Effective August 6, 2026
When you use ResumeMatch we collect: your account email, your organization name, the job descriptions you paste or upload, and the resumes you upload for screening (which may contain candidate names, contact details, and work history). We also log basic technical data through our hosting and error-monitoring providers — IP address, browser type, and request timestamps — for security and debugging.
The free public demo does not create an account and does not save anything — analyses there exist only in your browser session and are discarded when you close the tab.
Resume and job description content is used solely to run the matching engine and show you results. Matching runs on local embeddings on our own servers — resume content is not sent to a third-party AI API for scoring. We do not sell your data or candidates' data, and we do not use it to train models beyond your own account's results.
We process account and job data to perform the contract you enter into by creating an account (i.e., to run the service you signed up for). We process candidate resume data on your organization's instructions, as your data processor — you (the recruiter or hiring team) are the data controller for candidate data you upload, and you're responsible for having a lawful basis to collect and share it with us.
We use a small number of infrastructure providers to run the service:
Each of these processes data on our behalf under its own security and privacy terms; we don't sell or share your data with advertisers, data brokers, or anyone outside this list.
Our infrastructure runs across multiple regions (including Tokyo and Seoul), so data may be processed or stored outside your own country. Each provider we use maintains its own security certifications for cross-border data handling.
All traffic to ResumeMatch is encrypted in transit (HTTPS/TLS). Authentication and password storage are handled by Supabase Auth, which salts and hashes credentials — we never see or store your password in plain text. Access to production data is limited to the people operating the service.
Candidate resumes and job data are kept for as long as your organization's account is active. You can delete individual candidates or jobs from within the app at any time. If you request deletion of your organization's account, we remove your data from active systems within 30 days; residual copies may persist briefly in encrypted backups until they age out on our normal backup rotation.
We use only the session cookies/local storage needed to keep you signed in (managed by Supabase Auth) and to remember your light/dark theme preference. We don't use advertising or tracking cookies, and we don't run third-party analytics trackers that build a cross-site profile of you.
If you're a candidate and a recruiter has uploaded your resume to ResumeMatch, we process it on that organization's behalf. To access, correct, or request deletion of your data, contact the organization that uploaded it directly, use our privacy request form, or email us and we'll route the request to them.
Depending on where you're located, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to certain processing. You can use the privacy request form or email us below. We aim to acknowledge requests within seven days and resolve them within 30 days, subject to verification and the organization's role as controller for recruiter-uploaded candidate data.
ResumeMatch is a business tool intended for use by adults acting on behalf of an employer or recruiting organization. It isn't directed at, and we don't knowingly collect data from, children.
If we make a material change to how we handle your data, we'll update the effective date on this page and, where required, notify account holders by email.
Questions about this policy or a data request? Email aryanarora230506@gmail.com.