Privacy Policy

Last updated 20 August 2026

ApplyNorth submits job applications on your behalf. That means we handle personal information that goes to real employers under your name, so this page is specific about what we collect, where it goes, and what you can demand of us.

Who we are

ApplyNorth is run by Youssef Farhan in Longueuil, Quebec, Canada, who is also responsible for the protection of personal information. Reach him at privacy@applynorth.ca. Full postal address on request.

What we collect

• Account data: your email address. We do not store passwords. Sign-in uses a one-time emailed link.
• Job-search profile: name, phone, city and province, work authorization status, languages, target job titles, work-setup and employment-type preferences, minimum pay, LinkedIn URL, and any cover-letter notes you write.
• Your resume file. Stored encrypted, readable only by your account, and attached to the applications you approve. You can replace or delete it at any time from your profile. Deleting it removes the file from our database immediately.
• Application records: which jobs we applied to for you, when, the match score and reasons, and the answers submitted on each form.
• Saved answers: answers you give to employer screening questions, so you are not asked the same question twice.
• Billing data: your subscription tier and status. Card details are handled entirely by Stripe and never reach our servers.
• Technical data: IP address and request timing, used only for rate limiting and abuse prevention.

Why we collect it, and your consent

We use this information for one purpose: to find Canadian job postings you qualify for and submit applications to them on your behalf. Creating a profile and enabling auto-apply is your express consent to send applications in your name. You can withdraw that consent at any time by turning auto-apply off, which stops all sending immediately.

Work authorization is collected because employers screen on it and because answering it wrongly would misrepresent you. We never guess it, and we never answer a question about authorization in a country other than the one you told us about.

We do not sell your personal information, and we do not use it to train AI models.

Who we share it with

• Employers you apply to. This is the core of the service: your name, contact details, resume, cover letter and screening answers go to the employer whose job you applied for. Once sent, that employer controls the copy they hold, under their own privacy policy.
• Stripe: payment processing.
• Resend: sending sign-in links and applications by email.
• Our hosting and database providers : to run the service.

Where your data is stored. Our database is hosted in the United States (Neon, AWS US East), and our email provider sends from the same region. Some of our other providers also process data outside Canada. While your information is outside Canada it is subject to the laws of that country, and foreign courts and authorities may be able to compel access to it. By using ApplyNorth you consent to that transfer.

How we protect it

• All traffic is encrypted in transit with HTTPS, enforced by HSTS.
• Your resume file, phone number and LinkedIn URL are encrypted at rest with AES-256-GCM, so a stolen database dump does not expose them.
• Sessions use signed, HTTP-only, same-site cookies that JavaScript cannot read. Sign-in tokens are hashed before storage, single-use, and expire in 15 minutes.
• Every query is scoped to your account server-side. Access is never decided by the browser.
• Sign-in is rate limited per IP address and per email address.

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you, the Office of the Privacy Commissioner of Canada, and the Commission d'accès à l'information du Québec, as the law requires.

How long we keep it

• Active accounts: as long as your account exists.
• After you delete your account: profile and saved answers are erased within 30 days.
• Application records: kept for 24 months so you have a record of where you applied, then deleted.
• Billing records: kept 7 years, as Canadian tax law requires.

Your rights

Under PIPEDA and, in Quebec, Law 25, you can:

• Access a copy of everything we hold about you, in a portable format
• Correct anything inaccurate
• Withdraw consent and stop all applications immediately
• Delete your account and personal information
• Ask how any automated decision about you was made
• Complain to the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec

Email privacy@applynorth.ca and we will respond within 30 days.

Automated matching

Which jobs we apply to is decided by an automated scoring system using the profile you gave us. It is not a decision about you by an employer; it only chooses where to apply. Every application in your dashboard shows the exact reasons it was selected, and you can turn auto-apply off at any time.

Cookies

We set one cookie: your sign-in session. It is strictly necessary to keep you logged in, so it needs no consent banner. We use no advertising or third-party tracking cookies.

Children

ApplyNorth is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we make a material change we will email you before it takes effect. This policy was last updated on 20 August 2026.