Privacy Policy

Zappli Ltd is a company registered in England and Wales (company number 17506680) and the data controller for all personal data processed through zappli.co.uk and app.zappli.co.uk. References to "Zappli", "we", "us" or "our" in this policy refer to Zappli Ltd.

Our registered address and contact details for data protection enquiries are:

Zappli Ltd is registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC271367. We comply fully with the UK General Data Protection Regulation (UK GDPR) as retained in domestic law by the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 (DPA 2018).

The data we collect depends on how you use Zappli. Here is a full breakdown by category.

• Your name and email address when you create an account
• Your access tier (Free, or an active pass)
• Your job search preferences (role type, location, seniority), if you provide them
• Your career situation: a category you select (standard progression, career changer, gap in employment, or graduate) that we use to personalise your CV layout

• The CV documents you upload (PDF or DOCX format)
• The text content extracted from those documents for AI processing
• Job descriptions you paste or import for CV matching
• Cover letters generated on your behalf
• LinkedIn profile data, where you choose to import via our LinkedIn import feature
• Your application tracker records (roles applied to, dates, statuses)

• We use Stripe to process all payments. Zappli does not store card numbers, sort codes, or any payment card data. Stripe processes and stores this under their own privacy policy.
• We do retain your access tier, purchase date, and the date any pass expires. Nothing renews, so there is no renewal status to hold.

• Pages visited, features used, and time spent in the application
• Your IP address, browser type, and device type
• Error logs and crash reports
• Email engagement data via MailerLite (opens, clicks) where you have opted in to marketing

When you use the free ATS score without creating an account, we read your uploaded CV to generate your score. We do not keep the file itself. The text we read from it and your score are held for 24 hours after your last check, so that you can save them by creating an account, and are then permanently deleted. No account is created, no email address is collected, and nothing from your CV is kept after that window. If you choose to create an account during the session, your CV is then associated with that account and retained under the account data policy above.

Under UK GDPR, we must have a lawful basis for each type of processing. Here is what we rely on:

You can request deletion of your account and all associated personal data at any time by emailing privacy@zappli.co.uk. We will action deletion requests within 30 days.

We do not sell your data. We share it only with the third-party processors listed below, and only to the extent necessary to provide the service.

All processors are bound by data processing agreements. We do not share your data with any other party unless required to do so by law (for example, a valid court order or request from the ICO).

Some of our processors are based in the United States. Where we transfer personal data outside the UK, we ensure that adequate protections are in place as required by UK GDPR Chapter V:

• Anthropic (Claude API): transfers are made under the UK International Data Transfer Agreement (IDTA) or equivalent UK-approved safeguards. CV text sent to the Claude API is processed transiently and is not used to train Anthropic's models under our API agreement.
• Stripe: transfers are covered by Stripe's participation in the UK-US Data Bridge and standard contractual clauses.
• Clerk: transfers are made under standard contractual clauses with the UK International Data Transfer Addendum.
• Apify: where data is processed outside the UK, transfers are made under standard contractual clauses with the UK Addendum.
• Railway: transfers are made under standard contractual clauses.
• Resend: transfers are made under standard contractual clauses. Only the contents of a support message, your email address and our reply pass through Resend. Your CV is never sent to it.

Zappli uses AI extensively. We believe you have the right to understand exactly what that means for your data.

• Your CV text and any job description you provide are sent to the Claude API (Anthropic) to generate an ATS score, improvement suggestions, AI rewrites, and cover letters.
• The AI analyses the content of your CV (your employment history, skills, qualifications, and personal information included in the document) to produce this output.
• Your career situation (the stage you selected during onboarding) is used to determine the structural layout of your AI-generated CV.

• The AI does not make any final decisions about your job applications. All AI suggestions are presented for your review and approval. You decide what changes to accept.
• Your CV content is not used to train any AI model, either by Zappli or by Anthropic under our API agreement.
• The AI does not share your data with any employer or recruiter.

Zappli's ATS scoring produces an automated score. This score is informational: it does not affect your right to use the service, your access, or any decision made by an employer. It does not constitute automated decision-making with legal or similarly significant effects under Article 22 UK GDPR. You can always contact us to discuss your score or request a manual review of our methodology.

Under UK GDPR, you have the following rights. We take these seriously and will respond to all requests within one calendar month.

• Right of access: you can request a copy of all personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate data.
• Right to erasure: you can ask us to delete your data. We will do so within 30 days, subject to legal retention obligations (such as financial records).
• Right to restrict processing: you can ask us to pause processing of your data in certain circumstances.
• Right to data portability: you can request your data in a structured, machine-readable format.
• Right to object: you can object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent: where we process on the basis of consent (e.g. marketing emails), you can withdraw at any time via the unsubscribe link in any email or by contacting us directly.

To exercise any of these rights, email privacy@zappli.co.uk. We do not charge for these requests.

If you are unhappy with how we handle your request, please tell us first so we can put it right. See Complaints below, which also explains how to take it to the Information Commissioner's Office if you are still not satisfied.

Under the Data (Use and Access) Act 2025 we must handle data protection complaints ourselves first. If you are unhappy with how we have used your personal data, please tell us first. Email privacy@zappli.co.uk or use the contact form at zappli.co.uk/zappli-support. We will acknowledge your complaint within 30 days, keep you updated and tell you the outcome.

If you are still not satisfied, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Zappli uses a small set of cookies and browser storage. Most of it is strictly necessary: the service cannot work without it, so it is not something you can turn off and still sign in or get a score. One item, our own usage measurement, is optional and is only stored if you agree.

When you first arrive we ask. Choosing "Essential only" is exactly as quick as choosing "Accept all", and nothing optional is stored unless you accept. You can change your mind at any time using the Cookie settings link in the footer of every page.

zq_anon is a random identifier, not your name or email address. It is used only for statistics about our own service. It is never shared with advertisers and never used to track you on other websites. If you choose "Essential only", it is not stored at all.

We do not use Google Analytics, Meta Pixel, or any third-party advertising or cross-site tracking cookies on this site.

Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them. This happens as part of displaying the page and is not used by us to identify or track you.

To withdraw consent, use the Cookie settings link in the footer, or clear your browser storage for this site. You can also email privacy@zappli.co.uk.

Zappli is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us at privacy@zappli.co.uk and we will delete it promptly.

We may update this policy from time to time. Where changes are material (for example, new types of data collected or a new third-party processor), we will notify you by email at least 14 days before the changes take effect.

For minor changes (corrections, clarifications), we will update the "effective" date at the top of this page. The current version of this policy is always available at zappli.co.uk/privacy.