Privacy Policy

• Account details from Google sign-in: your name and email.
• Profile / knowledge base: contact details, experience, education, startup details, and any custom fields or Q&A you add.
• Documents you upload to your vault (e.g. résumé, pitch deck, certificates, marksheets) and text extracted from them.
• Anything else you type into the coach or fill flows.

• Basic technical data needed to run and secure the service (e.g. IP address, browser/OS, timestamps).
• Fill activity: which form fields were detected and filled, and error logs — used to make filling reliable.

Your name and email from Google when you sign in; billing status from Stripe when you purchase.

• To fill and manage application forms, and to power the coach and readiness features.
• To maintain your account, documents, credits, and application tracker.
• To operate, secure, debug, and improve the Services.
• To send you service-related messages (e.g. important account or billing notices).
• To comply with legal obligations.

We do not sell your personal data, and we don't use it for third-party advertising.

To generate fills and answers, we send the form's on-page content and the parts of your profile and Q&A relevant to the task to our AI provider (AWS Bedrock by default). Your uploaded documents are sent to the AI only when you explicitly mark a document “AI-readable.” If you don't, its content is never sent for AI processing.

Our AI provider processes these requests to return a result and, per its terms, does not use your inputs to train its foundation models. ApplyVault only produces answers grounded in your data — it does not fabricate credentials, and it never fills protected self-identification (gender, veteran, disability) unless you've explicitly provided it.

ApplyVault never submits a form for you. It fills fields and stops; you review and submit. It does not log in as you or solve CAPTCHAs. Where filling needs a judgement call, it asks you rather than guess.

We don't sell your data. We share it only in these situations:

• Service providers we rely on to run ApplyVault — see §6. They process data only to provide their part.
• With your action/consent — e.g. when you fill and submit a third party's form, that data goes to them; or when you link a co-founder to share profile data.
• Legal — to comply with applicable law, regulation, or a valid legal request.
• Business transfer — if ApplyVault is involved in a merger, acquisition, or asset sale, data may transfer under this policy.

• Google — sign-in (OAuth).
• AWS Bedrock (or your configured provider) — AI processing.
• Stripe — payments (we never receive your card number).
• UploadThing — encrypted document storage.

• In transit & at rest. Traffic is over HTTPS; document bytes and extracted text are encrypted at rest with AES-256-GCM.
• Honest note on keys. We hold the key needed to decrypt documents so we can process them on your behalf. This means we are not “zero-knowledge” — we could technically access your data — but access is limited to running the service, on a need-to-know basis, never for selling or profiling.
• Tokens. Browser-extension tokens are stored only as a SHA-256 hash.
• Link reading. When the coach reads a link you paste, requests are guarded against internal/private hosts (SSRF), with size and time limits.

We operate online, so your data may be processed or stored in countries other than your own (for example, our AI provider's region). Where required, we rely on appropriate safeguards under applicable data-protection laws (such as GDPR for EU users).

• Access & correction — view and edit your profile and documents anytime in your dashboard.
• Deletion — delete individual documents, or your entire account; account deletion cascades to your profile, knowledge base, documents, applications, and tokens.
• Consent — per-document control over whether the AI may read it; revoke anytime.
• Portability & objection — request an export of your data, or object to / restrict a specific processing, by contacting us.

To exercise any right, email pradeepsaridha@gmail.com.

We use a single, essential session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. You can clear cookies in your browser, but sign-in won't work without the session cookie.

By creating an account you agree to receive necessary service messages (account, security, billing). Any promotional email we send will include an unsubscribe link; opting out won't affect essential service messages.

ApplyVault is not directed to children under 13 (or under 16 where required), and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we'll delete it.

We keep your data while your account is active. When you delete your account, associated data is removed; routine backups are purged on their normal cycle.

We'll post changes here and update the effective date. Questions or requests: pradeepsaridha@gmail.com.

When you install and use the ApplyVault Chrome Extension, it requests specific browser permissions strictly to perform user-initiated application autofilling. The extension adheres to the Chrome Web Store Developer Programme Policies, including the Limited Use requirements:

• Single Purpose: The extension serves a single, narrow purpose: assisting founders and applicants in inspecting, reviewing, and autofilling their stored vault information into job, grant, and accelerator forms upon explicit command.
• Side Panel (sidePanel): Renders the ApplyVault assistant side-by-side with your active application webpage so you can review matched fields without obstructing form inputs.
• Host Permissions & Scripting (host_permissions, scripting, tabs): Used strictly to inspect form fields and populate answers on supported application portals (such as Startup India SISFS, BIRAC, Y Combinator, Techstars, Workday, and Greenhouse) only when you initiate autofill. ApplyVault does not track your general browsing history or monitor unrelated web activity.
• Local Storage (storage): Saves your authentication session tokens, cached vault metadata, and extension UI preferences securely in your local browser storage (chrome.storage.local).
• Automated File Attachments (debugger, downloads): Used exclusively when you click “Attach Documents” to populate your uploaded vault files (e.g., pitch decks, DPIIT certificates, resumes) into file upload fields on forms where standard browser DOM DataTransfer is restricted. The debugger protocol is attached solely during the file insertion process and is immediately detached upon completion. Download history entries are erased immediately after insertion.
• No Remotely Hosted Code: All extension code and dependencies are bundled locally within the extension archive in strict compliance with Manifest V3. No remote scripts are evaluated or executed.
• Limited Use & No Data Sale: User data is never sold, leased, or transferred to third parties for advertising, creditworthiness evaluation, or lending. All data usage complies strictly with the Google Chrome Web Store User Data Policy.