ApplyStorm

ApplyStorm Privacy Policy

Last Updated: 2026-08-25

This Privacy Policy describes how ZTechEngineering LLC, operating ApplyStorm at applystorm.net ("we," "us," or "our"), collects, uses, and shares information when you use the ApplyStorm service (the "Service").

This Policy complies with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), where applicable.

1. Data Controller

For purposes of GDPR, the data controller is:

ApplyStorm
A service of ZTechEngineering LLC
1009 Avoca Ave
Ellicott City, MD 21043
United States
Email: support@applystorm.net

2. Information We Collect

2.1 Information You Provide

  • Account information: email address, password (hashed)
  • Profile information: resume content, work history, education, skills, preferences
  • Job search activity: target roles, applied jobs, application history
  • Payment information: processed by Stripe; we do not store full credit card numbers
  • Communications: support requests and feedback

2.1a Interview Recordings and Transcripts

If — and only if — you choose to record an interview, we collect:

  • Audio of the call, which includes the voice of every other participant.
  • Video of the screen or window you choose to share, but only if you separately opt in to it. This is off by default and requires its own tick, because it can capture the other participant's camera, their surroundings, and anything else visible on the surface you share. Agreeing to be recorded is not the same as agreeing to be filmed, and we ask you to tell the other participants specifically.
  • A text transcript produced from the audio.
  • A record of your consent: when you granted it, that it was limited to a single session, and that you acknowledged your responsibility to inform the other participants.

This is never on by default and there is no setting that makes it so. Permission is granted per recording session, expires automatically after four hours, and can be withdrawn at any time. Our servers refuse to accept a recording without an unexpired permission for that specific session.

Your responsibility for other participants. In many jurisdictions — including much of the United States, Canada, the European Union and the United Kingdom — recording a conversation requires the consent of every participant, not only the person operating the recorder. You are responsible for informing everyone on the call and obtaining their agreement before you record. We ask you to confirm this each time you start a session. We are not able to give you legal advice on the rules that apply to you.

2.2 Information Collected Automatically

  • Usage data: features used, actions taken, session duration
  • Device data: browser type, operating system, IP address (truncated for privacy)
  • Cookies and similar technologies: for authentication and essential site function

2.3 Information from Third Parties

  • Job platform integrations: with your authorization, we access publicly available job posting data from third-party platforms (LinkedIn, Indeed, Greenhouse, Lever, etc.)
  • Email integration: with your authorization via Gmail OAuth, we read job-related emails to track application status. We do not access non-job emails.

3. How We Use Information

We use collected information to:

  • Provide and improve the Service
  • Process job applications on your behalf
  • Match you with relevant job opportunities using machine learning models
  • Tailor resumes and application materials to specific roles
  • Process payments and manage subscriptions
  • Send service-related communications (account confirmations, billing, security alerts)
  • Detect and prevent fraud, abuse, or violations of our Terms
  • Comply with legal obligations

Legal bases for processing under GDPR:

  • Contract performance: processing necessary to provide the Service you requested
  • Legitimate interests: improving the Service, preventing abuse
  • Consent: for optional features like email integration
  • Legal obligation: compliance with tax, accounting, and regulatory requirements

4. How We Share Information

We do not sell your personal information. We share information only as follows:

4.1 Service Providers

  • Stripe: payment processing
  • Supabase: database and authentication infrastructure
  • Hosting providers: Contabo (VPS hosting)
  • Cloudflare: email routing and sending for your application address, and object storage for the files described above (résumés, generated documents, attachments and recordings). Files are stored in a private bucket that is not publicly reachable.
  • AI/LLM providers: Z.AI (and selected alternates) for resume and application analysis; we send only the minimum data needed for the specific operation
  • Speech-to-text: interview and practice audio is transcribed on our own servers by default, using self-hosted software, and is not sent to any third party in that configuration. A managed transcription provider may be used only where an ApplyStorm operator has explicitly enabled it for an account; this cannot be switched on from within your account settings. Where a managed provider is used, the provider handling a given transcript is named on that transcript's page in the Service.

4.2 Job Application Targets

When you submit job applications through the Service, your application content (resume, answers to application questions) is transmitted to the employer's applicant tracking system as part of the application process you initiated.

4.3 Legal Requirements

We may disclose information when required by law, court order, or to protect our rights, property, or safety, or that of others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership or material change to this Policy.

5. Data Retention

We retain your information for as long as your account is active.

You can delete your account yourself, at any time, from Settings → Account. Deletion is confirmed by typing your own email address, then scheduled: it runs 7 days later, and you can cancel it at any point during those 7 days. Once it runs it removes your stored files first and then every record we hold about you, and it cannot be undone.

After account deletion:

  • Account data: deleted within 30 days
  • Application history: retained for 90 days for audit and abuse prevention, then deleted
  • Billing records: retained for 7 years as required by tax law
  • Aggregated, anonymized data: may be retained indefinitely

Interview recordings are retained on their own schedule, independent of the above, because the audio contains other people's voices and we hold it no longer than we need to:

  • Practice recordings (Rehearsal): Practice recordings are deleted on the same 30-day schedule as interview recordings. The transcript and the feedback are kept; the audio is not, because once it has been transcribed it serves no further purpose.
  • Recordings (audio, and video where you enabled it): deleted 30 days after the recording, automatically. Video is stored in the same file as the audio and expires with it — there is no separate video retention.
  • Transcripts: deleted 365 days after the recording
  • Analysis derived from a transcript: retained while your account is active

You can delete any recording and its transcript yourself at any time, which removes both immediately rather than waiting for these schedules. Withdrawing permission for a session stops any further processing of it.

6. Your Rights

6.1 GDPR Rights (EU/UK Users)

You have the right to:

  • Access: request a copy of your personal data
  • Rectification: correct inaccurate data
  • Erasure: delete your account yourself from Settings → Account, or ask us to do it (subject to the retention requirements above)
  • Restriction: limit how we process your data
  • Portability: receive your data in a machine-readable format
  • Objection: object to processing based on legitimate interests
  • Withdraw consent: for processing based on consent
  • Lodge a complaint: with your local data protection authority

6.2 CCPA Rights (California Users)

You have the right to:

  • Know: what personal information we collect, use, and share
  • Delete: delete your account yourself from Settings → Account, or request deletion of your personal information
  • Opt-out: of any sale of personal information (we do not sell, so this is N/A)
  • Non-discrimination: we will not discriminate against you for exercising these rights

To exercise any of these rights, contact support@applystorm.net. We will respond within 30 days (GDPR) or 45 days (CCPA).

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), encryption at rest for sensitive data, access controls, and monitoring for unauthorized access. No system is completely secure; we cannot guarantee absolute security.

8. International Data Transfers

Our infrastructure is hosted primarily in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. By using the Service, you consent to such transfer. For EU/UK users, we rely on Standard Contractual Clauses for data transfers outside the EU/UK.

9. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect information from children. If we learn we have collected information from a child, we will delete it promptly.

10. Cookies

We use essential cookies for authentication and site function. We do not use advertising or tracking cookies for third-party advertising purposes.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified by email or through the Service at least 30 days before they take effect.

12. Contact

For privacy questions or to exercise your rights:

ApplyStorm
A service of ZTechEngineering LLC
Privacy Officer
1009 Avoca Ave
Ellicott City, MD 21043
Email: support@applystorm.net

Privacy Policy — ApplyStorm