ApplyStorm
Sign in

ApplyStorm Privacy Policy

Last Updated: 2026-10-04

This Privacy Policy describes how ZTechEngineering LLC, operating ApplyStorm at applystorm.net ("we," "us," or "our"), collects, uses, and shares information when you use the ApplyStorm service (the "Service").

This Policy complies with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), where applicable.

1. Data Controller

For purposes of GDPR, the data controller is:

ApplyStorm
A service of ZTechEngineering LLC
1009 Avoca Ave
Ellicott City, MD 21043
United States
Email: support@applystorm.net

2. Information We Collect

2.1 Information You Provide

  • Account information: email address, password (hashed)
  • Profile information: resume content, work history, education, skills, preferences
  • Job search activity: target roles, applied jobs, application history
  • Payment information: processed by Stripe; we do not store full credit card numbers
  • Communications: support requests and feedback

2.1b Storm Permissions and Actions in Your Name

When you allow or turn off a Storm permission, we record which permission, the exact wording version you agreed to, when, and from which screen, together with limited evidence that it was you: your session, the first part of your IP address (not the full address) and your browser family (not the full browser string). When Storm acts under a permission — for example acknowledging an employer's privacy notice or submitting an application — we record what it did, on which application, and which permission or one-time confirmation covered it. We do not copy the answers themselves into these records. We use them to show you what you allowed and what Storm did, and to resolve disputes. You can see them in Settings › Automation › Storm permissions. We keep them for as long as your account exists, and may keep them longer only where the law requires it for legal claims.

2.1c Self-Identification Answers

If you choose to save voluntary self-identification answers (such as gender, race or ethnicity, veteran status or disability status) in Settings › Profile, we store them encrypted. We use them only to answer employers' voluntary self-identification questions, and only if you allow the "Share my self-identification answers" permission; without it, Storm doesn't send them. Storm uses your saved "I don't wish to answer" choice whenever one applies. We don't use them for targeting, scoring or any other purpose, and Storm doesn't guess them. You can change or remove them, or turn the permission off, at any time.

2.1a Interview Recordings and Transcripts

If — and only if — you choose to record an interview, we collect:

  • Audio of the call, which includes the voice of every other participant.
  • Video of the screen or window you choose to share, but only if you separately opt in to it. This is off by default and requires its own tick, because it can capture the other participant's camera, their surroundings, and anything else visible on the surface you share. Agreeing to be recorded is not the same as agreeing to be filmed, and we ask you to tell the other participants specifically.
  • A text transcript produced from the audio.
  • A record of your consent: when you granted it, that it was limited to a single session, and that you acknowledged your responsibility to inform the other participants.

This is off by default, and no setting turns it on by default. Permission is granted per recording session, expires automatically after four hours, and can be withdrawn at any time. Our servers refuse to accept a recording without an unexpired permission for that specific session.

Your responsibility for other participants. In many jurisdictions — including much of the United States, Canada, the European Union and the United Kingdom — recording a conversation requires the consent of every participant, not only the person operating the recorder. You are responsible for informing everyone on the call and obtaining their agreement before you record. We ask you to confirm this each time you start a session. We are not able to give you legal advice on the rules that apply to you.

2.2 Information Collected Automatically

  • Usage data: features used, actions taken, session duration
  • Device data: browser type, operating system, IP address (truncated for privacy)
  • Cookies and similar technologies: for authentication and essential site function

Site analytics. We count visits to our public pages using our own software, on our own servers. We do not set a cookie to do this and we do not store your IP address or your full browser user-agent string. Instead we combine them with a secret that changes every day and store only the resulting one-way hash, alongside the page path, the referring website's domain name (not its full address), a coarse device type (mobile, tablet or desktop), and a two-letter country code.

Because the secret changes daily, the hash recorded today cannot be linked to the one recorded for the same visitor yesterday. This is deliberate: it means we can count how many people visited on a given day, and we cannot build a profile of an individual over time or across devices. "Unique visitors" in our own reporting therefore means unique per day.

How you found us (signup attribution). When you visit our public pages while signed out, your browser keeps a short note, in its own local storage, about how you first arrived: the campaign details in the link you followed if it had any (source, medium and campaign), the domain name of the website that sent you (not its full address), the page you landed on, and the time. The first visit that came from a link with campaign details or from another website is kept, and later visits do not replace it. The note contains no identifier, and your browser does not send it to us on its own. If you create an account, the note is sent with your signup and stored in a first-party attribution record associated with your account, so that we can tell which pages and campaigns lead to people signing up. If you continue with Google or GitHub, we copy the note into a cookie named as_acq, which lasts at most 15 minutes, exists only to carry the note through that sign-in, and is used only if the sign-in creates a new account. The note in your browser expires after 30 days and is removed when you create an account with an email and password; you can also remove it at any time by clearing this site's data in your browser.

Google Analytics. We also use Google Analytics 4 on our public pages, which does set cookies and is subject to Google's own privacy policy. You can opt out using Google's browser add-on, an ad-blocker, or your browser's tracking protection; our first-party counting described above continues to work in a form that does not identify you, and no feature of the Service depends on either.

A/B testing (ended). Between 2 September and 18 September 2026 we showed one of two versions of our home page to different visitors to learn which explained the Service better. This used one cookie, named as_hero, holding a single word naming the version you were shown; it contained no identifier and was not used for advertising. That test has ended and we no longer set or read this cookie. If it was set in your browser during that period it expires on its own within 90 days, and you can delete it at any time from your browser's settings. For accounts created during the test we recorded which version was shown; we keep that record as part of the account, we do not add it to new accounts, and it is deleted with the account.

2.3 Information from Third Parties

  • Job platform integrations: with your authorization, we access publicly available job posting data from third-party platforms (LinkedIn, Indeed, Greenhouse, Lever, etc.)
  • Application tracking: when an ApplyStorm address is on your applications, employer replies sent to that address arrive in your ApplyStorm inbox, and we read them to match confirmations, to read one-time verification codes an employer's site sends while Storm submits an application, and to update your application status. In Settings → Integrations → Application tracking you can choose to use your own email address on new applications instead; replies to applications already sent with your ApplyStorm address still arrive in your ApplyStorm inbox. We do not read your personal email inbox.

3. How We Use Information

We use collected information to:

  • Provide and improve the Service
  • Process job applications on your behalf
  • Match you with relevant job opportunities using machine learning models
  • Tailor resumes and application materials to specific roles
  • Process payments and manage subscriptions
  • Send service-related communications (account confirmations, billing, security alerts)
  • Detect and prevent fraud, abuse, or violations of our Terms
  • Comply with legal obligations

Legal bases for processing under GDPR:

  • Contract performance: processing necessary to provide the Service you requested
  • Legitimate interests: improving the Service, preventing abuse
  • Consent: for optional features like interview recording
  • Legal obligation: compliance with tax, accounting, and regulatory requirements

4. How We Share Information

We do not sell your personal information. We share information only as follows:

4.1 Service Providers

  • Stripe: payment processing
  • Supabase: database and authentication infrastructure
  • Hosting providers: Contabo (VPS hosting)
  • Cloudflare: email routing and sending for your application address, and object storage for the files described above (résumés, generated documents, attachments and recordings). Files are stored in a private bucket that is not publicly reachable.
  • AI/LLM providers: Z.AI (and selected alternates) for resume and application analysis; we send only the minimum data needed for the specific operation
  • Speech-to-text: interview and practice audio is transcribed on our own servers by default, using self-hosted software, and is not sent to any third party in that configuration. A managed transcription provider may be used only where an ApplyStorm operator has explicitly enabled it for an account; this cannot be switched on from within your account settings. Where a managed provider is used, the provider handling a given transcript is named on that transcript's page in the Service.

4.2 Job Application Targets

When you submit job applications through the Service, your application content (resume, answers to application questions) is transmitted to the employer's applicant tracking system as part of the application process you initiated or directed Storm to submit. Employers are independent controllers of what they receive.

4.3 Legal Requirements

We may disclose information when required by law, court order, or to protect our rights, property, or safety, or that of others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership or material change to this Policy.

5. Data Retention

We retain your information for as long as your account is active.

You can delete your account yourself, at any time, from Settings → Account. Deletion is confirmed by typing your own email address, then scheduled: it runs 7 days later, and you can cancel it at any point during those 7 days. Once it runs it removes your stored files first and then every record we hold about you, and it cannot be undone.

After account deletion:

  • Account data: deleted within 30 days
  • Application history: retained for 90 days for audit and abuse prevention, then deleted
  • Billing records: retained for 7 years as required by tax law
  • Aggregated, anonymized data: may be retained indefinitely

Site analytics (described in Section 2.2) are kept for 24 months and then deleted automatically. Because those records contain only a daily one-way hash and do not include your IP address, they are not linked to your account and are not affected by account deletion — there is nothing in them to identify you by.

The record of how you found us (Section 2.2) is part of your account and is deleted with it.

Interview recordings are retained on their own schedule, independent of the above, because the audio contains other people's voices and we hold it no longer than we need to:

  • Practice recordings (Rehearsal): Practice recordings are deleted on the same 30-day schedule as interview recordings. The transcript and the feedback are kept; the audio is not, because once it has been transcribed it serves no further purpose.
  • Recordings (audio, and video where you enabled it): deleted 30 days after the recording, automatically. Video is stored in the same file as the audio and expires with it — there is no separate video retention.
  • Transcripts: deleted 365 days after the recording
  • Analysis derived from a transcript: retained while your account is active

You can delete any recording and its transcript yourself at any time, which removes both immediately rather than waiting for these schedules. Withdrawing permission for a session stops any further processing of it.

6. Your Rights

6.1 GDPR Rights (EU/UK Users)

You have the right to:

  • Access: request a copy of your personal data
  • Rectification: correct inaccurate data
  • Erasure: delete your account yourself from Settings → Account, or ask us to do it (subject to the retention requirements above)
  • Restriction: limit how we process your data
  • Portability: receive your data in a machine-readable format
  • Objection: object to processing based on legitimate interests
  • Withdraw consent: for processing based on consent
  • Lodge a complaint: with your local data protection authority

6.2 CCPA Rights (California Users)

You have the right to:

  • Know: what personal information we collect, use, and share
  • Delete: delete your account yourself from Settings → Account, or request deletion of your personal information
  • Opt-out: of any sale of personal information (we do not sell, so this is N/A)
  • Non-discrimination: we will not discriminate against you for exercising these rights

To exercise any of these rights, contact support@applystorm.net. We will respond within 30 days (GDPR) or 45 days (CCPA).

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), encryption at rest for sensitive data, access controls, and monitoring for unauthorized access. No system is completely secure; we cannot guarantee absolute security.

8. International Data Transfers

Our infrastructure is hosted primarily in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. By using the Service, you consent to such transfer. For EU/UK users, we rely on Standard Contractual Clauses for data transfers outside the EU/UK.

9. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect information from children. If we learn we have collected information from a child, we will delete it promptly.

10. Cookies

We use essential cookies for authentication and site function. Google Analytics sets its own cookies on our public pages. We do not use advertising cookies, and we do not sell or share cookie data with advertising networks. A home-page test cookie that we set between 2 and 18 September 2026 is no longer set or read (see "A/B testing (ended)" in Section 2.2). If you continue with Google or GitHub, we set one first-party cookie, as_acq, for at most 15 minutes to carry how you found us through that sign-in (see "How you found us" in Section 2.2).

Our own visit counting does not use cookies at all.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified by email or through the Service at least 30 days before they take effect.

12. Contact

For privacy questions or to exercise your rights:

ApplyStorm
A service of ZTechEngineering LLC
Privacy Officer
1009 Avoca Ave
Ellicott City, MD 21043
Email: support@applystorm.net

Privacy Policy — ApplyStorm