Privacy notice
Last updated: Version 2026-11
The short version
- Aplara is run by Splice Engineering Limited. We are responsible for your personal data.
- We use what you tell us about your experience only to help you with your job applications.
- We use AI from OpenAI to analyse your CV and help you write. OpenAI doesn't train its models on your content.
- We don't sell your data, show you ads, or use your content to make decisions about you.
- You can download or delete your data at any time in Settings.
1. Who we are
Aplara is a service of Splice Engineering Limited, trading as Aplara, a company registered in England and Wales (company number 08179062), registered office 3 Bickerton Close, Birchwood, Warrington, England, WA3 6LS. Our registration with the Information Commissioner's Office (ICO) as a data controller is in progress.
Contact us about privacy at privacy@aplara.com.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored scrambled), sign-in method, security settings and the link you used to sign up (for example a society's link) | You, or Google if you sign in with Google |
| Your experience and CVs | Uploaded CV files, education, jobs, projects, skills, achievements | You |
| Your applications | Job adverts you add, application questions, answers, cover letters, interview notes, chat with Ask Aplara | You, and job adverts you ask us to fetch |
| Payment and subscription details | Plan, billing dates, payment status, billing country, the last four digits and country of your card | Stripe, our payment provider. We never see your full card number. |
| Eligibility confirmations | That you are 18 or over and in the UK | You, at sign-up and checkout |
| Usage and security records | Features used and how often, allowance counts, sign-in times, IP address, browser type, error reports (without your content) | Your use of Aplara |
| Messages to us | Support requests, feedback, complaints | You |
| Waitlist | Email address, the date you joined, how you found us and who invited you | You |
| Business contacts | Name, work email, job title and organisation of people at universities, societies and partners we contact or work with | Public websites, or you |
3. How we use it and why the law allows it
| What we do | Our legal basis |
|---|---|
| Create and run your account, store your experience and CVs, analyse your CV, and help you write applications | Contract: we need it to provide the service you signed up for |
| Process sensitive details you choose to include (see section 4) | Your explicit consent |
| Take payments, manage your subscription and refunds, and check the service is only sold to adults in the UK | Contract |
| Keep billing and tax records | Legal obligation |
| Send service emails: sign-in links, receipts, renewal notices, changes to terms, security alerts | Contract and legal obligation |
| Keep Aplara secure: scan uploads for viruses, block bots, limit misuse, keep security logs and backups | Legitimate interests: protecting you, other users and Aplara |
| Understand which features are used and which links bring people to Aplara, using counts and statistics, not your content | Legitimate interests: improving Aplara |
| Send waitlist and product news emails | Your consent. Every email has an unsubscribe link. |
| Answer your messages and complaints | Legitimate interests, or legal obligation for data protection complaints |
| Contact universities, societies and partners about Aplara | Legitimate interests |
We don't read your CVs or writing unless you ask us to (for example, in a support request) or we need to investigate a security problem.
4. Sensitive details
Some information has extra protection in law: details about your health or a disability, ethnic origin, religion or beliefs, sexual orientation, political views, trade union membership or genetic or biometric data, and criminal records. Aplara doesn't need any of these, and we suggest you leave them out.
If you include them in a CV or in something you write, we ask for your explicit consent first. We then use them only to provide Aplara to you, in the same way as the rest of your content. You can withdraw consent at any time in Settings; because we can't reliably separate sensitive details from the rest of your writing, withdrawing deletes your uploaded CVs and written content. You can instead delete just the item that contains the details.
Please don't include sensitive details about other people.
5. How we use AI
When you ask Aplara to analyse a CV, draft an answer, write a cover letter or prepare for an interview, the relevant parts of your content are sent to OpenAI to generate a result. OpenAI acts on our instructions as our processor. Under our agreement it does not use your content to train its models. It may keep requests for up to 30 days to detect abuse, then deletes them.
AI can make mistakes. Aplara is designed to use only facts from your own experience, but you should always check what it produces before you send it.
Aplara does not make decisions about you that have legal or similarly significant effects. It helps you prepare applications; you and employers make the decisions.
6. Who we share it with
We use the service providers below to run Aplara. They act on our instructions under written contracts and may not use your data for their own purposes, except where noted.
| Provider | What it does for us | Data involved |
|---|---|---|
| Supabase | Database, file storage and sign-in (London region) | All account data and content |
| Cloudflare | Runs the Aplara website and app, the bot check on forms, and encrypted nightly backups of uploaded CVs (EU) | All data as it passes through; backed-up CV files |
| OpenAI | AI analysis and writing | The content needed for each request |
| Scanii | Virus scanning of uploaded files (London region) | Uploaded files, scanned then deleted |
| Resend | Sending emails | Email address and the email's text; never your CV or applications |
| Stripe | Payments and subscriptions | Payment, billing and subscription details |
| Optional sign-in with Google | Your name and email address |
Stripe and Google also act as independent controllers for some purposes, such as fraud prevention and running your Google account; their own privacy notices apply.
We will share data with the police, courts or regulators only when the law requires it. If Aplara is ever sold, your data would pass to the buyer under this notice, and we would tell you first.
7. International transfers
We store your account and content in the UK, and keep encrypted backups of uploaded CVs in the EU. Some providers may access or process data outside the UK: OpenAI and Resend in the United States; Stripe in Ireland and the United States; Supabase (a Singapore company) and Cloudflare, whose staff and networks are international; and Cloudflare may process a request at whichever of its data centres receives it. Where data leaves the UK, it is protected by UK-approved safeguards: the UK Extension to the EU-US Data Privacy Framework, or the ICO's International Data Transfer Addendum to the EU standard contractual clauses. Contact us for a copy of the relevant safeguard.
8. How long we keep it
| Data | How long |
|---|---|
| Your content (CVs, experience, applications, chat) | Until you delete it or close your account |
| Free accounts not used for 24 months | Deleted, after a warning email 30 days before |
| Backups | Overwritten within 35 days |
| Payment and tax records | 6 years after the payment, as tax law requires |
| Records of the consents you gave and the terms you accepted, and deletion receipts | 6 years after your account closes, linked only to a scrambled form of your email address, so we can show what you agreed to if there's a complaint or dispute |
| Security logs | Records used to limit repeated attempts: 48 hours. Other security records (blocked attempts, sign-in failures, admin actions, virus-scan results): 12 months |
| Waitlist email | Deleted within 30 days of you unsubscribing or asking us to, and by 1 December 2027 at the latest |
| Business contacts | 2 years after our last contact, or sooner if you ask |
9. Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to you in a reusable format. You can object to our use of it for legitimate interests, and withdraw any consent. Most of this you can do yourself in Settings: Download my data, and Delete account. Otherwise email privacy@aplara.com. We reply within one month.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at privacy@aplara.com or complaints@aplara.com. You don't need to use any particular words. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.
You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.
11. Age
Aplara is for adults aged 18 and over. We don't knowingly collect data from anyone younger. If you think a child has used Aplara, contact us and we will delete their account.
12. Cookies
We use only the cookies and similar storage needed for Aplara to work: keeping you signed in, the bot check on forms, and payments through Stripe. We don't use advertising or tracking cookies.
13. Changes to this notice
We will post any change here with a new date. If a change is significant, we will email you before it takes effect.