Privacy Policy

1. Controller

The controller responsible for data processing is the operator named below. For any privacy request, email privacy@aptlyprep.com.

2. Data we process and why

• Account data (email, name, password hash, language) — to create and run your account. Legal basis: Art. 6(1)(b) GDPR (contract).
• Content you enter (applications, job descriptions, interview rounds, interviewer names you add, notes, uploaded CVs and extracted text) — to provide the app. Art. 6(1)(b) GDPR. Some of this can be sensitive data; see section 11.
• AI prep briefs and chat — your job description, CV excerpt, notes and messages are sent to an AI model at the moment of generation. Art. 6(1)(b) GDPR; for sensitive data Art. 9(2)(a) GDPR (section 11).
• Partner programme membership — if you join with an access code: your group, and pseudonymised usage data shared with the partner (section 5).
• Job links you provide are fetched to auto-fill the job description and periodically checked to see whether the posting is still online. Art. 6(1)(b) GDPR.
• Payment data (plan, purchases, invoices; card details are handled only by Stripe) — to process payments and meet tax obligations. Art. 6(1)(b) and (c) GDPR.
• Emails — transactional emails (sign-up, password reset, payment confirmations) under Art. 6(1)(b) GDPR; optional tips and reminders only with your consent, Art. 6(1)(a) GDPR.
• Technical and security data (IP address, log data, usage counters for abuse prevention) — to keep the service secure and stable. Art. 6(1)(f) GDPR (legitimate interest).
• Website statistics — we use Umami, a cookieless analytics tool. It sets no cookies, stores no IP addresses and creates no personal profiles; we only see aggregated visits and sign-ups. Art. 6(1)(f) GDPR.

3. Cookies and local storage

We only use strictly necessary storage: your login session and language preference, plus a security cookie for the admin area. No advertising or tracking cookies are used, so no cookie banner is required (§ 25(2) TDDDG).

4. Recipients and processors

We use the following service providers, bound by data processing agreements (Art. 28 GDPR):

• Lovable / Supabase — application platform, database, file storage, authentication
• Amazon Web Services EMEA SARL (EU region Stockholm) — underlying cloud infrastructure for the database and encrypted file storage
• Cloudflare, Inc. — content delivery network (CDN), edge hosting and DDoS protection (processes IP addresses and connection data); legal basis Art. 6(1)(f) GDPR
• Google (via Lovable AI Gateway) — AI generation of prep briefs and chat replies
• Stripe Payments Europe Ltd. — payment processing and invoicing
• Resend — sending emails
• Firecrawl — fetching job postings from links you provide
• Umami Software — cookieless website statistics

5. Partner programmes

If you join Aptly Prep through a partner programme using an access code (for example from socialbee), your usage data will be shared with that partner on a pseudonymised basis, as agreed with them.

• What is shared: how many prep briefs and chat replies you used, how much of the group's monthly credits you used, the dates you were active and how far you got in onboarding. This is linked to a pseudonym, not to your name or email address.
• What is never shared: your name, email address, CVs, job descriptions, notes, chat messages or the content of your briefs.
• Why: so the partner can evaluate and fund the programme. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the partner and of Aptly in running and evaluating the programme). You can object at any time (Art. 21 GDPR) by emailing privacy@aptlyprep.com.
• Who receives it: only the partner organisation whose code you used. It uses the data under its own responsibility.

When a programme ends: we email you at least 14 days before. You can then switch to the free plan or a paid plan to keep your account and data. If you don't choose either, your account is deleted when the programme ends. For 5 days after that, you can ask us to restore it; after that, it is permanently deleted.

6. Transfers outside the EU

Some providers are based in or access data from the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Retention

We keep your data as long as your account exists. When you delete your account, we remove your profile, applications, interview rounds, notes, chat messages, briefs and CV files. Invoices and payment records are kept for the statutory period (up to 10 years, § 147 AO / § 257 HGB). Server logs are deleted after a short period. For partner programme accounts, see section 5 for what happens when the programme ends.

8. Your rights

You have the right to:

• access your data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interest (Art. 21 GDPR)
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR), e.g. in your Account settings

Email privacy@aptlyprep.com from the address linked to your account; we respond within one month. You also have the right to lodge a complaint with a supervisory authority, e.g. the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden.

9. Is providing data required?

An email address and your consent to the processing of sensitive data (section 11) are required to create an account. Everything else is voluntary, but some features (e.g. prep briefs) need the information you enter to work.

10. AI and automated decisions

AI-generated content is clearly labelled as such. We do not make automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR). Your data is not used to train AI models.

11. Sensitive data in CVs, chats and notes (Art. 9 GDPR)

What you write in your CV, in chats and in notes can contain special categories of personal data (Art. 9 GDPR), for example about your health or a disability, religion or beliefs, political opinions, trade union membership, ethnic origin or sexual orientation.

Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you give once when you create your account. If your account existed before this consent was introduced, we ask you once at your next sign-in. We record when you consented and which version of the consent text you agreed to.

Why this consent is required: Aptly works with free text you write yourself. We can't reliably detect or filter sensitive details out of it, so we can't provide the service without being allowed to process them. That is why this consent is required to create and use an account.

How we handle it: your data is stored encrypted in the EU (AWS, Stockholm). Excerpts are sent to our AI provider only at the moment a prep brief or chat reply is created, solely for that purpose, and are not used to train AI models. Please leave out sensitive details you don't need.

Withdrawing consent: you can withdraw your consent at any time in your Account settings. Because the service can't work without it, withdrawing ends your use of Aptly. You can ask us for a copy of your data and to delete your account by emailing privacy@aptlyprep.com. Withdrawal does not affect the lawfulness of processing carried out before.

12. Security

Data is transmitted over HTTPS. Your records are isolated per account, CV files are stored in a private bucket accessible only via short-lived links, and passwords are hashed and checked against known breaches.