currently engaged)	Commission attribution — will be listed here when engaged	Aggregate click data (no personal identifiers)	TBD

How AppliHawk uses AI: the app uses Google Gemini for optional, on-demand features only — resume parsing (into a structured profile), suitability scoring against a job description, and follow-up action suggestions. AI runs solely when you trigger it; nothing is sent to the AI provider without your explicit action. Your uploaded resume file is discarded immediately after parsing (see Data Retention) — only the structured profile you review and save is kept. Per-user daily limits and a global budget cap govern AI usage.

AI outputs are not professional advice. Suitability scores, action suggestions, and other AI outputs are generated by a language model and may be inaccurate. Use them as a starting point, not a definitive assessment, and always apply your own judgement.

6. Data Retention

Account and application data: retained while your account is active. If you delete your account, data is soft-deleted for 30 days (recovery period) then permanently erased.
AI usage logs: retained for 1 year for quota management and cost auditing, then deleted.
Audit logs: retained for 1 year, then deleted.
Error logs: retained for 90 days, then deleted.
Resume file: not retained — discarded immediately after parsing into structured profile data.
Affiliate click data: retained as long as the affiliate link record is active, then deleted with it. Only aggregate click counts and timestamps are stored — no personal identifiers.

7. Cookies

AppliHawk currently uses only essential cookies required for authentication (session tokens). We do not currently use analytics cookies or advertising cookies.

If we introduce analytics or display advertising in future, we will update this policy and ask for your explicit consent before any non-essential cookies are set, as required under UK GDPR and PECR.

8. Affiliate Links & Advertising

Affiliate links (current): The authenticated app may display affiliate links to relevant third-party services (e.g. resume writing, interview prep). These are clearly labelled as affiliate links. If you click one and make a purchase, we may receive a commission at no extra cost to you. We may earn different commission rates from different affiliate partners; we aim to recommend based on relevance to job seekers, but we cannot guarantee commission rates do not influence placement. We track clicks internally (link identifier and timestamp only) for commission attribution — no data is sent to ad networks.

Display advertising (not currently used): AppliHawk does not currently serve display advertisements. If we introduce display advertising in the future, we will: (1) update this policy before doing so, (2) notify you by email where we hold a verified address and display an in-app notice in any case, and (3) request your consent as required under UK GDPR and PECR before placing any advertising cookies or tracking pixels.

We are not responsible for third-party services accessed via affiliate links, their pricing, quality, or privacy practices.

9. Your Rights (GDPR)

If you are in the EEA/UK, you have the right to:

Access: request a copy of your personal data (Settings → Export My Data)
Rectification: correct inaccurate data (Settings)
Erasure: delete your account and all data (Settings → Delete Account)
Portability: download your data in JSON format (Settings → Export My Data)
Objection: object to processing based on legitimate interests
Withdraw consent: at any time, per consent type, in Settings
Lodge a complaint: with your national supervisory authority (e.g. ICO in the UK, CNIL in France)

To exercise any right not available in the app, email [email protected]. We will respond within 30 days.

10. International Transfers

Your data is processed in the USA by Railway, Resend, and Google. These transfers are covered by Standard Contractual Clauses or equivalent safeguards as part of each processor's terms.

11. Changes to This Policy

We will notify you by email and/or in-app banner of material changes to this policy. Continued use after the effective date of changes constitutes acceptance. If you do not accept the updated policy, please delete your account before the effective date.

12. Contact

For privacy questions or data requests: [email protected]