Privacy Policy

1. Data we collect

We collect only what is necessary to operate the service: name, email, professional data (resume, LinkedIn, job preferences), credentials of portals you choose to connect (encrypted with AES-256-GCM), session cookies from portals connected via the browser extension (encrypted in a dedicated vault), and application logs (role, date, status).

For affiliate program participants, we collect platform data (Instagram, TikTok, YouTube, LinkedIn), profile name, and follower count for eligibility validation and commission calculation.

We do not collect browsing history outside the product, full banking data (payments are processed by Stripe - we store only the last 4 card digits and a payment token), or sensitive information (health, religious beliefs, political opinion, racial origin).

2. How we use your data

Professional data feeds the AI that generates tailored resumes and identifies compatible roles. Portal credentials and extension cookies are used exclusively for application automation, never for human access.

Application logs feed the dashboard and are used to improve our machine learning models (always in aggregated and anonymized form, with no identifiable personal data in training).

Usage and performance data is used for bug diagnosis, SLA monitoring, and platform improvements.

3. Sharing

We do not sell personal data. We share only with essential service providers (cloud providers on AWS/GCP, AI inference providers via OpenRouter/Google Vertex AI, payment processor Stripe) under confidentiality agreements and Data Processing Agreements (DPAs).

Each application submitted to a job portal (LinkedIn, Indeed, Gupy, etc.) includes your resume data - you explicitly authorize this sharing by connecting each portal or installing the extension.

Aggregated and anonymized data may be shared in market trend reports, without any individual identification.

4. Data subject rights (LGPD art. 18)

You have the right to: confirm the existence of processing, access your data, correct incomplete or incorrect data, anonymize/block/erase unnecessary data, portability, deletion upon consent, information on sharing, and consent withdrawal.

To exercise any right, talk to one of our agents or use the "My account -> LGPD" page in the dashboard. We respond within 5 business days.

5. Cookies and tracking

The institutional site (applier.me) does not use third-party tracking cookies. The authenticated panel (app.applier.me) uses essential first-party cookies for session and language preferences (NEXT_LOCALE, 1 year). We do not use Google Analytics, Facebook Pixel, or other third-party trackers.

The Applier browser extension locally stores portal session tokens (LinkedIn, Gupy, Catho) to enable application automation. These cookies are encrypted in transit (TLS 1.3) and at rest (AES-256-GCM in a dedicated vault with periodic key rotation). No extension cookies are used for tracking or advertising.

You can revoke extension access to any portal individually via the "Connections" panel, which immediately removes all cookies for that portal from the vault.

6. Security

Portal credentials and extension cookies are encrypted with AES-256-GCM, with TLS 1.3 in transit, optional two-factor authentication (2FA) via authenticator app (TOTP), and immutable audit logs. Portal credentials and extension cookies are stored in a dedicated vault (AES-256-GCM key rotated every 90 days).

We perform daily backups with 30-day retention, quarterly penetration testing, and 24/7 anomaly monitoring. Our availability SLA is 99.5% (Pro) and 99.9% (Ultimate).

7. Data retention and deletion

Account and profile data is retained while the account is active. Upon deletion request: personal data (name, email, resumes) is removed within 30 days. Application logs are anonymized in 30 days and retained for up to 5 years for aggregated statistical purposes. Extension cookies are removed immediately upon portal disconnection.

Billing data is retained for 5 years as required by Brazilian tax law. After this period, it is permanently anonymized.

After 24 months of account inactivity, we will notify you with 30 days notice before automatic deletion.

8. International data transfers

Your data is primarily processed in data centers in Brazil. Some sub-processors (AI providers, cloud) operate in the US and Europe. We ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the ANPD, in compliance with LGPD art. 33.

9. Affiliate program

Affiliate program participants consent to the collection of: name, email, active platforms, profile name, follower count, and profile URL. This data is used exclusively for eligibility validation, commission calculation (15% to 25% on referred paid subscriptions, depending on the affiliate tier), and program communications. You can request removal of your affiliate data at any time via the dashboard or by speaking to an agent.

10. DPO contact

Data Protection Officer: talk to one of our agents via the "My account -> LGPD" panel or email [email protected]. Response within 5 business days.

Primary legal basis: contract performance (LGPD art. 7, V) for service provision; consent (art. 7, I) for optional cookies and extension; legitimate interest (art. 7, IX) for fraud prevention and aggregated model improvement.