Privacy Policy
Last updated: July 25, 2026
1. Who we are
MassApply AI ('we', 'us', 'our') operates the website and SaaS platform at massapplyai.com. Contact: hello@massapplyai.com.
2. What we collect
(a) Account data: name, email, password hash, OAuth provider IDs. (b) Profile data: resume, work history, target roles, salary expectations, work authorization. (c) Optional job-site credentials, which we store encrypted with AES-256-GCM. (d) Application activity: which jobs we applied to on your behalf, status, match score, and AI-generated resume/cover letter for each. (e) Payment metadata via Stripe (we never see card numbers). (f) Standard log data (IP, user agent, timestamps).
3. How we use it
Solely to operate the service — to find, score, tailor, and submit job applications on your behalf; to bill you; to send transactional and account email; to detect abuse; and to improve the product. We do not sell personal data. We do not use your resume to train any third-party AI model.
4. AI providers
We use third-party AI providers to power tailoring, scoring, and our Massey helper. Your resume text, job descriptions, and message content are sent to these providers solely to generate responses for you; providers contractually prohibit use of this content for training.
5. Credential handling
If you choose to store job-site credentials so we can submit applications on your behalf, they are encrypted at rest with AES-256-GCM and decrypted only inside our submission worker. They are never displayed back to you and not visible to staff in plaintext.
6. Sharing
Subprocessors: Supabase (database, RLS-isolated by user), Stripe (billing), Resend (email), Apify (job scraping), AI/LLM providers (AI generation), Vercel (hosting), Railway (automation). We do not share data with advertisers.
7. Your choices
You can export your data, delete your account, and revoke stored credentials at any time from your settings page. Deletion removes account data within 30 days; aggregated billing records may be retained as required by law.
8. Retention
Application history is kept for as long as your account is active and 90 days thereafter. Encrypted credentials are deleted within 24 hours of credential-revocation or account closure.
9. Security
HTTPS everywhere, Supabase Row Level Security on all per-user tables, AES-256 on stored credentials, rate limiting on all API routes, secrets in environment variables only. We do our best — no system is perfectly secure. If you find a vulnerability, please email hello@massapplyai.com.
10. Children
MassApply AI is not intended for users under 18.
11. International
We process data in the United States. If you sign up from elsewhere, you consent to processing in the US.
12. Changes
When we materially change this policy we'll email account holders and post the updated version here. Continued use after the effective date means you accept the changes.
13. Browser extension (Tailor & Fill)
Our optional Chrome extension, 'MassApply AI — Tailor & Fill', runs only on supported job sites (ZipRecruiter, Dice, Handshake, and Greenhouse application pages) and on massapplyai.com. (a) Page content: when you click the Tailor & Fill button on a job posting, the extension reads the visible content of that page — the job title and description — and your saved resume, and sends them to massapplyai.com (and nowhere else) to generate a tailored resume and cover letter for that role. It does not read your other tabs, your browsing history, or pages you do not act on. (b) Form filling: on supported application forms the extension fills fields (such as name, email, phone, and links) using values from your MassApply AI profile. It never overwrites entries you have already made, and it never submits an application for you — you always review and click Submit yourself. (c) Authentication: the extension reuses your existing massapplyai.com login session cookie to authenticate its requests to our servers; it does not collect or store any separate password, and it does not store your job-site credentials. (d) Local storage: the extension stores only a small local flag on your device (a settings toggle, and a marker on massapplyai.com used to detect that the extension is installed). (e) No third parties: the extension transmits data only to massapplyai.com. It does not send page content or personal data to any other party, and it contains no third-party analytics or tracking.
14. Data deletion
You have the right to delete your MassApply AI account and all personal data associated with it (including any data we received from Facebook Login or other OAuth providers) at any time. There are two ways to request deletion:
- In-app (recommended). Sign in, go to Settings, and click“Delete account.” Confirmation requires a 6-digit code sent to your registered email. Account and profile data are removed within 24 hours; encrypted job-site credentials are wiped immediately; derivative data (application history, AI-generated documents) is purged within 30 days.
- By email. Send a deletion request from the email address associated with your account to privacy@massapplyai.com with the subject line “Delete my data.” We respond within 5 business days and complete deletion within 30 days. If you signed up via Facebook Login, mention that so we can confirm Facebook ID removal as well.
What deletion removes: your account, profile, resume/cover letters, onboarding answers, application history, stored credentials, OAuth provider identifiers (including Facebook user ID and email scope, if applicable), and Massey chat transcripts. What we may retain: aggregate billing records as required by tax/finance law (no personal profile data), and anonymized usage analytics that cannot be tied back to you.
Facebook users:You can also revoke MassApply AI's access from Facebook Settings → Apps and Websites. Revoking access via Facebook stops further data sharing but does not by itself delete data we have already received — use one of the two methods above to complete deletion.
Questions? Email hello@massapplyai.com.