Legal
Privacy Policy and resume data security
Effective date: October 15, 2026 · Last updated: October 15, 2026
Plain-English privacy commitment
Resumes uploaded by guests are parsed in memory and discarded within 60 seconds. We never sell your resume to recruiters, job boards, or data brokers, and we never use your resume to train public AI models. Your scan history is private to your account and only you (and the founder for support) can see it.
1. Information we collect
We collect only what is needed to score your resume and run your account. Specifically:
- Uploaded resume files: PDF, DOCX, or TXT files sent to /api/analyze-resume. Guest uploads are processed in memory and discarded within 60 seconds. Logged-in users may opt to save the resulting score and keyword report to their scan history inside Supabase.
- Account data: Email address, hashed password or OAuth identifier, display name, plan status. Stored in Supabase with row-level security.
- Billing data: Handled entirely by Lemon Squeezy as the merchant of record. We never see or store full card numbers or CVV codes.
- Rate-limit telemetry: A one-way hash of your IP plus the scan timestamp, used to enforce the free-tier daily limit. The raw IP is not stored.
2. How resume parsing and AI processing works
When you submit a resume and job description, the server extracts clean text using unpdf (for PDFs) and mammoth (for DOCX), then sends that text plus the job description to our inference providers (Groq and Google Gemini) under enterprise zero-data-retention agreements. The providers return a structured JSON score which is returned to your browser and, for logged-in users, optionally stored in your private scan history. The original PDF or DOCX file is never persisted to disk.
3. Cookies, analytics, and local storage
We use the minimum browser storage needed for the product to work:
- A Supabase session cookie and a short-lived refresh token so you stay signed in.
- A localStorage key named
themethat remembers your light or dark preference. - A sessionStorage key that holds your most recent scan so a refresh does not lose it.
We do not run cross-site advertising pixels. We do not sell cookie data.
4. Third-party subprocessors
ATS Resume Checker runs on a short list of vetted providers. Each one has its own privacy notice and data processing agreement.
| Provider | Purpose | Data handled |
|---|---|---|
| Vercel | Hosting and edge compute | Request logs, no file persistence |
| Supabase | Authentication and database | Account email, hashed password, scan history |
| Groq | Primary AI inference | Transient resume and JD text, zero-retention |
| Google Gemini | Fallback AI inference | Transient resume and JD text, zero-retention |
| Lemon Squeezy | PCI-DSS merchant of record for Pro billing | Billing email, card data on Lemon Squeezy only |
5. GDPR, CCPA, and data deletion rights
If you live in the EU, EEA, UK, Switzerland, California, Colorado, or Virginia, you have the right to:
- Access the data we hold about you.
- Correct inaccurate account data.
- Delete your account and your entire scan history at any time from the /dashboard page.
- Export your scan history as JSON on request.
- Object to processing or request portability.
To exercise any of these rights, email naumanf3clicks@gmail.com from the address on your account. We respond within 30 days, usually within 48 hours.
6. Children and minors
ATS Resume Checker is intended for job seekers aged 16 and up. We do not knowingly collect data from children under 16. If a parent or guardian believes we have accidentally collected such data, email the address above and we will delete it.
7. Changes to this policy
We will post any material change to this policy on this page with an updated effective date and, when the change affects paid Pro users, we will email you at least 14 days before it takes effect.
8. Contact
Privacy questions, data requests, or security reports go to naumanf3clicks@gmail.com, or use the /contact page.