Privacy Policy

Symphonee is the controller for personal data we collect directly for our website, account administration, billing, security, support, and marketing. When a customer uploads or creates candidate, contact, client, job, message, note, CV, transcript, or similar workspace data, including applications submitted to its roles through Symphonee Jobs, Symphonee processes that data as the customer's processor and follows the customer's lawful instructions. For applications to Symphonee's own roles, Symphonee is the controller. Apply by Symphonee AI keeps your information on your computer and does not send it to Symphonee; Symphonee is the controller for the support emails you send us about Apply.

This policy covers symphonee.ai, the public site, the application workspace, Symphonee Jobs at jobs.symphonee.ai, the Harmony by Symphonee AI browser extension, the Apply by Symphonee AI Chrome extension and its dashboard at apply.symphonee.ai, API routes, support interactions, email and calendar integrations, billing, and operational logs. The next section describes Apply in detail. This policy does not cover third-party websites or services that you open from Symphonee or Apply, such as job sites, employers' application systems and the AI provider you choose in Apply, or the privacy practices of customers who decide what data to place in their workspaces.

Apply by Symphonee AI ("Apply") is a Chrome extension for job seekers. It works without an account and keeps your information in Chrome on your computer, where Symphonee cannot see it: your career record (your names, contact details, work history, education, skills and the other details you add), your application profiles, the CVs you import and the CVs and cover letters Apply prepares, the job postings it reads, an exact copy of each application you send with its status and your notes, your settings, and any AI provider API keys you add. This information comes from what you type, the CVs you import, and the job postings and application forms on the pages where you use Apply.

Apply reads a page when you use it there: when you click its toolbar button, choose one of its right-click menu items or press its fill shortcut, and on the job sites and careers sites you have allowed. It asks Chrome for access to each site when you turn a feature on, never at installation, and it shows on LinkedIn and Indeed pages and fills forms there only after you turn it on for that site. It reads the job posting and the application form on the page. On a form it filled, it notes your own click on the form's submit button and reads back the form's values at that moment, so it can keep a copy of what you sent. It does not read your other tabs, browsing history, cookies or saved passwords, it does not record keystrokes, mouse movements or scrolling, and it never fills sign-in or password fields.

If you choose to save them, Apply keeps equal-opportunity and self-identification answers (such as gender, ethnicity, veteran status, disability and sexual orientation) and the other answers it treats as sensitive (date of birth, criminal record, security clearance, citizenship or permanent residence) sealed on your computer, as it does your API keys. Sensitive answers are never sent to an AI provider or to Symphonee, and they are left out of exports unless you choose to include them. An answer other than "Decline to answer" goes into an application form after you confirm it on that application.

Information leaves your computer when you send it. Apply fills application forms with the profile you choose, and the employer and its application system receive the details when you submit the form yourself, under their own privacy policies. Apply never submits a form for you, and some sites save a form's contents as it is filled in.

AI is optional. Chrome's built-in AI runs on your computer, and with your own chat assistant you copy Apply's request and paste it there yourself, so Apply sends nothing in either case. With your own API key from OpenAI, Anthropic or Google Gemini, Apply sends a request straight from your computer to that provider when you start one, and before the first request to a provider it shows you what it sends and asks you to agree. To tailor a CV or draft a cover letter or answer, a request contains the job's title, company and description, the parts of your career record that the chosen profile includes, the profile's name, preferred work arrangement, target roles and tailoring guidance and, for an answer, the form's question. Your contact details, legal name, pronouns, saved answers and sensitive answers are left out, and work authorization or pay are included when you add them to that request. To read a CV you import, a request contains the CV's text, which can include your name and contact details, after Apply removes lines such as date of birth, nationality, visa, work permit and salary. The provider processes your requests under your own agreement with it. If a Gemini key is on Google's free tier, Google may use what you send to improve its products, and Apply tells you so when you add the key.

The dashboard at apply.symphonee.ai is a page in your browser that shows and changes what Apply keeps by talking to the extension through Chrome. Apart from loading its own files, it makes no network connections, so what it shows stays in your browser, and it never receives your sensitive answers or API keys. Apply contains no ads, analytics, telemetry or crash reporting. Symphonee accounts and Apply Pro are not available yet: Apply sends nothing to Symphonee and makes no request to a payment provider. If they open, we will update this policy first, and Apply will show what each feature sends and ask you before it sends anything.

When you write to support from Apply, we receive your email address and your message. The draft that Apply's help button opens includes Apply's version and your browser's details, which you can remove before you send it.

We collect account data such as name, work email, role, organization, login credentials, workspace settings, language, and support messages. Customers may add recruiting data such as candidate and contact profiles, work history, skills, notes, pipeline stages, communications, CVs, transcripts, client accounts, jobs, feedback, billing records, and consent or deletion requests. We also collect operational data such as IP address, device and browser details, log events, product usage, security events, payment metadata, and email or calendar metadata needed to operate connected features. Apply by Symphonee AI keeps the information described in the section above on your computer; Symphonee does not collect it, apart from the support emails you send us.

Data may come from you, your teammates, workspace administrators, candidates or clients who interact with shared links or self-service forms, people who apply to roles through Symphonee Jobs and the people workspace members refer to those roles, connected Google and Microsoft accounts, an organization's single sign-on provider, the Harmony by Symphonee AI browser extension, imported files, public professional sources, and customer-authorized enrichment providers. Payment data is processed by Stripe and we receive only the transaction and subscription information needed to manage billing.

Harmony by Symphonee AI, our browser extension for recruiters, works with the signed-in user's Symphonee workspace and sends data to no other service. While a user is signed in, it checks the LinkedIn profile, company and job pages they open, and the person in an open LinkedIn conversation, against their workspace, adds the LinkedIn profiles, companies and jobs they view to their recent records, and uses the address of a Google Meet, Microsoft Teams or Zoom call they open to load a brief for it. It sends profiles, companies and jobs, including the contact details LinkedIn shows on a profile, when the user imports or refreshes them, and the instructions they write when they draft outreach. On a call, after the user confirms that everyone agreed, it reads the visible captions with the speakers' names and saves the transcript to the workspace when they stop; it does not record audio. It keeps the user's session, and any caption transcript not yet saved, in the browser.

We use personal data to provide and secure the service, authenticate users, maintain workspaces, run recruiting workflows, process imports and CVs, send notifications, support email and calendar integrations, prepare AI-assisted suggestions inside the customer's own workspace, process payments, provide support, prevent abuse, analyze reliability, enforce our terms, and comply with legal, tax, accounting, and security obligations. Apply by Symphonee AI uses the information it keeps on your computer to provide its features, such as filling application forms, preparing CVs, cover letters and answers, and keeping your application history, and we use the support emails you send us to answer them.

For data where Symphonee is controller, we rely on contract performance, legitimate interests in operating and securing a business SaaS product, compliance with legal obligations, and consent where required, such as optional marketing or certain cookies. For customer-controlled workspace data, the customer determines the lawful basis for collection and use, and Symphonee processes the data as processor under the customer's instructions.

Symphonee uses AI to help recruiters summarize records, classify updates, draft outreach, evaluate role fit, including for applications received through Symphonee Jobs, and surface suggested next actions. Production AI requests are routed through vetted zero-retention inference infrastructure: prompts and outputs are not stored by the provider and are never used to train shared models. Symphonee does not use customer-controlled workspace data to train shared external models. AI output is assistive and customers remain responsible for human review, hiring decisions, outreach, and legal compliance.

Apply by Symphonee AI uses no Symphonee AI. You choose whether to use AI at all: Chrome's built-in AI on your computer, a request you copy into your own chat assistant, or your own API key from OpenAI, Anthropic or Google Gemini, in which case Apply sends the request from your computer straight to that provider under your agreement with it. Equal-opportunity and other sensitive answers are never sent to an AI provider. What Apply drafts with AI is a suggestion for you to review, and you submit every application yourself.

We share personal data only as needed to operate Symphonee: with service providers and subprocessors, with integrations enabled by the customer, with workspace users according to their permissions, with professional advisers, auditors, or authorities when required by law, and as part of a merger, acquisition, financing, or sale of assets if appropriate protections are in place. We do not sell personal data or use customer workspace data for cross-context behavioral advertising.

Apply by Symphonee AI shares nothing with Symphonee. Information leaves your computer when you submit an application form to an employer or start a request with the AI provider you chose, and each of them handles it under its own terms with you.

Our Chrome extensions, Harmony by Symphonee AI and Apply by Symphonee AI, use the information they handle to provide and improve the features described in this policy. The use of information received by Harmony and Apply adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell that information, use or transfer it for personalized advertising, transfer it to advertising platforms, data brokers or other information resellers, or use it to determine creditworthiness or for lending. We transfer it only as needed to provide or improve those features, to comply with applicable law, to protect against malware, spam, phishing or other fraud or abuse, or as part of a merger, acquisition or sale of assets with your prior consent. Our staff do not read it unless you give explicit permission for specific data, it is needed for security purposes such as investigating abuse, the law requires it, or it is aggregated and anonymized for internal operations.

Current subprocessors include DigitalOcean for EU cloud hosting in Frankfurt, managed MongoDB, managed Valkey, and serverless AI inference under zero-retention, no-training terms; Cloudflare for authoritative DNS, traffic proxying, TLS, and edge security, and for serving the apply.symphonee.ai pages; Resend for email delivery in the US; Coresignal for customer-authorized talent data enrichment in Lithuania; FullEnrich for customer-authorized contact enrichment in France; Stripe for payments in the US; Clerk for enterprise single sign-on and directory sync in the US, for organizations that turn them on; Simple Analytics for cookieless visit statistics on symphonee.ai in the Netherlands; and Google and Microsoft for sign-in with a Google or Microsoft account and for the mail and calendar features a user connects from that account. The application also shows company logos from logo.dev and Clearbit and maps and place lookups from OpenStreetMap, which receive company domains or place names, and the IP address of the browser that loads them. We maintain a data map and subprocessor register and notify customers ahead of material changes where required.

Apart from Cloudflare serving the dashboard pages at apply.symphonee.ai, Apply by Symphonee AI uses no subprocessors. The employers and job sites you submit applications to, and the AI provider you choose, receive information under their own terms with you.

Symphonee is based in Luxembourg and its primary workspace compute and storage are hosted in DigitalOcean's Frankfurt, Germany region. Cloudflare manages authoritative DNS and proxies public application traffic at the edge. Some providers, including the separately described serverless inference service, may process data in the US or other countries listed in the subprocessor section; where required, we rely on data-processing agreements, standard contractual clauses, adequacy decisions, and provider security commitments. Apply by Symphonee AI does not transfer your information to Symphonee; if you use your own AI provider, it may process your requests in the US or elsewhere under its terms with you.

We keep customer workspace data for as long as the workspace is active. When a subscription ends, the workspace owner can reactivate it or export the workspace data for 30 days, or another period agreed with the customer, and we email the owner at least seven days before deletion. After that, workspace data is deleted from production systems, unless a longer period is required by law or agreed with the customer, and backups age out on a rolling cycle. Security logs, billing records, audit trails, and aggregated non-identifying metrics may be kept longer where needed for security, accounting, dispute resolution, or legal compliance.

Apply by Symphonee AI keeps its information on your computer until you change or delete it, use Delete everything in Apply's settings, or remove Apply from Chrome, and it never deletes your information to fit a storage limit. We hold no copy, so we cannot restore what you delete. What you send to an AI provider is kept under that provider's terms.

Depending on where you live, including in the EU and UK, you may request access, correction, deletion, restriction, portability, objection to certain processing, or withdrawal of consent. Workspace users can update many account details directly. Candidates and contacts can write to [email protected]. If your data was added by a Symphonee customer, we may need to refer the request to that customer because they control the workspace data. You may also lodge a complaint with the Luxembourg Commission nationale pour la protection des données, or your local data-protection authority.

If you use Apply by Symphonee AI, you can see, correct, export and delete your information in Apply yourself at any time, with Export everything and Delete everything under Settings, Data and privacy. Because we hold no copy, we cannot do this for you. For information we do hold about you, such as your support emails, write to [email protected].

We use technical and organizational safeguards designed for a recruiting workspace, including role-based access, organization scoping, encryption in transit and at rest where supported by our infrastructure, session controls, audit trails, restricted production access, validation at system boundaries, and monitored subprocessors. No online service can be guaranteed perfectly secure, so customers should use strong passwords, manage seats carefully, and notify us promptly of suspected unauthorized access. Apply by Symphonee AI seals sensitive answers and API keys with AES-256-GCM encryption under a key that is created on your computer and never leaves it, sends its requests over encrypted connections, and loads no code from the internet. Encryption in the browser does not protect against someone who can use your computer and Chrome profile, so keep your computer locked and store exports safely.

We use necessary cookies and similar technologies to operate the site and application, remember settings, authenticate sessions, measure reliability, and protect against abuse. Cloudflare may set a short-lived security cookie on our sites. On symphonee.ai, a language cookie is set when you choose a language, and Simple Analytics counts visits without cookies and without storing IP addresses. The application uses session and sign-in cookies, and Stripe sets its own cookies when its payment form is shown. Symphonee Jobs sets no cookies of its own, and Apply by Symphonee AI contains no ads, analytics, telemetry or crash reporting. We may use optional analytics or marketing tools only where permitted by law and applicable consent settings. You can control cookies through your browser and any consent controls we provide.

We may update this Privacy Policy to reflect product, legal, or operational changes. When we do, we will update the date above and, where a change is material, provide additional notice through the website, application, email, or another reasonable channel. If a change affects what Apply by Symphonee AI sends or who receives it, Apply shows you the new notice and asks you again before it sends anything under the change.

Email [email protected] for privacy requests, security questions relating to personal data, or subprocessor information. For help with Apply by Symphonee AI, email [email protected].