Privacy Policy

Appollan, operated from Kenya, is responsible for the personal information described in this policy (in data protection terms, we are the data controller). Our full registered business name and address will be stated here once registration is complete.

Our privacy contact, who is also the person in charge of protecting personal information for the purposes of Quebec law, can be reached at privacy@appollan.com.

Website visitors and leads: name, email, target role, country, employment status, your message, and campaign information such as which ad or page you came from.

Clients: contact details, resume and career history, education, skills, certifications, job preferences, work authorization and sponsorship information, application materials and answers, messages between you and your Appollan team, employer communications sent to and from your job-search mailbox, records of the applications we prepare and submit, and billing records (payment card details are held by our payment providers, not by us).

If you sign in with Google, we receive your name, email address and profile picture from Google. We don't receive your Google password or access your Gmail, contacts or files.

We also receive information from others in the course of the service: employers and job platforms (through your job-search mailbox), payment providers (whether a payment succeeded), and public job listings.

We do not ask for or store Social Security Numbers, Social Insurance Numbers, bank account details, or passwords to your personal accounts. We don't collect demographic information such as race, gender or disability, and we answer voluntary self-identification questions “decline to self-identify” unless you instruct otherwise.

We use your information:

• to provide the service: finding roles, tailoring materials, submitting applications, handling employer communications and showing you everything in your dashboard (because it is necessary for our agreement with you);
• to communicate with you about your account, applications and billing (necessary for our agreement);
• to process payments and keep tax and accounting records (necessary for our agreement and to meet legal obligations);
• to keep the service secure, prevent fraud and abuse, and keep audit records of staff access (our legitimate interest in protecting you and the service);
• to understand how our website is used and whether our advertising works, only if you consent;
• to send marketing emails, only if you opt in.

To check that resumes and cover letters match a job before we apply, we may send the document text and the job description to an AI service provider (OpenAI or Anthropic) after removing your name and contact details; under their API terms, these providers do not use this data to train their models.

If you choose to have your CV read when you set up your account, we send its text to the same providers, with your name, email address and phone number removed, to suggest your career profile — you check and correct every field, and nothing is saved until you save it. On the AI plan, we use the same providers to reword descriptions you have written, and reject any wording that adds something you didn't tell us.

We also score open jobs against your preferences automatically, so your specialist can see which roles fit you best. Your specialist, or you in approval mode, decides where to apply. A person always reviews the result, and no application decision is made by AI alone.

If you use the assistant on our website, your questions are processed by the same providers to generate answers; don't include sensitive personal details.

Our systems are hosted with cloud providers in the United States. Appollan's application specialists work from Kenya and access client information remotely, only as needed to perform the service, under confidentiality obligations and access controls. Job-search mailboxes are Gmail accounts, so their contents are also held by Google. Some of the service providers listed below process information in other countries.

By using the service, you understand that your information will be processed outside your province, state, or country of residence, where privacy laws may differ. We protect it wherever it is processed with contracts and the security measures described in this policy.

We share your application information with employers and job platforms you have authorized us to apply to. We do not sell your personal information.

We use service providers for hosting and storage, sign-in, job-search mailboxes, email delivery, payments, security, the automated tools described above, and, only with your consent, analytics and advertising measurement. They act under contracts that restrict their use of your data. The Service Providers page lists each one, what it receives and where it processes it.

If you accept advertising cookies and then subscribe, we tell Meta that a purchase happened and what it was worth, with your email address converted into an unreadable code (a SHA-256 hash) first. We never share your resume, your applications or any detail of your job search with an advertiser. If you don't accept advertising cookies, nothing is shared for advertising.

We may also disclose information if the law requires it, to protect someone's safety, or to a buyer of our business, who would have to protect it as this policy describes.

We use encrypted connections, private document storage, role-based access limited to people working on your search, multi-factor authentication for staff, encryption of stored credentials, and audit logging of staff access. Our team signs confidentiality agreements and uses company-managed accounts only. No system is perfectly secure, and we will notify you and the relevant authorities of a breach where required by law.

• Account information is kept while your account is open.
• Lead information is kept for up to 24 months unless you ask us to delete it.
• Website analytics events are kept for up to 400 days; how you first found Appollan is kept with your account.
• Website assistant conversations are deleted after 30 days.
• Messages between you and your Appollan team are kept while your service is active and deleted 90 days after it ends.
• Documents you delete from your dashboard are permanently removed within 30 days, unless they were used in an application we submitted for you; those stay with that application so you can always see what was sent.
• Original copies of emails received in your job-search mailbox are removed after 90 days; the readable message stays in your dashboard while your service is active. Mailbox forwarding continues for 12 months after your service ends so you don't lose employer communications, but messages older than 90 days are no longer kept.
• Client documents are deleted 90 days after your service ends.
• Screenshots confirming submitted applications are compressed when uploaded.
• A basic record of the applications we submitted, your acceptance of our terms and authorization, security audit records, and billing records are kept as long as required by tax, accounting and other laws, and to deal with any dispute.

Depending on where you live (including under Kenya's Data Protection Act, Canada's PIPEDA, Quebec's Law 25, California's CCPA/CPRA, and other applicable laws), you may have the right to:

• know what information we hold about you and get a copy of it;
• have inaccurate information corrected;
• have your information deleted;
• receive your information in a portable format;
• object to or restrict some uses of your information;
• withdraw your consent, including to analytics and advertising cookies, at any time;
• opt out of marketing.

If you live in a US state with its own privacy law, our US State Privacy Notice (Your Privacy Choices) gives the details that law requires.

Clients can download their data and request deletion from Settings in the dashboard. Anyone can also email privacy@appollan.com. We'll confirm your identity before acting on a request and respond within 30 days, or sooner where the law requires. We will not discriminate against you for exercising your rights.

If you're unhappy with how we've handled your information, please contact us first. You can also complain to a regulator, such as Kenya's Office of the Data Protection Commissioner, the Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information, or the privacy regulator where you live.

We send service emails, such as payment receipts, application updates, employer messages and security notices, because they're part of the service. You can choose which notifications you receive in your dashboard. Marketing emails are only sent if you opt in, and every one has an unsubscribe link.

Appollan is for adults. We don't knowingly collect information from anyone under 18, and we delete it if we learn we have.

We use essential cookies to run the site. Analytics and advertising measurement only run if you consent. See the Cookie Policy.

The Appollan browser extension is optional. It reads a web page only when you click it on that page, and only to find the job on it: the job title, company, location, description and the page's address. It does not read other pages, your browsing history, what you type into forms, or anything on pages where you don't use it.

What it reads is shown to you in the extension before anything is sent. When you choose Save, Send to Appollan or Prioritize, that job information is sent to Appollan and added to your account. For job boards with public APIs, and for company career sites, our servers may re-read the job from its source so the details are accurate. We never fetch pages from LinkedIn, Indeed or Glassdoor ourselves.

When you connect the extension, we create a connection key for that browser. It is stored only in the extension on that device, expires after 90 days, and can be disconnected at any time from your dashboard. By default it can only add jobs to your account. We store a one-way fingerprint of the key, never the key itself, together with when the browser was connected and last used.

Filling in application forms is off unless you turn it on for a browser. If you do, and you choose Fill this application on a supported application form, the extension receives your name, email, phone, city, state or province, postal code, country, LinkedIn and website links, and, on the AI plan, the cover letter we prepared for that job. It puts them only into empty fields on that page, never submits the form, and never answers questions about demographics, work authorization, sponsorship or salary. The phone, city and postal code it uses are ones you enter for this purpose, and each time these details are sent to the extension it is recorded in your account's security log. You can turn this off for any browser at any time.

The extension contains no advertising or analytics, and the information it handles is used only to provide the service. It is never sold, and never used for advertising or to decide anyone's creditworthiness.

We'll update this policy when our practices change. Each version is numbered and dated, and we'll email active clients about material changes before they take effect.

Privacy questions and requests: privacy@appollan.com.