Privacy policy
What we hold about you, why, for how long, and the rights you have over it.
Privacy
Subprocessors
We use the companies below to run Resumetricx. Each one processes personal data only on our instructions, under a data processing agreement, and only for the purpose listed. We give 30 days’ notice before adding a subprocessor that handles customer content, so you can object.
Sections2
Sections in this document; the ring is the words in each, in order.
Words287
Counted rather than estimated; the ring is how they divide between the longest parts.
Minutes to read1
At 200 words a minute; the ring is each part's share of the time.
Last reviewed18 Aug 2026
18 August 2026. 45 days ago; the arc is that share of a year.
The document, one section at a time.
Section 01 / 02
GDPR Art 28
| Company | What it does | Data involved | Where | Transfer basis |
|---|---|---|---|---|
| Google (Firebase) | Authentication, database, file storage | Account details, CV content, analytics events, and any name or contact detail a reader typed into the optional card on a shared CV | United States / EU regions | EU–US Data Privacy Framework + Standard Contractual Clauses |
| OpenAI | AI writing, rewriting, grammar and tone review | The CV text you submit to an AI feature | United States | Standard Contractual Clauses; API data is not used for training |
| Anthropic | The reading debrief — one paragraph explaining a CV’s own reading figures | Your CV title, its section names, and the aggregate reading figures shown on your own report — never a reader’s identity or a single reading row | United States | Standard Contractual Clauses; API data is not used for training |
| Stripe | Payments, subscriptions, billing portal | Email, billing details, payment method (we never see card numbers) | United States / Ireland | EU–US Data Privacy Framework + Standard Contractual Clauses |
| SendGrid (Twilio) | Transactional email — receipts, alerts, password resets | Email address, message content | United States | Standard Contractual Clauses |
| IPinfo | Country lookup for tracking events — nothing narrower is stored | IP address of a document viewer, at the moment of lookup | United States | Standard Contractual Clauses |
| Vercel | Application hosting and delivery | Request metadata, IP address | Global edge network | Standard Contractual Clauses |
Section 02 / 02
On transfers to the United States
Most of these vendors process data in the US. The European Commission’s adequacy decision for the EU–US Data Privacy Framework remains in force, and we rely on it where a vendor is certified. Because that decision is under appeal, we also keep Standard Contractual Clauses in place with every vendor as an independent fallback, so a change in the framework’s status would not leave transfers without a legal basis.
Questions, or an objection to a new subprocessor: contact our DPO. See also our Privacy Policy and what we collect.
The whole set, side by side.
Terms of service
The agreement: what the service does, what you keep, what you may not do.
Recruiter transparency
What a reader of your CV can see was measured, and how to object.
Consent management
The switches for email, marketing and anonymous sharing, and your data rights.
What we collect
Every field we collect, from both sides of a reading, in one inventory.
You are reading this one
Subprocessors
The companies that run parts of the service, where, and under what terms.
This document
Delete your data
How to remove your account and everything under it, and what that takes.
Contact the DPO
Who answers data-protection questions, and how quickly.