Privacy Policy

1. Who is responsible

Blindspot Studio LLC, a Wyoming limited liability company (“we”, “us”), operates proapply.co (the “Service”) and is the controller of your personal data. Contact: hello@proapply.co.

2. What data we collect

2.1 Data you give us, or ask us to fetch

• Your LinkedIn profile. When you search for your name or give us your profile URL, we look up matching public profiles and, once you pick yours, import the publicly visible content: name, headline, location, experience, education, skills, and profile photo.
• Your documents — the resumes and cover letters we generate, and everything you add or edit in them.
• Your photo — your LinkedIn photo or one you upload, and the retouched headshot we produce from it.
• Job postings you point us at, to tailor a document to them.
• Your email address, when you provide it.
• Messages you send us, attachments included.

2.2 Data we collect automatically

• How you found us — the referring page and any campaign parameters in the link you clicked, including an advertising click identifier when there is one.
• Browser and device data — browser, operating system, device type, approximate country (from your IP address, using IP Geolocation by DB-IP), and the IP address of sign-in sessions.
• Usage data — which screens you saw and which options you chose.
• Subscription and transaction data — your plan, amounts, dates, renewals, cancellations, refunds, and payment references. Card details go directly to Whop; we never receive the full card number.
• Cookies and similar technologies, as described in our Cookie Policy.

3. Why we process it

• To provide the Service — import your profile, generate and tailor your resumes and cover letters, retouch your photo, let you sign back in, and fix errors.
• To run your subscription — take payments, renewals and refunds through Whop, and tell you about them.
• To analyse and improve the Service — understand which screens work and which lose people.
• To send reminders. If you leave your email address and do not subscribe, we may send you at most two emails: one shortly after, and one later with a reduced price. Nothing else — no newsletter, no sequence. Every such email has an unsubscribe link and the one-click unsubscribe header your mail app understands. Unsubscribing stops these reminders only; sign-in links, subscription emails and replies to your own messages still work.
• To measure our advertising, as described in section 5.
• To enforce our Terms, prevent fraud, and comply with the law, including responding to lawful requests from authorities.

Your photo is used only to produce your headshot and to appear on your documents. We do not use it, or anything derived from it, to identify you or to build a face template or any other biometric identifier.

We do not sell your personal data, and we make no automated decision about you with legal or similarly significant effects.

4. Legal basis (EEA and UK)

• Performance of a contract — providing the Service, running your subscription, communicating with you about it.
• Consent — importing the LinkedIn profile you choose, and processing your photo. You withdraw it by asking us to delete them.
• Legitimate interests — analysing and improving the Service, keeping it secure, measuring our advertising, and sending the reminders described above, in a measured way and with an easy way out. Where your jurisdiction requires it, we rely on consent instead.
• Legal obligation — keeping transaction records, answering lawful requests.

5. Who we share it with

We share personal data with providers that operate parts of the Service on our instructions, and only for the purposes above:

• hosting and database providers (Vercel, DigitalOcean, Supabase);
• Whop, our payment processor and merchant of record, which processes your payments and renewals and sends your receipts. As merchant of record, Whop also processes payment data for its own legal and anti-fraud obligations, under its own privacy policy;
• our email delivery provider (Resend), for the emails we send and receive;
• our product analytics provider (Mixpanel), which receives the screens you saw, the options you chose, your payment amounts and, once you have given it, your email address;
• an AI provider (OpenAI), which receives your profile, your documents and the job postings to generate text, and your photo to retouch it. Data sent through their API is not used to train their models;
• profile lookup and web providers (Apify, Serper), which search for and fetch the public LinkedIn profile you choose and the job postings you point us at;
• LinkedIn, for advertising measurement, when it is enabled: LinkedIn receives confirmation that you selected a profile, submitted an email or subscribed, plus the payment amount and currency. Server-side matching uses a SHA-256 hash of your email and/or the LinkedIn ad click identifier when available. Hashing does not make this data anonymous. We never send LinkedIn your documents, photo, or profile content. Under some US state laws this may count as “sharing” for advertising; you can opt out as described in section 8.

We may also disclose data to public authorities when the law requires it, and to a successor in the event of a merger, acquisition, or sale of assets.

6. International transfers

We and our providers are located in the United States. If you are in the EEA, the UK, or another country that restricts transfers, your data is transferred there under the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

7. How long we keep it

We keep your data until you ask us to delete it, so that your documents, history and subscription stay available when you come back. Transaction records are kept for as long as tax and accounting rules require, even after everything else is deleted. When you ask us to delete your data, we do so within thirty days, subject to that exception.

8. Your rights and choices

You can ask us to access, correct, delete, or export your personal data, to restrict or object to a particular use, and to withdraw consent where consent is the basis. Write to hello@proapply.co; we answer within thirty days. If you are in the EEA or the UK, you may also complain to your local data protection authority. You may act through an authorised agent, in which case we will verify their authority before responding.

Opting out of advertising measurement. If your browser sends the Global Privacy Control signal, we honour it automatically: we send nothing about you to advertising platforms. You can also opt out by writing to us.

US state privacy rights. Residents of California and other states with privacy laws have the right to know what personal information we collect and how we use it, to access, correct and delete it, to opt out of its sale or sharing for advertising — we do not sell it, and the opt-out above covers sharing — and not to be discriminated against for exercising these rights.

9. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, passwordless sign-in, and access limited to those who need it. No method of transmission or storage is completely secure.

10. Age limitation

The Service is not directed at anyone under 18. We do not knowingly collect data from minors; if you believe we have, contact us and we will delete it.

11. Do Not Track

We do not respond to browser “Do Not Track” signals, which have no common standard. We do honour Global Privacy Control, as described in section 8.

12. Changes

We may update this policy. The date at the top changes when we do, and material changes are announced on the Service or by email. Continued use after the effective date means you accept the revised policy.

13. Contact

Blindspot Studio LLC — hello@proapply.co.