Privacy Policy
This Privacy Policy explains how Floating Binary Software Systems Inc. (“FlashApply,” “we,” “us” or “our”) collects, uses, discloses and protects personal information when you use our website at flashapply.ai, our application at app.flashapply.ai (including when it’s installed on a device), our emails and related services (together, the “Service”). It also explains your choices and rights.
We wrote this policy to be read, not skimmed past. If anything is unclear, contact our Privacy Officer at privacy@flashapply.ai.
In short:
- We collect what we need to find jobs and tailor your resume, and nothing more.
- We don’t sell your personal information, don’t share it for advertising, and don’t use your resume or chats to train AI models.
- Your resume and searches are sent to our AI provider (OpenAI) only to produce your results.
- Guest data is deleted after about 24 hours.
- Deleting your account erases your data immediately, except for records the law requires us or our payment provider to keep.
1. Who is responsible for your information
Floating Binary Software Systems Inc., 23 Barrel Yards Blvd, Waterloo, Ontario, Canada, is responsible for personal information processed through the Service. Under the EU and UK General Data Protection Regulations (“GDPR”), it is the “controller.”
Privacy Officer (the person in charge of the protection of personal information): Privacy Officer, Floating Binary Software Systems Inc., privacy@flashapply.ai.
2. Information we collect
Information you give us
| Category | Examples | When |
|---|---|---|
| Account details | Email address. If you sign in with Google, Google gives our sign-in provider (Firebase Authentication) your name, email address and profile picture. FlashApply uses only your email address. | When you create an account or sign in |
| Resumes and files | Resume files you upload, the text we extract from them, tailored versions, your edits, and resume labels | When you upload or tailor a resume |
| Chats and searches | Your messages to FlashApply, the jobs you search for (role, location, salary and other preferences), and the results shown to you | When you use Chat |
| Saved jobs and activity | Jobs you save, mark as applied or organize, and your conversation history | When you use those features |
| Auto Search settings | Search criteria, schedule, time zone and whether each Auto Search is active | When you set up an Auto Search |
| Preferences | Email preferences, including whether you agreed to receive marketing emails | When you sign up or change settings |
| Communications | Messages you send us and our replies | When you contact us |
A resume may contain sensitive details. Please leave out information you don’t need to share, such as government identification numbers, date of birth, health information, photos, or details about race, religion or other protected characteristics. We don’t ask for it and don’t need it.
Information about payments
Payments are handled by Stripe. We don’t receive or store your full card number. Stripe shares limited information with us: a customer identifier, your plan, subscription status, billing dates, the amounts and currency you paid, taxes, and refund or dispute status. Stripe’s own use of your information is covered by the Stripe Privacy Policy.
Information collected automatically
| Category | Details |
|---|---|
| Usage and credits | Which features you use, credits reserved and charged, plan limits used, and the cost of AI and search operations linked to your account (for billing, limits and preventing abuse) |
| Guest-session signals | For people using FlashApply without an account: a random session identifier, and a one-way, keyed hash of your IP address and browser signals, used to apply daily limits and stop abuse. We don’t store guest IP addresses in raw form. |
| Technical logs | Our hosting provider’s request logs, which include IP address, browser user agent, time, and requested page. Used for security, troubleshooting and service reliability. |
| Email events | Unsubscribe requests. Clicks on job links in Auto Search emails go through a signed redirect and are counted only as an anonymous total that isn’t linked to you. |
| Device storage | Cookies and similar storage described in section 9 |
Information from others
- Google, if you choose Google sign-in (see the table above).
- Public web pages. Job postings we find through web search are public information about jobs, not about you.
- Bot protection. If our abuse checks are triggered, we may ask Cloudflare Turnstile to confirm you’re a person. Cloudflare returns a pass or fail result.
3. How we use information, and our legal bases
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Provide the Service: run your searches, show results, tailor resumes, keep your history | Account details, resumes, chats and searches, saved jobs, Auto Search settings | Performance of our contract with you |
| Run Auto Search and email you results | Auto Search settings, email address, time zone | Contract |
| Sign you in and keep your account secure | Email address, Google account details, session cookie | Contract; legitimate interests (security) |
| Process payments, credits and plan limits | Payment information from Stripe, usage and credits | Contract; legal obligation (tax and accounting records) |
| Prevent abuse, fraud and overuse, and enforce free limits | Guest-session signals, usage, technical logs | Legitimate interests (protecting the Service and keeping it affordable) |
| Customer support | Communications, account details | Contract; legitimate interests |
| Improve reliability, cost and quality | Aggregated and de-identified usage and cost metrics | Legitimate interests |
| Send service notices (security, billing, changes to terms) | Email address | Contract; legal obligation |
| Send marketing emails | Email address, marketing preference | Your consent, which you can withdraw at any time |
| Comply with law and enforce our terms | Any relevant information | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights. You can object (section 8). In Canada, we rely on your consent, which you give by using the Service as described in this policy, or express consent where the law requires it (for example, for marketing emails).
We don’t sell or rent personal information, share it for cross-context behavioural advertising, or use it for advertising profiles. We don’t use your resumes, chats or other content to train AI models.
4. How AI is used
To answer your requests, FlashApply sends the relevant parts of your request to OpenAI, our AI provider, through its business API. Depending on the action, that includes:
- your search request and preferences (for a search);
- your resume text and the job posting (for tailoring); and
- your recent messages in the conversation (for chat).
OpenAI processes this information on our behalf to generate the response. Under OpenAI’s API terms, data sent through the API isn’t used to train OpenAI’s models by default. OpenAI may keep it for a limited period, currently up to 30 days, to detect abuse, before deleting it.
Automated processing. AI helps choose which postings to show you and how to word tailored resumes. FlashApply doesn’t make decisions about you that produce legal effects or similarly significant effects. We don’t decide who gets a job, and we never apply on your behalf. Before you can export a tailored resume, our accuracy checks flag new claims, and you review and approve every flagged item. You can contact us to ask how a result was produced.
5. How we share information
We share personal information only as described here.
Service providers (processors) that help us run the Service, under contracts that limit their use of your information to providing services to us:
| Provider | What they do | Information involved | Location |
|---|---|---|---|
| Google Cloud / Firebase (Google LLC) | Hosting, database, file storage, authentication, logs, scheduling | All Service data | United States |
| OpenAI (OpenAI, L.L.C. / OpenAI Ireland Ltd.) | AI models and web search | Requests, resume text, job postings, recent messages | United States |
| Stripe (Stripe, Inc. / Stripe Payments Canada, Ltd.) | Payments, subscriptions, tax calculation | Email, payment and billing information | United States / Canada |
| Resend (Plus Five Five, Inc.) | Sending email (sign-in links, Auto Search, notices) | Email address, email content | United States |
| Cloudflare (Cloudflare, Inc.) | Bot protection (Turnstile), only when abuse checks are triggered | Browser and device signals, IP address | United States / global |
Other disclosures. We may disclose information:
- when the law requires it, or in response to a valid legal request, such as a court order, after checking the request is lawful and limiting what we disclose;
- to protect people and the Service, where we believe in good faith it’s necessary to prevent fraud, abuse, security threats or harm to someone’s safety;
- in a business transaction, such as a merger, financing, acquisition or sale of assets, under confidentiality obligations. We’ll notify you if your information becomes subject to a different privacy policy; and
- with your direction or consent.
Employers don’t receive your information from us. Job postings link to third-party sites. Anything you submit to an employer or a job site is governed by their policies, not ours.
6. International transfers
We are based in Canada, and our service providers process information in Canada, the United States and possibly other countries. Those countries’ laws may differ from where you live, and authorities there may be able to access information under their own laws. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions where available (Canada has partial adequacy for commercial organizations under EU law) and on safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum. For Quebec residents, we assess the protection offered before transferring personal information outside Quebec, as Quebec law requires. Contact us for more about these safeguards.
7. How long we keep information
| Information | How long |
|---|---|
| Guest sessions and guest data | Deleted automatically after about 24 hours |
| Account data: resumes, chats, saved jobs, Auto Searches, preferences, usage history | Until you delete it or your account |
| Data you delete yourself (a resume, a chat, an Auto Search) | Deleted from the Service right away |
| Account deletion | Immediate. Your account is locked and all your content, files and usage records are erased at once. Any step interrupted by a technical failure is finished automatically within about an hour. |
| Shared search cache | Public job postings only, with no information about you. Expires the same day. |
| Hosting request logs | About 30 days |
| Payment records | Kept by Stripe, and by us where required, for as long as tax, accounting and anti-fraud laws require (often 6 to 7 years) |
| Records of your consent and marketing preferences | For as long as needed to show we respected your choice |
| Aggregated, de-identified statistics | May be kept indefinitely. They can’t identify you. |
When you delete your account, we also delete your Stripe customer record, which cancels any subscription. Stripe may keep transaction records it’s legally required to keep.
8. Your rights and choices
Choices you can make anytime in the app:
- Download your resumes and tailored resumes.
- Delete individual resumes, chats and Auto Searches.
- Pause or delete Auto Searches, or unsubscribe from Auto Search emails using the link in each email.
- Turn marketing emails on or off in your account, or use the unsubscribe link in any marketing email.
- Delete your account (Account → Delete account). This is immediate and permanent.
Your rights. Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy;
- correct inaccurate or incomplete information;
- delete your information;
- port your information in a structured, commonly used, machine-readable format;
- object to, or ask us to restrict, certain processing, including processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing;
- be informed about automated processing and ask for a human review (see section 4);
- opt out of the “sale” or “sharing” of personal information, or of targeted advertising (we don’t do either); and
- not be discriminated against for exercising your rights.
How to make a request. Email privacy@flashapply.ai from the address on your account. We’ll confirm your identity before acting, and may ask for more information to do so. An authorized agent may make a request for you with proof of authority. We’ll respond within the time the law requires: generally within 30 days, extendable where the law allows. Requests are free unless they are clearly unfounded or excessive.
Complaints. Please contact us first so we can try to help. You also have the right to complain to a data protection authority, such as:
- the Office of the Privacy Commissioner of Canada (priv.gc.ca);
- the Commission d’accès à l’information du Québec (cai.gouv.qc.ca), for Quebec residents;
- your local supervisory authority in the EEA, or the UK Information Commissioner’s Office (ico.org.uk).
Additional information for California residents
In the past 12 months we have collected these categories of personal information, as defined by the California Consumer Privacy Act: identifiers (such as email address and account IDs); customer records (such as resume contents); commercial information (purchases and plan history); internet or other electronic network activity (usage and logs); professional or employment-related information (such as resume contents and job preferences); and inferences drawn from your requests to personalize results. The sources, purposes and recipients are described in sections 2 to 5, and retention in section 7. We disclose these categories to the service providers listed in section 5 for business purposes. We don’t sell or share personal information (as those terms are defined in the CCPA), and we have no actual knowledge of selling or sharing information of consumers under 16. We use sensitive personal information only to provide the Service, as the law permits. We honour Global Privacy Control signals as an opt-out of sale and sharing, though we don’t sell or share.
9. Cookies and similar storage
Our marketing website (flashapply.ai) doesn’t use cookies, analytics or advertising trackers.
The FlashApply app uses only what it needs to work. It doesn’t use advertising, cross-site tracking or third-party analytics cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
__session |
Cookie (secure, HTTP-only) | Keeps you signed in | 7 days |
fa_guest |
Cookie (secure, HTTP-only) | Identifies a guest session to apply free limits | 24 hours |
fa_email_for_signin |
Local storage | Remembers the email you entered so the sign-in link can finish signing you in | Until sign-in completes |
fa_marketing_consent |
Local storage | Carries your marketing choice through sign-in | Until sign-in completes |
fa_next |
Local storage | Returns you to the page you were on after signing in | Until sign-in completes |
fa.pwa.*, tips and layout preferences |
Local storage | Remembers whether you dismissed the install prompt or a tip, and interface preferences such as a collapsed sidebar | Until you clear your browser storage |
| App cache | Service worker cache | Stores the app’s public files (code, icons, offline page) so it loads quickly and works offline. Never stores your account data, chats, resumes or payment information. | Replaced with each new version of the app |
If our bot protection is triggered, Cloudflare Turnstile may set its own strictly necessary cookies or use similar technology to confirm you’re a person.
You can block or delete cookies in your browser settings, but you won’t be able to sign in without the session cookie. We don’t respond to “Do Not Track” signals, because there is no common standard for them. We honour Global Privacy Control as described in section 8.
10. Security
We protect personal information with safeguards suited to its sensitivity, including:
- encryption in transit (HTTPS) and at rest;
- database and storage rules that block direct access from browsers, so every request goes through our server, which checks you own the data;
- secure, HTTP-only session cookies, and checks on the origin of requests that change data;
- signed links in emails;
- keyed hashing in place of raw guest IP addresses;
- limited staff access on a need-to-know basis; and
- protections against prompt-injection attempts in AI features.
No method of transmission or storage is completely secure, so we can’t guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the relevant authorities as the law requires, and keep a record of the incident.
11. Children
The Service is not intended for anyone under 16, and we don’t knowingly collect personal information from children under 16. If you believe a child under 16 has given us personal information, contact privacy@flashapply.ai and we’ll delete it.
12. Changes to this policy
We may update this policy as the Service or the law changes. We’ll post the new version here with a new “Last updated” date. If a change is material, we’ll also notify you by email or in the app before it takes effect. Where the law requires your consent to a change, we’ll ask for it.
13. Contact us
Privacy questions and requests: privacy@flashapply.ai Privacy Officer: Floating Binary Software Systems Inc., 23 Barrel Yards Blvd, Waterloo, Ontario, Canada General support: support@flashapply.ai