Privacy Policy

Effective October 31, 2026. Operated by MarkKings Group LLC (“we”, “us”).

Updated October 31, 2026: we added optional website analytics. It is off unless you accept it. See sections 2, 3, 5, 6, 8 and 9.

Kivoo Apply handles a resume, which is one of the more sensitive documents most people own: full name, home location, phone number, email address, employment history, and often work authorization status. This policy explains what we collect, why, who receives it, how long we keep it, and what choices you have. It is meant to be read, so we have kept it plain.

1. Who is responsible

MarkKings Group LLC is the controller of your personal data, which means we decide how and why it is used. You can reach us at legal@kivooapply.com.

Paid plans, credit packs and the Trial pack are sold only to people in the United States, Canada, Australia and South Africa. The Free plan is open to people in other countries too, except that sign-up is closed for now in the European Union, the European Economic Area and the United Kingdom. We have not yet appointed a representative in the European Union or the United Kingdom, and we have not appointed a data protection officer. If that changes, this page will say so.

2. What we collect

• Account data. Your email address, a protected form of your password (we never store the password itself), your name, phone and location if you give them, and your multi-factor sign-in details if you turn that on.
• Resumes and what is read from them. The files you upload and the text we extract from them: employers, job titles, dates, skills and summary.
• Application data. Jobs you save, the documents we generate for each, your answers to application questions, your approvals, and the outcome of each submission.
• Job search activity. The search terms and locations you enter when you look for jobs.
• Recruiter contacts and outreach drafts that you create.
• Sign-in details for employer sites. If you save a login for an employer or job site so we can apply for you, we store that password in encrypted form and use it only to submit applications you have approved.
• Payment and billing records. When you buy a plan or a credit pack, our payment processor collects your payment details. We receive your plan, your purchase and invoice records, and a customer reference. We do not receive or store your full card number. We also keep a record that you accepted the Terms and the Refund and Cancellation Policy at checkout, with the date and time and the version of the wording. If you buy the one-time Trial pack, our payment processor also gives us a card fingerprint, a code that identifies your card without showing its number. We use it, with your email address, to make sure the Trial pack is bought only once. When you pay for the Trial pack, we also read the country that issued your card, and the country in your billing address, to check that the Trial pack is sold there. If we cannot tell which country issued the card, we refund the payment and add no credits.
• Technical data. Your IP address and the time of actions in your account, recorded in our security log, and counters we use to lock an account after repeated failed sign-ins.
• Website analytics (only if you accept). If you click Accept analytics, Google Analytics records how you use our website: the pages you view and when; how you reached us, for example from a search engine or a link; how far you scroll; links you click that lead to other websites; searches you make on our site; that a form was started or sent, but never what you typed into it; files you download; your approximate location (country, region and city); your device type, browser, screen size and language; and a random code kept in a cookie, so we can tell when the same browser comes back. We do not send your name, email address, resume or account details to Google Analytics. If you click Reject, none of this is collected.
• Operational records. A security log of actions taken in your account, and a usage log recording, for each AI request, the type of task, the size of the request and its cost. The usage log does not store your prompts or the text that was generated.
• Messages to us. Anything you send to our support or legal address.
• Where you live and can work (optional). Your residence country and the countries where you are authorized to work, only if you choose to give them. We never assume a country. We use them to show whether a job posting says it is open to people in your country.
• Your province (if you are in Canada). The province you choose in Settings. We ask for it before a purchase so we can apply regional availability rules. We also read the approximate region of your internet connection when you start a purchase, and the province in your billing address after you pay, for the same reason. We keep the province you choose while your account is open, and we remove it when we carry out your deletion request. Billing details that our payment processor sends us with payment messages, such as your billing address and email address, are kept with our billing records, even after your account is deleted, as section 8 explains. If we refund a payment because of this rule, we keep a record of the refund with our billing records.
• Reviews. If you leave a review: your star rating, your text, the display name and job title you choose, and whether you agreed to publish it.

We do not sell your personal data, and we do not share it for advertising.

3. Cookies

We use the cookies needed to run the Service. We also use Google Analytics cookies, but only if you click Accept analytics. We do not use advertising or cross-site tracking cookies. Cookies that are strictly necessary, such as the sign-in session, are always on, because the Service cannot work without them.

The security provider that protects our sign-in page may set its own short-lived cookie to tell people and automated programs apart. You can block or delete cookies in your browser settings. If you block the sign-in session cookie, you will not be able to sign in.

Google Analytics cookies are set only if you click Accept analytics. You can change your mind at any time with the Cookie settings link in the footer of our website. If you click Reject, or withdraw a choice you made earlier, we stop Google Analytics and delete its cookies from your browser.

4. Sensitive information

Some employer forms ask optional questions about work authorization, disability, veteran status, gender or ethnicity. We use an answer only if you have given it to us, and we never make one up. If we hold no answer for a question, we leave it for you to answer yourself. We use these answers only to complete an application you approve. You choose whether to provide them, and you can ask us to remove them at any time. Leaving a question unanswered may mean an application cannot be completed, because some employers require an answer.

5. Why we use your data

If you are in the EU, the EEA or the UK, our lawful bases are the ones named in the table: contract, our legitimate interests, your consent where we ask for it, and legal obligation (Article 6 of the EU and UK GDPR, and Article 9 for sensitive information). If you live elsewhere, we rely on the equivalent basis under your local law.

6. Who receives your data

We share your data with other companies only to run the Service. We describe them by type here. If you ask us, we will tell you the specific companies that process your data (see section 12).

• AI service providers. To tailor a resume, an AI model must be given the resume text, the job description and the task instructions. Requests go to third-party AI providers, including providers that route requests to other model providers.
• Employers and their application systems. When you approve a submission, your resume file and your answers are sent to that employer or its applicant tracking system. From then on the employer holds that data under its own privacy policy. We cannot retrieve or delete it.
• Payment processor. Handles card payment, subscriptions and invoices. It receives your email address, your plan and your payment details, and it acts under its own terms and privacy notice for payment, fraud and legal purposes.
• Email delivery provider. Receives your email address and the message when we send verification, invitation and notification emails.
• Hosting and security providers. Provide the network protection and bot-check tools that keep our sign-in page safe. They receive the technical information needed to run those checks, such as your IP address.
• Analytics provider. If you click Accept analytics, your browser sends the data described in section 2 to Google, which provides Google Analytics. Google acts as our processor: it handles this data for us, under a data processing agreement, to produce our analytics reports, and not for its own advertising. Your browser contacts Google’s servers to send this data, so Google receives your IP address with each message. Google Analytics does not log or store IP addresses. It uses the address, as it arrives, to work out your approximate location, and does not keep it. This is separate from the IP address in our own security log (section 2). To learn more, read how Google uses information from sites that use its services and the Google Privacy Policy.
• Job-listing sources. When you search for jobs, your search terms and, where the service supports it, your location are sent to job-listing services.
• Professional advisers and authorities, where the law requires it or to protect our legal rights.

If we are involved in a merger, sale or reorganisation, your data may be transferred as part of it, with the same protections and with notice to you.

AI processing, and what the AI providers may do with your content

You can use the AI features only by letting an AI model read your content. We do not make decisions about you that have legal or similarly significant effects by automated means alone. Nothing is sent to an employer without your approval of that specific application.

• Every plan, including Free. We use paid access to AI models from commercial providers. The Free plan uses a lower-cost model from those same paid providers. We do not send Free plan content to free third-party models. What a provider does with submitted content is set by its own terms, which can change. We cannot guarantee how a provider treats your content.
• AI output can be wrong. Review every document before you approve it.

7. Where your data is stored

We store your data on servers operated by MarkKings Group LLC in the United States. If you use the Service from outside the United States, your data is transferred to, and processed in, the United States, which may have different data protection rules from your country. We also send data to the providers in section 6, some of which are outside your country.

Our servers are in the United States, so your data is processed there. Where the law requires it, for personal data from the EU, the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses and the UK addendum with our providers, or on another lawful transfer mechanism. You can ask us for details (see section 12).

8. How long we keep it

We may keep data longer where the law requires it or to defend a legal claim.

9. Your choices and rights

• Access and correction. Your data is visible and editable in the app.
• Export. Ask us for a copy of your account data at the address in section 12. We aim to respond within 30 days.
• Deletion. Ask us to delete your account at the address in section 12. Before we can, you must cancel any active subscription and have no applications queued or running, and the account must not be shared with other people. We then remove your account data, resumes, generated documents, application records and recruiter contacts. It does not remove applications already delivered to employers, or the logs, billing records, Trial pack marker, website analytics data and backups described in section 8. We aim to act on a deletion request within 30 days.
• Withdrawing from AI processing. Generation is the Service. You can stop generating and delete what was generated, but we cannot tailor a document without sending it to an AI model.
• Withdrawing consent. You can withdraw consent for sensitive answers at any time by writing to us. You can withdraw consent for analytics at any time with the Cookie settings link in the footer of our website. This does not affect what we did before.
• Public reviews. You can edit your review or withdraw your consent to publish it in the app at any time. A withdrawn review is taken off our website within 5 minutes.
• Cookies and analytics. Choose, or change your choice, with the Cookie settings link in the footer of our website. See section 3.
• Analytics data. We do not link it to your account, so we can find data about your browser only if you give us the value of your _ga cookie. If you send it to the address in section 12, we will ask Google to delete that data.

Your rights wherever you live

We offer the same rights to everyone, wherever you live. You can ask to access your personal data, correct it, delete it, receive a copy of it in a portable form, object to or restrict our use of it, and withdraw consent where we rely on it. You can also complain to your local data protection authority.

We aim to meet the privacy laws that apply to you. These include the EU and EEA General Data Protection Regulation (GDPR), the UK GDPR, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), the Australian Privacy Act, US state privacy laws such as California’s, and similar laws in Africa, the Middle East and Asia. We do not claim any privacy certification. We do not sell personal data or share it for cross-context advertising, and we will not treat you worse for using these rights. You can use an authorised agent to make a request for you, and we may need to verify your identity first.

How we answer. We will reply within the time your local law sets, and in any case within 45 days where US state law applies, or one month where EU or UK law applies, extended only as the law allows and with notice to you. We do not charge a fee unless a request is clearly unfounded or excessive. If we refuse a request, you can appeal by writing to the address in section 12 with the word “Appeal” in the subject line, and we will explain our reasons. You may also complain to your regulator.

10. Security

We protect your data with encryption in transit, protected storage of passwords, encrypted storage of saved employer-site logins, optional multi-factor sign-in, access controls, account lockout after repeated failed sign-ins, and an activity log. No system is immune. If a breach affects your personal data, we will notify you and, where required, the regulator, without undue delay.

11. Children

The Service is not for anyone under 18, which is above the minimum age of 16 (or the higher local age of digital consent) that applies in many countries. We do not knowingly collect data from anyone under 18. If we learn we hold data of a person under 18, we delete it.

12. Contact, requests and providers

Privacy questions, export requests, deletion requests and appeals: legal@kivooapply.com.

Billing and refunds: see the Refund and Cancellation Policy.

Providers list. On request we will tell you the specific companies that process your data.

Business customers. If you are a business customer and need a data processing agreement, contact us at the same address and we will provide one.

You can also read our Terms of Service.

13. Changes

If this policy changes materially, the effective date above changes and registered users are notified. We do not edit it quietly.