Draft for lawyer review

Privacy notice

This is a draft privacy notice for ApplyHonest, operated by Zavva Holdings, LLC, 515 North Flagler Drive, Suite 350, West Palm Beach, FL 33401. It is not legal advice. A lawyer should review it, including for GDPR, UK GDPR, and US state privacy laws, before the service takes real users. Last drafted 28 October 2026. Contact zavvaadmin@zavvaholdings.com.

What we collect

• Resume text you paste or that we extract from a PDF or DOCX. The original file bytes are discarded after extraction. We do not keep the upload.
• Job posting text you paste, or text fetched from a public URL you supply.
• An email address if you sign in or buy credits, and a random session cookie.
• A random device cookie so a match you ran in this browser can be reopened before you sign in.
• Credit balance and purchase identifiers from Lemon Squeezy. We do not receive or store card numbers.
• A coarse rate-limit key that can include an IP address from the request, used to slow automated abuse of the free check. It is not sold and it is not a marketing profile.

Why

We use this information to show the evidence table, to produce a tailoring you asked for, to keep credits attached to your email, to prevent abuse, and to delete data on schedule. The legal basis for people in the EEA or UK should be confirmed by counsel. The working basis in this draft is steps toward a contract you request (the check or the tailoring) and a legitimate interest in keeping the service from being abused, balanced against the fact that a resume is personal and often sensitive.

Models and training

We do not use your resume or job text to train our own models. We do not sell resume data. If the deployment has an OpenAI or Anthropic key, the text needed for that request is sent to that provider under their API terms. You should read those terms before turning a key on. If no key is set, matching stays on this server and no model provider receives the resume.

How long we keep it

Extracted resume text, the posting, and a saved tailoring are deleted 30 days after the match is created, unless RETENTION_DAYS is set to another value between 1 and 365. You can delete a single match from its page, or delete the account, which removes saved resumes, tailorings, the email, and unused credits. A daily job is intended to purge expired rows when CRON_SECRET is configured. Payment records at Lemon Squeezy follow their retention, not ours. Rate-limit buckets expire with their window.

Who else sees it

• The hosting provider (intended: Vercel) processes requests.
• The database provider processes stored text if DATABASE_URL points at a hosted Turso database (libsql).
• Lemon Squeezy, if you pay, as merchant of record.
• Resend, if email is configured, to deliver the sign-in link.
• OpenAI or Anthropic, only when that provider’s key is configured.

A public card shows only the counts (backed, partial, unsupported). It does not include your name, employers, or quotes. Do not create one if even the counts feel identifying. The private match URL is a secret. Anyone with it and the same browser cookie can open the resume text.

Where

The company is in the United States. Hosting, database, email, and model providers may process data in the United States or other countries they operate in. International transfer terms (such as SCCs) are for counsel to put in place before you invite users from the EEA, UK, or similar regions.

Children

The service is not directed at children under 16, and we do not want resumes from them.

Your requests

Email zavvaadmin@zavvaholdings.com to ask for a copy or a correction, or use the delete controls in the product. We may need the same email you used to sign in so we do not delete the wrong person. Response timing should be set by counsel to match the laws that apply. This draft aims to act without delay on a delete of resume text.

Security

Session cookies are httpOnly. Webhook calls are checked with a signature. Job URL fetches refuse private and link-local addresses. None of that is a promise that a breach is impossible. If we learn of a breach that the law says we must announce, we will follow that law.

Changes

If this notice changes, the date at the top changes with it.