Last updated: October 16, 2026 · Version 1.0
This Data Processing Addendum ("DPA") supplements the Terms of Service (the "Agreement") between you ("Customer") and Zoey OS, LLC, a Florida limited liability company ("Zoey OS"), operator of ApplyOwl. Terms not defined here have the meaning given in the Agreement.
ApplyOwl is a local-first application. The data involved in its core function — your resume, your job-site logins and sessions, the content of your applications, and your AI prompts and responses — stays on your device and is never transmitted to or processed by Zoey OS (see Privacy Policy, Section 2). ApplyOwl's AI work is performed by your own AI provider under your own credentials, in a request that goes directly from your device to that provider; Zoey OS is not a party to, and does not process, that content.
As a result, Zoey OS does not act as a processor of your job-search content, and this DPA governs only the limited account and operational personal data Zoey OS processes to run your account (the "Covered Data") — e.g., your email, subscription status, operational telemetry, and (where enabled) usage analytics. For personal data processed as a controller, see our Privacy Policy.
This DPA is primarily relevant where you use ApplyOwl in a business/organizational context such that Zoey OS processes Covered Data on your behalf as a processor. Where Zoey OS is a controller of the Covered Data, the Privacy Policy governs and the controller-specific provisions below do not apply.
"Covered Data" means the limited account and operational personal data that Zoey OS Processes in connection with the Services, as described in Section 0 and Exhibit A. It excludes the local-only data described in Section 0.
"Data Protection Laws" means all applicable laws relating to the processing of personal data, including the CCPA/CPRA, EU GDPR, UK GDPR and UK Data Protection Act 2018, the Swiss revFADP, and other applicable laws.
"Personal Data Breach", "Process"/"Processing", "Data Subject", and "SCCs" have the meanings given under applicable Data Protection Laws (SCCs: the EU Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum).
"Authorized Sub-Processor" means a third party engaged by Zoey OS to Process Covered Data, as listed at applyowl.app/legal/subprocessors.
Where this DPA applies, Customer is the Controller (or Processor on behalf of its own controller) of Covered Data, and Zoey OS is the Processor, Processing Covered Data solely on Customer's documented instructions. Where Zoey OS is a controller (typical for consumer use), the Privacy Policy governs.
Zoey OS will Process Covered Data only to fulfill its obligations under the Agreement, on Customer's behalf and per Customer's documented instructions, and in compliance with Data Protection Laws. Zoey OS will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.
Zoey OS will not: Process Covered Data for any purpose other than providing the Services; "sell" Covered Data or "share" it for cross-context behavioral advertising; retain, use, or disclose Covered Data outside the direct business relationship; use Covered Data to train AI models; or attempt to re-identify de-identified data without Customer's permission. Zoey OS certifies it understands and will comply with these restrictions.
On termination, at Customer's choice, Zoey OS shall return Covered Data in a machine-readable format (JSON) or delete it within 30 days from production systems and within 1 year from backups, and provide written certification of deletion on request.
Customer authorizes Zoey OS to engage the Authorized Sub-Processors listed at applyowl.app/legal/subprocessors. Zoey OS will give at least thirty (30) days' prior notice before engaging a new Sub-Processor. Your AI provider is not a Zoey OS sub-processor — you engage it directly under your own credentials.
Customer may object to a new Sub-Processor within fifteen (15) days on reasonable data-protection grounds. The parties will work in good faith to resolve it; if not possible, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees.
Zoey OS will impose data-protection obligations on each Sub-Processor no less protective than this DPA and remains liable for their compliance.
Zoey OS maintains appropriate technical and organizational measures (Exhibit C), including encryption in transit (TLS 1.2+) and at rest (AES-256), access controls and MFA on administrative accounts, network segmentation, audit logging, and regular vulnerability management.
On a Personal Data Breach affecting Covered Data, Zoey OS will notify Customer without undue delay and within 72 hours of becoming aware, provide information to enable Customer's own notifications, take reasonable containment and remediation steps, and cooperate with Customer's reasonable requests.
Taking into account the nature of the Processing, Zoey OS will assist Customer in responding to Data Subject requests. If Zoey OS receives a request directly, it will notify Customer within five (5) business days, advise the Data Subject to contact Customer, and not respond without Customer's authorization unless required by law.
Zoey OS will maintain records demonstrating compliance for three (3) years after termination. On Customer's written request (no more than once per year), Zoey OS will make available certifications/reports or, if insufficient, permit an audit by Customer's independent representative on at least 30 days' notice, during business hours, scoped to Customer's data, at Customer's cost, under confidentiality.
Where Covered Data originates from the EEA, UK, or Switzerland and is processed in the United States, Zoey OS relies on the EU SCCs (Modules Two/Three as applicable), the UK IDTA, and FDPIC-recognized clauses for Switzerland, plus supplementary measures.
Where Zoey OS Processes Covered Data as a Service Provider, it will not sell or share it, and will not retain, use, or disclose it other than for the business purposes specified in the Agreement or outside the direct business relationship. Zoey OS certifies it understands and will comply.
In conflict between this DPA and the Agreement, this DPA prevails as to Processing of Covered Data; in conflict with the SCCs, the SCCs prevail. This DPA remains in effect for the duration of the Agreement and survives until all Covered Data is returned or deleted.
| Element | Description |
|---|---|
| Subject matter | Provision of the ApplyOwl account, license, and website services |
| Duration | For the term of the Agreement |
| Nature and purpose | Operating the user's account, validating the license, processing payment, and (where enabled) usage analytics |
| Categories of Data Subjects | The account holder |
| Categories of Covered Data | Email address, hashed password, subscription/billing status, operational telemetry, device/technical data, and (where enabled) usage-analytics events. Excludes resume, applications, AI content, and job-site credentials (local-only — never received by Zoey OS) |
| Sensitive data | None required or solicited |
The current list is maintained at applyowl.app/legal/subprocessors and incorporated by reference. Your AI provider is not a sub-processor.
| Category | Measures |
|---|---|
| Encryption | In transit (TLS 1.2+) and at rest (AES-256). Managed-provider database encryption. Secrets field-encrypted. |
| Local credential handling | AI credentials and job-site sessions are held in the user's OS keychain/browser on their device, not on Zoey OS systems. |
| Access control | MFA on administrative accounts; role-based access; no shared credentials. |
| Network security | WAF/DDoS protection on public endpoints; segmentation between production and development. |
| Backup and recovery | Automated backups with tested restore (at least once per 90 days). |
| Monitoring and logging | Audit logging of administrative access; error and uptime monitoring; automated alerting. |
| Vulnerability management | Regular dependency updates and scanning; periodic penetration testing. |
| Incident response | Documented plan; 72-hour breach notification; post-incident review. |
| Data minimization | Only data necessary to run the account is collected; defined retention per data type. |
By using the Services and accepting the Terms, you agree to this DPA to the extent it applies to your use.
Last updated: October 16, 2026 · Version 1.0
