ApplyWiser Privacy Policy

Effective date: 15 October 2026

This policy explains what personal data we collect when you use ApplyWiser, what we use it for, who we share it with, how long we keep it, and what your rights are. It is written under Indonesia's Law No. 27 of 2022 on Personal Data Protection ("PDP Law").

ApplyWiser is operated by PT Bijak Teknologi Semesta ("we"), a limited liability company established under Indonesian law. For personal data processed through the applywiser.ai website and app (the "Service"), we are the personal data controller. This policy covers users who create an account, visitors to the website, and other people whose data we receive through the Service, for example recruiters who email a user's application inbox or people a user lists as references in a CV.

1. Data we collect

(a) Data you provide

Account data: name, email address, and password. Passwords are stored only in a scrambled form that cannot be turned back into the original (a salted hash).
Profile and career data: CV, work history, education, skills, achievements ("Memory" entries), target roles, salary expectations, work authorization and visa status, and answers you save to your answer bank.
Application content: answers to employer questions, cover letters, and tailored CV versions.
Communications: messages you send to us.

(b) Data generated or received by the Service

Application records: the jobs you applied to, application status, submission time, and screenshots of submitted applications, so you can check what was submitted on your behalf.
Inbox data: emails that employers send to the ApplyWiser email address linked to your account, including attachments. These emails may contain the sender's personal data, such as a recruiter's name and job title.
AI output: fit scores, CV tailoring suggestions, and draft answers, all built from data you provided.
Usage and device data: log records, IP address, browser type, pages viewed, and system error records.

(c) Data from others

Third-party account providers: the basic profile information you allow them to share, for example your name and email address, if you choose to sign in with an account from one of them.
Our payment provider: payment status, the plan purchased, and a transaction reference number. We do not receive or store your full card or bank account details.
Employers: the status of and responses to your applications, including through the applicant tracking systems ("ATS") they use.

(d) Specific personal data and other people's data

We do not ask for health data, biometric data, genetic data, criminal records, or personal financial data. However, such data may appear in your CV or answers, or be requested by an employer's form, for example disability status or criminal history. Include it only when your application really needs it. We process such data only as part of your CV and answers, for the purposes in section 2, and for no other purpose.

If your CV or answers contain someone else's data, for example a reference's name and contact details, make sure that person agrees to their data being shared for your application.

2. Why we use data and on what basis

The PDP Law requires all processing of personal data to have a lawful basis:

Purpose	Data used	Basis for processing
Creating and managing your account	Account data	Performance of our agreement with you
Finding matching jobs and calculating fit scores	Profile and career data, job descriptions	Performance of our agreement with you
Tailoring your CV, cover letters, and answers with AI	Profile and career data, application content, job descriptions	Performance of our agreement with you
Submitting applications to employers or ATS platforms, including those outside Indonesia	Application content and contact details you approve	Your explicit consent, per application or through automation rules you set
Keeping application records and screenshots so you can check what was submitted on your behalf	Application records	Performance of our agreement with you
Providing your application inbox	Inbox data	Performance of our agreement with you; for email senders' data, our legitimate interest in passing application replies on to you
Using other people's data you include, such as references	Those people's names and contact details	Our legitimate interest in preparing and submitting the applications you request
Billing and plan access	Payment status	Performance of our agreement with you; legal obligation, for example bookkeeping and tax
Service notices (receipts, submission notices, plan period reminders)	Account data	Performance of our agreement with you
Security, fraud prevention, and fixing faults	Usage data and logs	Our legitimate interest in keeping the Service secure and working
Usage analytics to improve the Service	Usage data (see section 9)	Your explicit consent through cookie settings
Marketing emails	Email address	Your explicit consent, requested separately
Meeting legal obligations and official requests from authorities	Data lawfully requested	Legal obligation

Consent. Where the basis for processing is consent, we ask for it separately for that purpose and keep a record of the consent you give. We send marketing emails only if you agree to them. You can withdraw consent at any time:

analytics consent, through "Cookie settings";
automation rules, through Settings;
any other consent, including for marketing emails, through the unsubscribe link in our marketing emails or by emailing us.

We stop the processing based on that consent no later than 3 x 24 hours after we receive your request, and then delete the data processed on the basis of that consent, unless the law requires us to keep it. Withdrawing consent does not undo processing already carried out, and we cannot recall applications already submitted to employers.

If you do not provide the data required, some features of the Service cannot work.

3. AI and automated decisions

We use AI models to assess how well you match a job (the fit score), tailor your CV, and draft answers. The fit score is a form of profiling: an automated assessment of your profile against a job posting.

Our tailoring system is designed not to invent qualifications, not to answer questions you have not provided information for, and not to upgrade the roles you list in your work history.
You can always see AI output in the app, and it can be wrong, so check it before you approve an application. Applications sent through automation rules are submitted without a per-application check.
Applications are submitted automatically only if you turn on automation rules yourself. You can review, pause, or revoke those rules at any time in Settings, and revocation applies to applications not yet submitted.
We do not use your personal data to train third-party foundation AI models.

You have the right to object to decisions based solely on automated processing, including profiling, that have legal effects on you or significantly affect you. On request, we will have a person review any automated submission decision. Send your request to us by email.

We share personal data only as far as needed to run the Service, and we do not sell your personal data.

Employers and ATS platforms: when an application is submitted on your behalf, the employer receives the application content you approved: your CV, answers, and contact details. Once received, the employer processes that data under its own privacy policy.
Service providers working for us: they are bound by agreements with us, are under our supervision, and may process data only on our instructions and for the purposes we set. They are:
- cloud service providers, for servers, databases, and file storage;
- AI model providers, to assess fit, tailor CVs, and draft answers;
- email service providers, for the application inbox and service emails;
- other technical providers that help us run and secure the Service, for example system fault monitoring.
Payment provider: to process your payments. That provider processes payment data under its own privacy policy.
Third-party account providers: only if you choose to sign in with an account from one of them.
Competent authorities: where required by law or a valid legal process.
A party that takes over our business: if PT Bijak Teknologi Semesta is involved in a merger, demerger, acquisition, consolidation, or dissolution, we will notify you of the transfer of personal data before and after that event.

5. Transfers outside Indonesia

To employers and ATS platforms abroad: jobs on ApplyWiser may come from companies outside Indonesia, and employers may use an ATS whose servers are in another country. Your application may be sent to the country where the employer or its ATS is located, whose level of data protection may differ from Indonesia's. This transfer happens only with the explicit consent you give when you approve an application or turn on automation rules. Through automation rules, applications may be sent to employers in any country that matches your criteria.
To our service providers: some of the providers listed in section 4, for example AI model providers, may process data outside Indonesia. For those transfers we make sure there is adequate and binding personal data protection through our agreements with those providers.

6. How long we keep data

Account and profile data: while your account is active, then deleted no later than 30 days after the account is deleted.
Application records and screenshots: 24 months after submission, then deleted. If your account is deleted before then, these records are deleted together with your account data.
Inbox data: while your account is active, or earlier if you ask us to delete it.
Payment and transaction records: for as long as Indonesian tax and financial regulations require.
Email address for marketing: until you withdraw your consent.
Consent records: for as long as needed to prove the consent you gave.
Other data: any data not listed above, such as AI output, logs, analytics data, and messages you send us, is kept only as long as needed for its purpose in section 2, then deleted.
Backups: backup copies are deleted automatically within 3 months at most.

Data is deleted or destroyed when its retention period ends, when you ask, or when you withdraw the consent its processing is based on, unless the law requires us to keep it longer. We will notify you after your data has been deleted or destroyed.

7. Security

We protect your data with technical and organizational measures, including encryption in transit (TLS) and at rest; access limited to what is needed, including for system accounts; management of system keys and passwords; non-public storage for application screenshots, with special links that expire quickly; and audit logging of access and system activity. We keep your personal data confidential, and every party processing data on our behalf must do the same.

No system is completely secure. If a personal data protection failure affects your data, we will notify you and the competent authority in writing no later than 3 x 24 hours. The notice will state which personal data was exposed, when and how it was exposed, and what we are doing to handle and recover from it.

8. Your rights

As a personal data subject, you have the right to:

obtain information about our identity, the legal basis and purpose of the processing, and who is responsible for that processing (this policy is part of meeting that right);
complete, update, or correct data that is wrong or inaccurate;
access and obtain a copy of your data, together with the record of how it has been processed;
end the processing of your data, or have it deleted or destroyed;
withdraw your consent;
object to decisions based solely on automated processing, including profiling, that have legal effects on you or significantly affect you;
postpone or restrict processing proportionately to its purpose;
obtain your data in a commonly used format that electronic systems can read, and use it and send it to another personal data controller, as long as the systems can communicate with each other securely;
sue for and receive compensation for violations in the processing of your personal data, in accordance with the law.

We carry out requests to complete, update, or correct data and to postpone or restrict processing no later than 3 x 24 hours after we receive your request, and then tell you the result. We carry out requests to access data or withdraw consent within the same time limit.

How to make a request. Email us a written request stating which right you want to use.

If you are a user, send it from the email address registered to your account.
If you are not a user, tell us which data you mean.

Users can also export or delete their data themselves in Settings › Account (the "Export or delete your data" button). To protect your data, we may ask you to verify your identity before we act on a request.

Limits. In certain situations, the law limits some of these rights, for example in the interest of law enforcement. We must also refuse a request to change data if doing so would endanger your or another person's security or health, or would reveal another person's personal data. If we refuse a request in whole or in part, we will explain why.

Complaints. We suggest you contact us first so we can put things right. You may also complain directly to the personal data protection authority established by the President under the PDP Law.

9. Cookies and browser storage

We use two kinds of cookies and similar browser storage, and you choose whether we use the second kind:

Necessary (always on): this kind keeps you signed in and your account secure, including short-lived cookies used while you create an account or sign in with a third-party account. It also keeps the Service's working data in your browser, for example a CV you are editing, and remembers your cookie choice. The Service cannot work without it, so it cannot be switched off.
Analytics (off unless you allow it): if you allow it, we count visits to our public pages and record which app pages you open and which buttons you press, so we can see what works and improve the Service. For this we set no cookie of our own and use no third-party analytics tool. In the app, a random identifier for your browser tab is kept in that tab's temporary storage (session storage), which your browser deletes when you close the tab.

We do not use advertising or marketing cookies.

The first time you visit, a "Cookie settings" window asks for your choice: "Accept all", "Accept necessary", or switch each kind on or off and "Save preferences". We keep your choice in a cookie in your browser for up to 12 months, then ask again; if you are signed in, we also record it with your account. You can change it at any time through "Cookie settings" at the bottom of our home page, or in Settings › Account when you are signed in. If you withdraw your consent, we stop collecting analytics from your browser and delete that identifier.

If your browser sends a Global Privacy Control or Do Not Track signal, we take it as your answer: analytics stays off and the window does not open by itself. You can still switch analytics on yourself through "Cookie settings".

10. Children

The Service is only for users aged 18 and over, and we do not knowingly process children's personal data. If we learn that an account or data belongs to a child, we will delete it.

11. Changes to this policy

If we change the information in this policy, for example the purposes of processing, the types of data, retention periods, or your rights, we will notify you by email or in-app notice at least 14 days before the change takes effect. If a change requires new consent, we will ask for it first.

12. Language and governing law

This policy is made in Indonesian and English. If the two versions differ in meaning, the Indonesian version prevails. This policy is governed by the laws of the Republic of Indonesia, including the PDP Law.

13. Contact us

Questions and requests about personal data, including complaints and withdrawals of consent, can be sent to:

PT Bijak Teknologi Semesta (ApplyWiser) Email: info@applywiser.ai