Privacy policy

Who is responsible

Aptivelle is operated by Raphael Oche Adole, sole trader, ABN: not yet registered. Privacy enquiries: ocheadole1@gmail.com. This draft follows Australian Privacy Principles-style disclosures; applicability and compliance require legal review.

Information we collect

We collect account email, career facts, uploaded and Resume Vault originals, job preferences, pasted job ads, discoveries and match estimates, tailoring inputs and document versions, application tracking notes and contacts, interview answers, application modes, consent evidence and activity records, and contact messages that you provide. Authentication is managed by Lovable Cloud; Aptivelle does not keep a separate password database.

Provide only information you are authorised to share. Avoid unnecessary sensitive information, identity documents, licence numbers and third-party personal information.

Why we use information

We use information to operate your private workspace, import and organise career evidence, create and assess documents, analyse job requirements, support written interview practice, respond to enquiries, maintain security and record operation usage and costs. Without relevant information, some functions cannot operate. We do not automatically apply to jobs or fetch your application links.

Providers and overseas processing

Lovable Cloud provides hosting, database, authentication, auth email and private file storage. It receives account information, career records, originals, generated files, jobs, settings, consent and activity needed to operate the workspace. Lovable AI processes discovery explanations through its gateway; the configured model is from OpenAI. OpenAI also processes submitted text for import, generation, tailoring, analysis and verification. Requests contain the evidence and job information needed for that operation; import necessarily processes the uploaded text. Processing may occur overseas; Australian-only hosting is not promised.

OpenAI Responses requests send store: false, including discovery requests through Lovable AI. This disables stored responses; it does not mean zero retention. OpenAI’s standard API abuse-monitoring retention can be up to 30 days, with endpoint-specific exceptions. Provider retention is separate from deletion of Aptivelle records.

Job discovery currently uses jobs you paste or save. The Australia-only Adzuna adapter is disabled and not connected; no search is sent to it today. Employer and other licensed-feed adapters are unconnected placeholders. No supported real submission integration is connected; Authorised AutoApply remains locked.

Stripe is configured for internal test billing through Lovable’s connector, receiving test customer, email and subscription details when authorised testing occurs. Checkout and the subscription portal are paused for this free beta; Plus and Pro are not available for purchase. No real payment is enabled.

Lovable documents daily database backups retained for up to roughly 14 days. These cover database records, not files in storage buckets. Live-system deletion does not erase an earlier backup immediately; database backup expiry and provider retention are separate.

Security and browser preferences

Ownership-based access rules protect account records. Documents use private storage with expiring signed links. Privileged operations and AI credentials stay server-side. These controls do not eliminate all security risk.

Browser storage holds your sign-in session and selected preferences, including theme and tracker view. This draft does not claim that browser storage is cookie-free or that essential authentication is optional. No marketing analytics integration has been added.

Access, correction and export

Export includes account-linked records and uploaded and generated files, with up to 3 account exports per rolling 24 hours and a 60-second download link. Export archives expire after 24 hours. An hourly cleanup job is configured to remove expired archives, targeting removal within about 25 hours under normal operation. Automatic delivery on the published site has not yet been verified. Failed cleanup is retryable; outages may delay deletion. Download-link expiry does not delete the archive.

Correct facts in your career profile or Evidence Library and edit other records in their respective screens. For assistance accessing or correcting information, contact ocheadole1@gmail.com. Identity checks may be required.

Deletion and retention

Account deletion requires password confirmation and typing DELETE. Verified requests start immediately, targeting removal from live systems within 7 days. Private files and account-linked records, including submitted applications, are removed. Minimal consent evidence is retained separately under the consent policy; usage cost records remain without your account identifier until their retention expires. A partial failure may remove some data; retry to finish deletion. A non-identifying deletion audit is recorded.

Saved career facts, Vault files, résumés, letters, tailoring versions, applications, interviews and evidence-bearing history are kept while your account is active unless you delete them earlier. Planned inactivity deletion uses 24 months since last verified sign-in or authenticated workspace write, followed by one warning and 30 days to respond. Automatic warning and inactivity deletion are disabled until custom account-warning email is verified.

The approved cleanup schedule is: explicit temporary processing files 24 hours after completion; security and operational logs 90 days; support messages 12 months after closure; complaints 24 months after closure; discovered jobs and matches 90 days after discovery when not linked to an application. Original files are never treated as temporary. Fact revisions and saved AI results contain career content and follow account retention, not content-free operational-log retention. Application-linked jobs and document versions are protected.

Consent records are retained while the account is active and for 24 months after withdrawal or account closure, whichever requires longer retention. On closure, a restricted minimal record preserves scope, integration, wording version, evidence hash and timestamps, not the documents or full disclosure. This is a business-policy choice to evidence authorisation, not a claim of a statutory requirement.

Age-based cleanup has been implemented and tested only with disposable synthetic records. Its scheduled production execution remains switched off pending rollout; the periods above are planned, not a claim that automatic deletion is operating today. Export-archive cleanup is separate as described above. Unused tailoring-version deletion remains off; versions follow account retention.

We will give 30 days’ notice before beta ends. Starting any paid subscription requires your explicit choice; beta never converts to billing automatically. If you do not upgrade, viewing, downloading, account export and deletion remain free for 90 days, with another reminder 30 days before that access closes. Accounts then remain subject to the inactivity policy rather than being deleted merely because beta ends. Free AI generation is not promised for life. The closure date and notice delivery are not yet scheduled.

Breaches and complaints

Suspected privacy or security incidents should be reported to ocheadole1@gmail.com. The operator will assess incidents and, where the Notifiable Data Breaches scheme applies, notify affected people and the OAIC as required.

Send complaints to ocheadole1@gmail.com. We acknowledge within 2 business days and aim for a substantive written response within 30 calendar days. If delayed, we explain the delay and give an expected response date. If you are not satisfied with a privacy response, you can contact the Office of the Australian Information Commissioner (OAIC), https://www.oaic.gov.au/privacy/privacy-complaints, where applicable.