aiApply.ch ("aiApply", "we") provides career preparation software for people job-hunting in Switzerland. This policy explains how we process personal data when you use https://aiapply.ch.
1. Controller
The data controller is the operator of aiApply.ch. Contact: privacy@aiapply.ch.
2. What we collect
- Pre-launch waitlist: if you join before public launch, we collect your name, email, optional job-search context, and marketing attribution (e.g. UTM parameters). We use this only to contact you about aiApply launch and early access. Retained until you unsubscribe or ask us to delete your waitlist entry (privacy@aiapply.ch).
- Contact form: name, email, message, and topic. Used only to reply. Retained for 24 months or until you ask us to delete the message (privacy@aiapply.ch).
- Account data: email, display name, authentication identifiers (Firebase Auth).
- Career documents you upload: CVs, Swiss Work Certificates, certificates, and job descriptions you provide.
- Profile and settings: job-search preferences, Swiss work-permit category, CEFR language levels (optional).
- Generated outputs: tailored CVs, cover letters, fit analyses, and export files you create in the product.
- Billing metadata: Stripe customer id, subscription status, token wallet balance (no full card numbers).
- Technical logs: security, abuse prevention, and pipeline run diagnostics.
3. Where data is stored and processed
Storage: personal data at rest is held in Google Cloud regions in Switzerland (Zürich, europe-west6) — Firestore and Cloud Storage. The application itself (Cloud Run, Cloud Functions) also runs in Zürich.
AI writing: when we generate a CV, cover letter, or related analysis, we send prompt content (which may include your approved career facts) to named AI providers. That processing is not pinned to the EU or Switzerland today:
- xAI (United States) — Grok, via xAI's direct API. Used as the flair draft seat and as the labelled interim writer when Claude is unavailable.
- Google Vertex AI partner models (global routing) — Anthropic Claude when quota allows, and OpenAI gpt-oss for structure drafts. Vertex
locations/globalis not an EU region pin. Google's Model Garden card for gpt-oss lists ML processing in the US multi-region.
Outputs are written back to Switzerland. We do not use your documents to train public models. Stripe processes payment data as a separate provider.
4. Purposes and legal bases
- Provide the service you signed up for (contract).
- Security, fraud prevention, and billing (legitimate interest / contract).
- Compliance with law where required (legal obligation).
5. Retention
We retain your vault and generated documents while your account is active. You may delete your account in Settings; we delete the tenant subtree under your user id. Backups may persist for a limited period per Google Cloud retention policies.
Data export downloads: when you request a machine-readable export of your data (GDPR portability), we write a JSON file to your private Storage folder. That file is automatically deleted after 48 hours (GCS lifecycle plus a scheduled cleanup). Download it promptly; we do not keep long-lived copies of full export dumps after download.
6. Your rights
Under Swiss nFADP and, where applicable, GDPR, you may request access, correction, deletion, restriction, or portability of your data. Contact privacy@aiapply.ch.
7. Sub-processors
Google Cloud (hosting, database, Vertex partner models), xAI (Grok drafts), Stripe (payments), and Firebase/Google Identity (authentication). Optional: Perplexity (job-market research only), Bright Data (a LinkedIn posting you paste), Honcho (optional rewrite memory). A current sub-processor list is available on request. Which written agreements exist is listed for internal review in the project runbook — this page is disclosure, not legal advice.
This document is provided for transparency. Have your legal counsel review before relying on it for regulatory filings.