Privacy

A deliberately narrow data boundary

The commercial architecture does not automatically collect proposal content, application answers, client messages, or AI credentials. Text you deliberately send through support or voluntary feedback is stored for us to read. Choosing an ailavo.com mailbox also stores the mail and preferences described below.

Your ailavo.com mailbox

Mail workspace access requires a valid Apply with AI entitlement. Export and deletion remain available when access ends. Existing receiving, forwarding and automatic retention continue under their own settings.

When you explicitly choose an address and accept mailbox consent version 2026-10-10, we store your permanent address, message headers, senders and recipients, message bodies, attachments, folders, labels and mailbox preferences. Supabase stores this data privately and Resend receives and sends mail. Connected installations can read your own mail and extracted verification codes and links, mark messages read, archive them, and record sites using the address. Installation credentials cannot send or delete mail, choose an address, or read raw MIME.

Rules assess mail importance and recruiting outcomes first. When enabled, unresolved checks send the subject and up to the first 1,500 body characters through Experiential Labs to the administrator-selected Luna Decisions or Jev decision model. If email meaning or outcome is still unresolved, conflicting, or needs evidence beyond that preview, an enabled full-email review runs automatically. It sends the complete stored subject and plain-text body, full text extracted from HTML, meaningful link addresses, and relevant sender/header facts through Experiential Labs to the selected general language-model provider. The default review model is gpt-6-luna. Attachments, remote images and linked pages are not opened. Full review has no application preview limit; a provider context limit or expired body is reported as an operational failure rather than silently shortening the email.

We store importance, recruiting outcome, freely named email types and labels, selected model, classification stage, reported usage and your corrections with the message. You can correct an outcome or edit/remove a label; those choices take priority over automatic classification. Known temporary errors can retry a bounded number of times; an unknown dispatched result is not automatically charged again. These model checks may use paid provider credits and have no application spending ceiling. Administrators choose the decision and review models independently from the available provider catalog.

Retained older false Offer, unclear or conflicting classifications may receive a versioned repair. This updates automatic labels, importance and Stats without automatically forwarding that older email again. Message-linked jobs, label suppression, metadata and correction receipts expire with the message. The admin panel retains only a bounded recent history of content-free canonical categories, model stages and usage summaries, without account/message identifiers or email content. The forwarding destination defaults to your sign-in email and starts forwarding important new mail without a confirmation email. Saving any valid external address activates it immediately; check the address before saving. You can choose important, all or no forwarding. Untrusted attachment contents remain quarantined until a supported security scan approves them; executable files cannot be downloaded.

The starting quota is 1 GB per mailbox. Your mailbox always keeps only the last 30 days of email in every folder, including Inbox, Sent, Drafts, Archive, Spam and Trash. Older messages and their attachments, raw MIME, search indexes and scan records are automatically deleted. The 30-day period starts when incoming mail is received, sent mail is sent, or an unsent draft is created. Moving, starring or labeling a message does not extend retention. Expired messages become inaccessible immediately; scheduled cleanup removes their stored content. Export anything you want to keep before it expires. Content-free draft and upload creation identifiers remain until account closure to prevent delayed retries restoring discarded mail or files. Minimal delivery identifiers without message content may remain to prevent webhook retries from restoring deleted email. Separate safety receipts retain only delivery identifiers, a hashed destination, destination version and acceptance or hard-bounce timestamps for up to seven days, even if you delete the source message, so delayed bounces and complaints can still stop unsafe sending. They are removed on account closure. Anonymous counts of delivery attempts, with no account link, remain for up to 48 hours to enforce service-wide sending limits. Mailbox settings provide export and deletion controls as those capabilities become available. You can also request export or deletion through support. Account closure removes mail, attachments, preferences and pending jobs; ordinary object cleanup may take up to ten minutes to finish safely. Recently granted attachment uploads may take up to two hours and fifteen minutes to clean up physically, so an upload still authorized or already in flight cannot recreate a deleted file. Access is removed immediately. We retain only an address hash with no account link to prevent a deleted address from being reassigned. Operational logs record identifiers and statuses, never message bodies or credentials. Consent is recorded with its version and acceptance time.

What stays on your device

Apply with AI stores its provider credentials, writing profile, settings, job filters, LinkedIn answers, application history, and external-site resume and login settings locally in the extension. The licensing service does not automatically receive your AI access tokens, API keys, job descriptions, proposals, client messages, profile content, prompts, or generated drafts. Text you deliberately type and send through support or the voluntary feedback form is an exception.

Job content and form questions are sent to the AI provider you choose when needed to generate an answer. In a LinkedIn run, application answers, resumes, and required account details are entered into LinkedIn or the external employer website as part of the application. Auto-submit can be turned off so the agent waits for your final review.

Anyone with access to your local Chrome profile or computer may be able to access locally stored extension data. Disconnect providers and remove extension data before giving another person access to that profile.

What the account service stores

  • Your sign-in email and optional display name.
  • Billing-customer and subscription identifiers, plan, status, and relevant renewal or end dates.
  • Your entitlement state and a limit of two active installations.
  • Random installation identifiers, customer labels, extension versions, and last-seen timestamps.
  • Voluntary feedback text that you type and choose to send.
  • Release metadata, webhook replay records, and allowlisted audit events needed to protect downloads and investigate account changes.

Extension product reporting

Product reporting is on by default from installation and can be turned off in the extension's Account settings. Starting with extension version 0.14.0, the extension sends that choice when it starts and whenever the switch changes. The service records the choice for each installation. Existing content-free usage events from an older installation that has not sent a choice remain accepted unless reporting was explicitly turned off; failure reports and friction events are accepted only after that installation has explicitly turned reporting on.

Usage events report the event time, an allowlisted action and application outcome, whether the action was direct or part of an agent run, Upwork or LinkedIn, the extension version, an approximate country supplied by our hosting provider, and a one-way identifier derived from the platform's job identifier. Events are associated with your Apply with AI account so one person is counted once across installations and the same confirmed application is not counted twice. Version 0.12.3 reports supported job-assistance actions and application outcomes. Versions 0.12.4 and later also report each connection request, message, event invitation, and withdrawn invitation sent by LinkedIn campaigns, plus LinkedIn replies prepared by the extension. The service also accepts optional application channel, public employer name and public job title, with the name and title limited to 80 characters each. Older extension versions can omit these fields. Usage events never include job descriptions, URLs, your proposals or replies, form answers, profiles, resumes, AI prompts, API keys, provider tokens, passwords, or raw IP addresses. License checks remain separate and never count as product usage.

Version 0.14.0 can send a bounded diagnostic when an external application cannot be finished, an assisted rescue is needed, or LinkedIn or Upwork repairs itself. A report may include the failure time, surface, registrable site domain, failure kind, an allowlisted reason code, provider kind, model rounds, extension version, short state and action history, and a path-only URL. Its page outline is limited to element kinds and labels, plus text from buttons and links. Every diagnostic text field is limited to 80 characters. The contract has no field for screenshots, page titles, headings, general page text, typed values, names, emails, phone numbers, job descriptions, prompts, proposals, replies, form answers, profiles, resumes, credentials, URL queries, or URL fragments.

Before sending a failure report, version 0.14.0 removes the account holder's own identifiers known to the extension. The service rejects the entire report batch if an accepted diagnostic field is too long or matches an email-address or phone-number pattern. These controls reduce personal-data exposure but cannot guarantee that every short page label, button caption, state, or diagnostic detail is anonymous or contains no personal information.

With explicit reporting consent, the extension can also send fixed-code friction events that show where product controls are used, retried, or abandoned. Each event contains only a time, a closed-list surface and code, a fixed target identifier, an optional fixed variant identifier, an aggregated count, and the extension version. Target and variant values come from a registry in the extension source and are never derived from page text or user text. This stream has no free-text field, and repeated events are combined by the extension before upload. The service makes only grouped friction results available through its restricted owner-triage interface.

Voluntary feedback is separate from product reporting. When you type into the extension's feedback box and press Send, the extension sends the text you entered, the time, surface, extension version, and a random retry identifier. The reporting switch does not control this person-initiated message. Feedback is limited to 1,000 characters and stored as submitted, so it may include an email address, phone number, or other personal information you choose to write. It is available only through the restricted owner interface and is never returned to an installation.

Usage, failure, friction, and feedback tables store the same one-way hash of the random installation identifier rather than the raw identifier used for authentication. Detailed usage events, failure reports, and friction events are deleted after 90 days. Voluntary feedback is retained until you turn reporting off, use the account deletion flow, or ask us to delete it; the timed 90-day cleanup does not remove it. Turning reporting off stops new usage, failure, and friction reporting, deletes unsent reports and friction events from that browser, turns reporting off for every installation on the account, and deletes the account's stored detailed usage, failure, and friction history together with previously submitted feedback. You can still choose to send new voluntary feedback afterward. To enforce the daily submission limit, content-free quota receipts retain only an installation hash, account association, and acceptance time. They contain no message text or feedback identifier, survive reporting-history deletion, stop counting after 24 hours, and are removed by the following daily cleanup (normally within 48 hours). Deleting the account also removes these receipts. Subscription, entitlement, security, and connected-installation records required to operate the service remain subject to their own retention rules.

Your Stats history

Stats uses available reporting and mailbox history. Content-free daily totals and a minimal application record can remain after detailed sources expire, so an application is not counted twice and a later recruiting response can be associated with it. The minimal record contains a protected application identifier, platform, channel, milestone dates and outcome. Public employer names and job titles become unusable after 90 days and are removed by scheduled cleanup; email bodies, headers and message-linked corrections still expire with the 30-day mailbox window. A retained application milestone does not contain the email subject, sender, body or message identifier.

Turning reporting off or purging usage removes usage-derived Stats, application records and their mailbox associations across your account. Independent mail totals and categories remain available. A content-free account cutoff records when usage was erased so older timestamped retries cannot restore that history after reporting is enabled again. If an accepted event was dated slightly ahead of the server clock, the cutoff includes that timestamp (at most five minutes ahead); new events at or before that cutoff are ignored. Deleting your mailbox removes its mail-derived totals and milestones; deleting your account removes all account Stats and their contribution to aggregate totals. Your timezone preference and its effective dates support consistent local calendar labels; a change takes effect prospectively rather than rewriting older dates.

Customer Stats shows only the signed-in account. Admin Stats uses aggregate metrics and can include the registration email already used for account administration; it does not expose customer email subjects, senders, bodies, conversations or attachments.

Authentication, payment, and infrastructure providers

If you choose Google sign-in, Google authenticates you and provides your email address and basic profile information to Supabase so it can create or connect your account session. Apply with AI requests only the standard OpenID, email, and profile permissions for sign-in. It does not receive your Google password or request access to Gmail, Google Drive, contacts, or calendars.

Stripe processes checkout, subscription payments, invoices, payment-method changes, and the customer portal. Stripe may receive the billing and payment information you provide on its hosted pages under its own terms. Apply with AI retains Stripe customer, subscription, Price, Event, status, and relevant billing-date identifiers; it does not copy card or bank details into Supabase.

Supabase provides authentication, PostgreSQL, and private file storage; Vercel hosts the Next.js application; and GitHub is the private upstream release source. Apply with AI does not use Stripe Tax unless a checkout explicitly displays a tax calculation.

Security and retention

Secrets are server-only. Release files are private and shared through short-lived links. Raw installation activation secrets are returned once and only a cryptographic hash is stored. Operational logs must not contain application content, failure-report text, friction payloads, voluntary feedback text, Upwork content, or provider credentials.

Account, billing, entitlement, security, and audit records are retained only for as long as needed to provide the service, protect accounts, resolve disputes, and meet accounting or legal obligations. Data that is no longer required is deleted or de-identified.

Support conversations and notifications

When you contact us through your account, we store the request category, subject, messages, timestamps, and conversation status with your account. You can view your own conversations; authorized administrators can review and reply to them alongside your account, subscription, license, and device details.

When you email support@applywithai.app, Resend receives and processes the sender address and name, recipients, subject, message content, delivery headers, and attachment metadata. A new direct email creates an email-only support ticket, while a reply to the private address included in one of our messages continues that existing conversation. Email alone is not treated as proof of a signed-in account identity. Attachment contents stay with the email provider and are not downloaded into the support database.

For troubleshooting and abuse prevention, support submissions made through the website may also record the request IP address observed by our hosting provider, browser user-agent information, and the page path without its query string. This diagnostic context is restricted to administrators, expires after 30 days, and is removed during scheduled or subsequent support cleanup. An IP address may identify a proxy or shared network rather than an individual; provider webhook addresses are not recorded as customer addresses.

Administrator replies create account notifications for signed-in customers and send the reply content through Resend when email delivery is enabled. We do not include request IP addresses, private diagnostics, account entitlements, or device details in those emails. Conversations and delivery records are retained while needed to provide support and resolve account issues; you can request deletion through the contact below.

New subscriber administrator alerts

When an account is first created, we may record the signup IP address and approximate country supplied by our hosting provider. After the first successful subscription invoice, including one covered by a discount, we send a private operational email through Resend to the service administrator. It includes your account email, available name, signup time, signup IP and estimated country when recorded, selected plan, payment and discount amounts, promotion details, and billing reference IDs. It never includes payment-card details or AI credentials. IP location may reflect a VPN or shared network and is not proof of residence.

Raw signup network context and rendered alert copies in our database expire after 30 days and are removed by scheduled cleanup. Delivery status and deduplication records remain with the account. Delivered copies follow the administrator mailbox's retention; the database cleanup does not delete delivered email.

Privacy requests

For privacy questions or to request access, correction, export, or deletion of your account data, email support@applywithai.app. Please do not include AI credentials, client messages, or payment-card details.

Optional website analytics

With your permission, we use Google Analytics to understand website visits, completed signups, checkout starts, and subscription purchases. Analytics cookies identify a browser and session. We send page paths, selected plans, and purchase totals. A limited set of validated campaign labels and Google ad-click identifiers from page URLs helps attribute visits and subscriptions to traffic sources. Other URL query fields and fragments are excluded, and referring URLs are reduced to the website origin. Choosing Accept cookies enables both website analytics and Google Ads measurement. Google Ads measurement uses browser and ad-click identifiers and subscription purchase values to connect subscriptions to ads and improve our advertising. We do not send your name, email address, payment-card details, AI credentials, or application content to Google Analytics or Google Ads. Advertising personalization and Google signals remain disabled. Private mail, control, and stats pages are excluded from website analytics; visiting them does not change your saved choices or remove previously permitted cookies.

You can choose Decline cookies and continue using the service, or change your choice below. Declining cookies stops both types of measurement and removes their cookies. Withdrawing permission does not erase information already processed by Google. Essential authentication, security, and payment processing continue independently.

Independent product

Apply with AI is not affiliated with, endorsed by, or sponsored by Upwork, LinkedIn, OpenAI, or Anthropic. Product names are used only to describe compatibility.