Privacy Policy

Last updated 31 August 2026

ApplyNorth submits job applications on your behalf. That means we handle personal information that goes to real employers under your name, so this page is specific about what we collect, where it goes, and what you can demand of us.

Who we are

ApplyNorth is run by Youssef Farhan in Longueuil, Quebec, Canada, who is also responsible for the protection of personal information. Reach him at privacy@applynorth.ca. Full postal address on request.

What we collect

• Account data: your email address. We do not store passwords. Sign-in uses a one-time emailed link.
• Job-search profile: name, phone, city and province, work authorization status, languages, target job titles, work-setup and employment-type preferences, minimum pay, LinkedIn URL, and any cover-letter notes you write.
• Your resume file. Stored encrypted, readable only by your account, and attached to the applications you approve. You can replace or delete it at any time from your profile. Deleting it removes the file from our database immediately.
• Application records: which jobs we applied to for you, when, the match score and reasons, and the answers submitted on each form.
• Saved answers: answers you give to employer screening questions, so you are not asked the same question twice.
• Billing data: your subscription tier and status. Card details are handled entirely by Stripe and never reach our servers.
• Technical data: IP address and request timing, used only for rate limiting and abuse prevention.

Why we collect it, and your consent

We use this information for one purpose: to find Canadian job postings you qualify for and submit applications to them on your behalf. Creating a profile and enabling auto-apply is your express consent to send applications in your name. You can withdraw that consent at any time by turning auto-apply off, which stops all sending immediately.

Work authorization is collected because employers screen on it and because answering it wrongly would misrepresent you. We never guess it, and we never answer a question about authorization in a country other than the one you told us about.

We do not sell your personal information, and we do not use it to train AI models.

Who we share it with

• Employers you apply to. This is the core of the service: your name, contact details, resume, cover letter and screening answers go to the employer whose job you applied for. Once sent, that employer controls the copy they hold, under their own privacy policy.
• Stripe: payment processing.
• Amazon SES: sending sign-in links and applications by email, from Montreal.
• Our hosting and database providers : to run the service.

Where your data is stored. Your account, your resume and your application history are stored in Canada, on servers in Montreal (Oracle Cloud, Canada Southeast). The code that runs the website runs in Montreal too (Vercel, yul1), and our email is sent from Montreal (Amazon SES, Canada Central). Some of our other providers do process data outside Canada: Stripe handles payments in the United States, and the advertising cookie you can refuse sends data to Meta there. Our Canadian-region providers are also American companies, so United States law may reach them even for data held here. While your information is outside Canada, or held by a company subject to another country's law, foreign courts and authorities may be able to compel access to it. By using ApplyNorth you consent to that transfer.

How we protect it

• All traffic is encrypted in transit with HTTPS, enforced by HSTS.
• Your resume file, phone number and LinkedIn URL are encrypted at rest with AES-256-GCM, so a stolen database dump does not expose them.
• Sessions use signed, HTTP-only, same-site cookies that JavaScript cannot read. Sign-in tokens are hashed before storage, single-use, and expire in 15 minutes.
• Every query is scoped to your account server-side. Access is never decided by the browser.
• Sign-in is rate limited per IP address and per email address.

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you, the Office of the Privacy Commissioner of Canada, and the Commission d'accès à l'information du Québec, as the law requires.

How long we keep it

• Active accounts: as long as your account exists.
• After you delete your account: everything goes at once: profile, saved answers, and the record of what was applied for. There is no waiting period and no archive.
• Free-trial record: if you used any of the five free applications, we keep a one-way scrambled form of your email address and the number you used, never the address itself, and nothing that can be turned back into it. It outlives your account on purpose: without it, deleting and re-registering would hand out the free applications again and again. Kept for 24 months.
• Billing records: kept 7 years, as Canadian tax law requires.

Your rights

Under PIPEDA and, in Quebec, Law 25, you can:

• Access a copy of everything we hold about you, in a portable format: download it from your profile page
• Correct anything inaccurate
• Withdraw consent and stop all applications immediately
• Delete your account and personal information
• Ask how any automated decision about you was made
• Complain to the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec

Email privacy@applynorth.ca and we will respond within 30 days.

Automated matching

Which jobs we apply to is decided by an automated scoring system using the profile you gave us. It is not a decision about you by an employer; it only chooses where to apply. Every application in your dashboard shows the exact reasons it was selected, and you can turn auto-apply off at any time.

Cookies

We set three strictly necessary cookies: your sign-in session, the language you chose, and a short-lived one while you sign in on a second device. None of them needs consent.

We also ask permission for one advertising cookie from Meta, which we use to measure our own ads. We ask before it is set, nothing loads unless you say yes, and refusing changes nothing about how the service works. It sends data to Meta in the United States, where it is subject to US law. Your answer is remembered for a year in a fourth cookie, and you can change it here at any time.

Children

ApplyNorth is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we make a material change we will email you before it takes effect. This policy was last updated on 31 August 2026.