ResumeMatch ("we", "us") helps you compare a CV against a job post. This policy explains what personal data we handle and how. It is written to reflect the EU General Data Protection Regulation (GDPR), since we operate from Bulgaria (EU).
Controller: Radostin Valentinov Armenov, Yadenitsa Street 14, 4400 Pazardzhik, Bulgaria. Contact: privacy@resumematch.pro.
1. What we collect
- Account data — your email address and a password. Passwords are hashed by our authentication provider; we never see or store them in plain text. If you sign in with Google, we receive your email and basic profile from Google instead of a password.
- The content you submit — the CV text and job-post text you paste or upload for analysis. A CV can contain special-category data (for example health, ethnicity, or religious information). We ask you not to include anything you don't want processed; see §4.
- Free-scan email — if you use the free scan without an account, the email you enter, so we can apply the one-free-scan-per-address limit.
- Marketing consent — if you tick the optional box, a record that you consented, plus the time and place you did so. Kept so we can demonstrate consent and honour withdrawal.
- Credits and purchases — your credit balance and a record of packs bought. Card details are handled directly by our payment provider (Stripe); we never see or store your full card number.
- Technical logs — standard server logs (IP address, timestamps, error traces) generated automatically when you use the site.
We use privacy-friendly, cookieless analytics (Vercel Web Analytics) to count page views and see which pages are used. It sets no cookies and does not track you across other sites, so no cookie-consent banner is required. We do not use advertising trackers or third-party advertising cookies.
2. Why we use it, and our legal basis
| What | Why | GDPR basis |
|---|---|---|
| Email + password | Create and secure your account | Contract (Art. 6(1)(b)) |
| CV & job text | Produce your match analysis | Contract (Art. 6(1)(b)) |
| Free-scan email | Enforce the free-scan limit; deliver the result | Contract / legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Send tips and product updates | Consent (Art. 6(1)(a)) — only if you opt in |
| Logs & security | Keep the service running and prevent abuse | Legitimate interests (Art. 6(1)(f)) |
Marketing is never a condition of using the service. You get your scan whether or not you opt in, and you can withdraw consent at any time.
Where your CV contains special-category data (Art. 9 GDPR, such as health, ethnicity, or beliefs), our legal basis for processing it is your explicit consent, which you give by choosing to submit that CV for analysis. You can withdraw it at any time by deleting the scan or your account, and you never have to include such details.
3. Who we share it with
We use these processors to run the service. Each acts on our instructions under a data-processing agreement:
- Supabase — accounts and database (EU region).
- Render — backend hosting.
- Vercel — frontend hosting.
- Anthropic (US) — the AI model that performs the analysis on the CV and job text you submit.
- Stripe — payment processing; card details go directly to Stripe and never to us.
- Resend — sending transactional emails (such as password resets), when configured.
Some of these process data outside the EU (for example Anthropic and Vercel in the United States). Those transfers are covered by a data-processing agreement and rely on the European Commission's Standard Contractual Clauses as the transfer safeguard.
We do not sell your personal data.
4. What you submit — your responsibility
Please don't paste anything into the CV or job boxes that you don't want us to process. If your CV includes sensitive details, submitting it is your decision, and by doing so you ask us to process that text to produce your analysis.
5. How long we keep it
- Account data — until you delete your account, then removed within 30 days.
- CV and job text — stored with your saved scan history so you can revisit a result. Removed when you delete the scan or your account (within 30 days). If you use the free scan without an account, the text is processed to produce the result and not stored beyond it.
- Free-scan records — the email and a counter, kept for 12 months to enforce the one-free-scan limit.
- Marketing consent records — kept while consent stands and for up to 3 years afterwards as proof.
- Logs — up to 90 days.
6. Your rights
Under the GDPR you can: access your data, correct it, delete it ("right to be forgotten"), restrict or object to processing, receive it in a portable format, and withdraw consent at any time. You also have the right to complain to your supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP).
To exercise any of these, email privacy@resumematch.pro. We aim to respond within one month.
7. Security
Passwords are hashed by our authentication provider. Traffic is encrypted in transit (HTTPS). Credit balances and every paid action are enforced on our servers, not in your browser. No system is perfectly secure, but we take reasonable measures to protect your data. If a personal-data breach occurs that is likely to risk your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and inform affected users without undue delay when the risk is high.
8. Children
ResumeMatch is not intended for anyone under 16, and we do not knowingly collect their data.
9. Changes
We may update this policy. Material changes will be notified on this page and, where appropriate, by email. The date below shows the current version.
Last updated: 30 July 2026.