Privacy policy

resumatch is operated by David Centeno Pedrido, an individual based in Spain, not a registered company. Contact: privacy@tryresumatch.app.

Depending on how you use the site:

• Your CV — the file you upload, and the structured text we extract from it (name, work history, education, skills — whatever the CV itself contains).
• The job description you paste in, to compare against your CV.
• Account details, if you sign up — your email address and a password (stored securely by our authentication provider, never in plain text — we never see it ourselves).
• Payment records, if you buy credits — the amount, date, and a reference ID from Stripe. We never see or store your card number; Stripe handles that directly.
• Your IP address, hashed (irreversibly scrambled) before storage, used only to enforce the free daily limit for people without an account.
• A short-lived signal from Cloudflare’s bot-check widget, used to confirm you’re a real visitor rather than an automated script.
• Your email address, if you ask to be notified when paid credits become available. It’s used for that one message and nothing else, never sold or shared, and you can ask us to remove it at any time.
• Which steps of the site you used — that a CV was uploaded, a CV was generated, a result downloaded, a price was shown or clicked. This is recorded against the same hashed IP address described above, never your name or your CV contents, and it exists so we can tell whether the site is actually useful to people.
• Your answer to the one-question survey on the result page, and the optional comment you can leave with it, if you choose to answer.
• Which advert or link brought you here, if you arrived from one (the campaign name in the web address). Not linked to your identity.

We use no third-party advertising or analytics trackers — no Google Analytics, no advertising cookies, nothing that follows you to other sites. The records above are counted by us, on our own server, and never leave it.

Solely to provide the service you’re asking for: reading your CV, comparing it against the job description, generating a tailored version, and — if you have an account — remembering it for next time and tracking your credit balance. The hashed IP address and bot-check signal exist only to stop the free tier from being abused by automated scripts.

Nobody sees your CV manually — the pipeline is automated. A few outside services process it as part of running the site, each strictly for that purpose:

• Anthropic (maker of Claude, the AI model) — receives your CV text and the job description to generate the tailored CV and the strengths/weaknesses analysis. Anthropic’s API terms state that data sent through their API is not used to train their models.
• Supabase — hosts the database and file storage, physically located in the EU (Ireland).
• Stripe — processes payments for credit packs. PCI-compliant; we never touch your card details.
• Cloudflare — runs the bot-check widget (Turnstile).
• Vercel — hosts the website and its server functions.

We don’t sell data to anyone, ever.

• No account: your uploaded CV and any generated result are automatically and permanently deleted within 48 hours, by an automated daily cleanup job. There’s nothing to request — it just happens.
• With an account: your saved CV and generation history are kept until you ask us to delete them (see “Your rights” below), or until you delete your account.
• Payment records are kept for as long as legally required for accounting purposes, even after account deletion.

We use two kinds of cookie, both strictly functional — no tracking, no ads:

• A session cookie that lets an anonymous visitor’s uploaded CV be found again for a few hours (it expires automatically, as above).
• A login cookie that keeps you signed in, if you have an account.

Under GDPR, you can ask to access, correct, delete, or export your data at any time, or object to how it’s processed. There’s no self-service delete button yet — for now, email privacy@tryresumatch.app and it’ll be handled directly, promptly. You can also lodge a complaint with Spain’s data protection authority, the AEPD, if you believe your rights haven’t been respected.

resumatch isn’t directed at children, and we don’t knowingly collect data from anyone under 16.

If this policy changes in any meaningful way, the “last updated” date above will change too. Significant changes will be flagged on the site itself.