Privacy Policy

Last Updated: 9/1/2026

Welcome to EasyApplAI ("we", "us", "our"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application (the "Service"), which includes features for creating Curriculum Vitae (CVs), cover letters, and AI-generated photos. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

Data Controller

The Service is offered under the brand "EasyApplAI" and operated by the entity responsible for processing your personal data:

1. Information We Collect

We may collect information about you in a variety of ways. The information we may collect via the Service includes:

• Personal Data: Personally identifiable information, such as your name, email address, phone number, employment history, educational background, skills, references, and any other information you voluntarily provide to us when creating your CV or cover letter.
• Photographs (AI Headshots): If you choose to use our AI headshot feature (Headshot Pro), you upload one photograph of yourself (a "selfie") and select style options (outfit, background). The selfie is transmitted to our AI image provider solely to generate your professional headshots and is never stored on our servers: it is discarded immediately after generation. The generated headshots are stored in private storage accessible only to you until you delete them or delete your account (see the section "AI-Generated Professional Headshots" below).
• Derivative Data: Information our servers automatically collect when you access the Service, such as your IP address, browser type, operating system, access times, and the pages you have viewed directly before and after accessing the Service.
• Usage Data: Information about how you use the Service, including features utilized and frequency of use.

2. Use of Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the Service to:

• Create and manage your account.
• Generate CVs, cover letters, and AI photos as requested by you.
• Improve the efficiency and operation of the Service.
• Monitor and analyze usage and trends to improve your experience with the Service.
• Respond to your requests and support needs.
• Send you administrative emails regarding your account or the Service.
• Comply with legal obligations.

3. Disclosure of Your Information

We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

• By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.
• Third-Party Service Providers: We may share your information with third parties that perform services for us or on our behalf, including hosting, database management, authentication, email delivery, payment processing, and AI processing. These service providers include Supabase Inc. (hosting and database services) with Amazon Web Services (AWS) as a sub-processor, Stripe, Inc. (payment processing), and OpenRouter Inc. (AI-based content and image generation). All such providers are contractually obligated to process personal data only on our instructions and to implement appropriate technical and organizational security measures.
• AI Processing (OpenRouter): For certain features including CV enhancement, cover letter generation, interview preparation, content optimization, and AI headshot generation, we use artificial-intelligence models accessed through OpenRouter (OpenRouter Inc., United States). For text-based features, we minimize personal identifiers and do not intentionally include direct identifiers such as names, email addresses, or phone numbers. For the headshot feature, the photograph you upload is necessarily transmitted to the provider in order to generate your images, as described in the section "AI-Generated Professional Headshots" below. Data sent to AI services is used solely to produce the output you request and is not used to train AI models.
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• International Data Transfers: While we primarily store and process data in Switzerland, certain limited processing activities (such as technical support or infrastructure management) may involve access from outside Switzerland or the European Union. In addition, AI processing is routed through OpenRouter (United States), and the underlying AI model providers may process requests in other jurisdictions; such transfers are limited to the content required to fulfil your request (for the headshot feature, this includes your photograph) and are covered by the providers' data-processing terms. In all such cases, we rely on appropriate safeguards, including Data Processing Agreements and Standard Contractual Clauses, to ensure an adequate level of data protection in accordance with Swiss and EU data protection laws.

We do not sell your personal information.

AI-Generated Professional Headshots (Headshot Pro)

Headshot Pro is an optional premium feature that generates professional portrait photos from a photograph you upload. When you use it, we process: (a) the photograph you upload (your "selfie"); (b) your style selections (gender presentation, outfit, background); and (c) the resulting AI-generated images.

Your selfie is transmitted over an encrypted connection to our AI image provider, OpenRouter (OpenRouter Inc., United States), which routes the request to the image-generation model we use (Google Gemini). Your image is used exclusively to produce your headshots and is not used to train AI models. The selfie is not stored on our servers and is discarded immediately after the generation is complete.

The generated headshots are stored in private, access-controlled storage hosted in Switzerland and are only accessible to you through short-lived, signed download links. They are kept until you delete them or delete your account. When you delete a set of headshots, the image files are permanently erased; we retain only a minimal record of the generation (the date and your style selections, without any image), which is necessary to administer the monthly generation allowance and cannot be used to reconstruct your photo. All headshot data is permanently deleted when your account is deleted.

We process your photograph on the basis of your explicit consent, which you give by uploading it, and only at your request. Please do not upload photographs of other people unless you have their explicit permission (see our Terms of Service). You may withdraw your consent at any time by deleting your generated headshots or your account; this does not affect the lawfulness of processing carried out before withdrawal.

Advertising Measurement (Google Ads)

If you reach the Service by clicking one of our Google ads, the link carries a click identifier (gclid, gbraid or wbraid). We store that identifier for up to 90 days in a first-party cookie set by our own server, and — if you create an account — on your account record. It tells us only which ad brought you here; it does not identify you to us by name.

When a payment succeeds, we send Google, server to server through the Google Data Manager API, the click identifier, the amount and currency of the payment, a transaction reference, and your email address in irreversibly hashed form (SHA-256) — never in the clear. This allows Google to credit the sale to the ad that produced it. We never send your CV, cover letters, photographs, or any other content you create with the Service, and we do not load Google's advertising or remarketing tags on our site.

We ask for your consent before using your data this way, through the banner shown on your first visit. If you decline, your refusal is transmitted to Google together with the conversion, which means it may only be counted in aggregate statistics: it is not linked to you, not used to build a profile of you, and not used to show you personalised advertising. If you never answer the banner, no consent signal is sent and Google applies the default treatment for your region.

You may change or withdraw your choice at any time by clearing this site's cookies and stored data in your browser, which brings the banner back, or by contacting us — on request we will delete the advertising identifiers held on your account. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Security of Your Information

We use administrative, technical, and physical security measures to help protect your personal information. We implement reasonable security practices, including encryption and access controls, designed to protect the security of any personal information we process.

However, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse. Any information disclosed online is vulnerable to interception and misuse by unauthorized parties. Therefore, we cannot guarantee complete security if you provide personal information.

In the event of a data breach, we will take reasonable steps to notify affected users as required by applicable law, but we disclaim liability for any unauthorized access or breach that occurs despite our reasonable security measures, to the maximum extent permitted by law.

5. Data Hosting and Storage Location

Our Service is hosted using Supabase, a cloud platform that provides database, authentication, and storage services. All primary customer data is stored and processed in Switzerland (Zurich region) using infrastructure provided by Amazon Web Services (AWS). We take reasonable measures to ensure that personal data remains within Switzerland or the European Economic Area. Limited cross-border access may occur for technical support or maintenance purposes, subject to appropriate contractual and technical safeguards.

6. Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements. You may request deletion of your account and associated data, subject to our need to retain certain information for legal or legitimate business purposes. Photographs uploaded for AI headshot generation are never retained. Generated headshots are retained until you delete them or delete your account; after you delete a set of headshots, a minimal metadata record (date and style selections, without any image) is kept solely to administer the monthly generation allowance.

7. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal data:

• The right to access – You have the right to request copies of your personal data.
• The right to rectification – You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you would like to exercise any of these rights, please contact us using the contact information provided below.

8. Policy for Children

We do not knowingly solicit information from or market to children under the age of 13 (or higher age threshold as required by applicable law). If we learn that we have collected personal information from a child under the relevant age without verification of parental consent, we will delete that information as quickly as possible.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

10. Contact Us

If you have questions or comments about this Privacy Policy, please contact us.