Privacy Policy
This Privacy Policy describes how appply(“appply”, “we”, “us”, “our”) collects, uses, and shares personal data when you use our website at appply.ai (the “Site”) and our recruiting service (the “Service”). This Policy is written in English. It is the binding version; translations may be provided for convenience.
1. Who we are
appply is a recruiting platform that lets businesses describe a role over WhatsApp, automatically posts the resulting job advertisement to job boards in the relevant country, and uses artificial intelligence to converse with each applicant via WhatsApp until a qualified candidate can be introduced to the recruiter.
- Legal entity: Foreach Labs, a company registered in France, operating the appply.ai service.
- Registered office: 51 Boulevard de Strasbourg, 59000 Lille, France.
- Company registration number (SIREN / RCS Lille): provided on request to [email protected].
- General contact: [email protected]
- Data-protection contact: [email protected]
We are the data controller for personal data we process about recruiters (our customers). For personal data of job applicants whom we screen on behalf of a recruiter, the recruiter is the data controller and we act as their data processor.
2. WhatsApp Business API
The Service is delivered primarily through the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates (“Meta”). When you exchange messages with us or with candidates via WhatsApp, those messages are transmitted through Meta’s WhatsApp Business API.
By using the Service, you acknowledge that:
- Messages sent via WhatsApp are subject to Meta’s WhatsApp Business Messaging Policy and WhatsApp Business Terms of Service.
- WhatsApp encrypts messages in transit; because we act as a business endpoint, the content of WhatsApp Business API messages is accessible to us in plaintext within our systems to operate the Service.
- Meta receives certain message metadata (sender, recipient, delivery status, business account information) and may use it as described in the WhatsApp Business Privacy Policy.
- You may opt out at any time by replying STOP to the WhatsApp conversation. We will cease messaging that number and place it on a suppression list.
3. Information we collect
3.1 From recruiters (our customers)
- Account information: name, business name, email address, phone number, billing address, tax identification number where applicable, and payment information (processed by our payment provider; we do not store full card numbers).
- Job briefs: voice notes, text, or images you send to our WhatsApp number describing roles to fill.
- Configuration: screening questions, availability windows, target job boards, calendars connected to the Service.
- Communications: messages, voice notes, and attachments you exchange with us via WhatsApp, email, or in-app channels.
3.2 From candidates (applicants)
- Identity and contact data: WhatsApp profile name, WhatsApp display photo, phone number.
- Application data: answers to screening questions, voice notes, files sent via WhatsApp (e.g., CVs, ID, work permits if requested by the recruiter), language preference.
- Behavioural data: message timestamps, read receipts, conversation duration.
3.3 Visitors to the website
- Technical data: IP address, user agent, device type, locale, referrer, pages viewed, time on page.
- Cookies: strictly necessary session cookies; privacy-friendly analytics only where consent is given (see §8).
4. Lawful bases (GDPR)
We process personal data on the following lawful bases under the EU General Data Protection Regulation (EU) 2016/679:
| Activity | Lawful basis |
|---|---|
| Providing the recruiting Service to recruiters | Contract — Art. 6(1)(b) |
| Conversing with applicants via WhatsApp on the recruiter’s behalf | Legitimate interests of the recruiter (Art. 6(1)(f)) and the applicant’s own initiative |
| Sending service updates to recruiters | Legitimate interests, with opt-out |
| Sending direct marketing | Consent — Art. 6(1)(a) |
| Complying with legal obligations | Legal obligation — Art. 6(1)(c) |
| Detecting and preventing fraud and abuse | Legitimate interests |
For applicant data, the recruiter is the data controller and we act as data processor. Our data processing terms with recruiters incorporate the EU Standard Contractual Clauses (2021/914) where applicable.
5. How we use information
We use personal data to:
- Generate job advertisements from recruiter briefs;
- Publish those advertisements to job boards selected for the recruiter’s country and budget;
- Receive and engage with applicants via WhatsApp;
- Run AI-powered screening conversations in the applicant’s language;
- Schedule interviews against the recruiter’s calendar;
- Introduce qualified candidates to the recruiter;
- Operate, secure, and improve the Service;
- Train and evaluate our AI models on anonymised or aggregated data, where permitted by applicable law;
- Comply with legal and regulatory obligations;
- Enforce our Terms of Service.
We do not sell personal data. We do not use applicant data for advertising profiling. We do not share applicant data with third parties other than as described in §6.
6. Sharing of information
- With recruiters:when an applicant qualifies, we share the applicant’s contact information, screening transcript, and our assessment with the relevant recruiter.
- With job boards:the job advertisement (no personal applicant data) is published to job boards in the recruiter’s country.
- With Meta: as required to deliver messages via the WhatsApp Business API.
- With service providers: cloud hosting, telephony, AI model providers, payment processors, analytics, and customer-support tools — each bound by written agreements restricting use to providing services to us.
- With law-enforcement or regulators: where legally compelled or to protect our rights, property, or safety.
- In a business transfer: in connection with a merger, acquisition, or sale of assets, subject to confidentiality protections.
A current list of our material sub-processors is available on request and is maintained in our Data Processing Addendum.
7. International transfers
We process personal data primarily in the European Union. Some of our service providers (including Meta and our AI providers) operate outside the European Economic Area. Where data is transferred outside the EEA, we rely on:
- European Commission adequacy decisions where applicable;
- EU Standard Contractual Clauses (2021/914); and
- Supplementary safeguards such as encryption in transit and at rest.
8. Cookies and analytics
The Site uses strictly necessary cookies to support the language switcher and security. Where you give consent, we may use privacy-friendly analytics to understand aggregate usage (no cross-site tracking, no advertising IDs). You can withdraw consent at any time via our cookie banner or browser settings.
9. Data retention
| Data category | Retention period |
|---|---|
| Recruiter account data | For the duration of the contract, plus 3 years for legal-claim purposes |
| Recruiter billing and invoicing data | 10 years (French Commercial Code) |
| Applicant conversation data (general) | 24 months after last interaction, then anonymised |
| Applicants introduced to a recruiter | Until the recruiter requests deletion, or up to 2 years |
| Applicants who opt out (“STOP”) | Phone number kept on a suppression list; conversation data deleted within 30 days |
| Website analytics | 13 months |
| Backups | Up to 35 days after primary deletion |
10. Your rights
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under applicable data-protection law:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”);
- Restrict or object to certain processing;
- Data portability;
- Withdraw consent at any time, without affecting the lawfulness of prior processing;
- Lodge a complaint with your supervisory authority (in France: the CNIL).
To exercise any right, email [email protected]. We respond within one month.
10.1 Data deletion requests
You can request deletion of all personal data we hold about you at any time:
- Email [email protected] with the subject “Data Deletion Request”.
- Include the phone number you used with the Service and a brief description.
- We confirm receipt within 5 business days and complete deletion within 30 days, except where we are required to retain certain data for legal or accounting purposes (e.g., invoices retained under French tax law).
Applicants who messaged us via WhatsApp can also trigger deletion by replying DELETE to the conversation. We will delete the conversation and remove the phone number from our active databases within 30 days.
11. Security
We protect personal data using:
- TLS encryption in transit;
- Encryption at rest for stored data;
- Role-based access controls and audit logs;
- Least-privilege access for staff;
- Vendor security review for sub-processors;
- Annual penetration testing.
No system is perfectly secure. If we become aware of a personal-data breach affecting your rights, we will notify the relevant supervisory authority and, where required, you directly within 72 hours.
12. Children
The Service is intended for use by recruiters and adult job applicants. We do not knowingly collect personal data from children under 16. If you believe we have, please contact us so we can delete it.
13. Changes to this policy
We may update this Policy from time to time. Material changes will be notified by email to recruiters and via a banner on the Site at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.
14. Contact
- Privacy questions and rights requests: [email protected]
- General: [email protected]
- Postal address: Foreach Labs, 51 Boulevard de Strasbourg, 59000 Lille, France
If you have a complaint we have been unable to resolve, you may contact the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75007 Paris, France — www.cnil.fr.