Privacy policy
Last updated 2026-11-04
1. Who is responsible
Burak Kelleroglu
Kronenstraße 63, 10117 Berlin, Germany
Email: info@optiapply.app
2. What we process and why
- Account: email address, name and profile picture from Google sign-in, password (stored hashed by Supabase). To run your account (Art. 6(1)(b) GDPR).
- Your content: resumes, profile photo, cover letters, saved jobs, notes, filters, interview briefs and reports. To provide the service you use (Art. 6(1)(b) GDPR).
- AI processing: when you use an AI feature, the relevant resume text and job description are sent to an AI provider (see section 3) to produce the result. Providers are used through their APIs; we do not ask them to train on your data.
- Usage and error data: pages visited, feature events, AI call statistics (model, tokens, cost) and error reports. To keep the service working and improve it (legitimate interest, Art. 6(1)(f) GDPR).
- Telegram: your chat ID, only if you connect Telegram for job alerts (consent, Art. 6(1)(a) GDPR; you can disconnect at any time in the settings).
- Newsletter: your email address and name, only if you tick the newsletter box at signup and confirm the link in your welcome email (consent, Art. 6(1)(a) GDPR). Every newsletter has an unsubscribe link; deleting your account also removes you from the list.
- Browser extension: if you install it, the questions on application forms you choose to fill, so they can be answered from your resume.
3. Who receives data
We use these service providers. They process data on our behalf under data processing agreements.
| Service | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of the web app | EU (Dublin); company in the USA |
| Supabase Inc. | Sign-in and database | EU (Ireland); company in the USA |
| OpenRouter Inc. | AI processing (routes requests to Google, OpenAI, Mistral and others) | USA |
| Anthropic PBC | AI processing (Claude) | USA |
| Groq Inc. | AI processing | USA |
| Google LLC (Gemini API) | AI processing | USA |
| Langfuse GmbH | Quality monitoring of AI calls; emails, phone numbers and links are masked before sending | EU |
| PostHog Inc. | Usage analytics (page views, chosen events; no form contents) | EU; company in the USA |
| Resend Inc. | Sending emails, and the newsletter list if you subscribe | USA |
| Telegram Messenger Inc. | Job alerts, only if you connect Telegram | Outside the EU |
Some providers are in the USA. Transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, otherwise on the EU standard contractual clauses (Art. 46 GDPR).
4. How long we keep data
Your data is kept while your account exists. When you delete your account in the settings, your account and all content stored with us are deleted. Copies held by analytics and monitoring providers (PostHog, Langfuse) are deleted according to their retention periods; messages already sent to Telegram remain in your Telegram chat.
5. Cookies and local storage
We use cookies needed to keep you signed in, and local storage for settings such as theme and language. PostHog analytics stores nothing in your browser: its identifier is kept in memory for the current page only, and session recording is off.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15 to 21 GDPR), and to withdraw consent at any time. Contact us at the address in section 1. You may also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.