Privacy Policy

What We Collect

• Email address (for authentication)
• Uploaded CV files (for analysis and optimization)
• Usage data (number of analyses, timestamps)
• Optional job descriptions and target roles you provide
• A one-way hash of your IP address, used only to prevent abuse of our free plan

We store a salted SHA-256 hash of your IP address rather than the IP itself, so that we can cap free analyses per network, limit how many accounts are created from one network, and rate-limit sign-in link requests. We never store your raw IP address, the hash cannot be reversed, and we also block signups from known disposable email providers for the same reason.

How We Use Your Data

• Analyzing and rewriting your CV for ATS compatibility
• Managing your account and subscription
• Sending authentication emails (magic links)
• Improving our service (aggregated, anonymized data only)

Data Retention

Uploaded CV files and analysis results are automatically deleted 30 days after upload. Account information is retained until you request deletion.

Security

Your data is encrypted in transit using industry-standard HTTPS/TLS. Data stored on our servers is protected by our hosting provider’s security controls, including access restrictions and encryption at rest where provided. No system can be guaranteed completely secure, and we cannot promise absolute security.

Who We Share Data With

We do not sell your personal information. To deliver the service we use a small number of trusted providers who process data on our behalf: a third-party AI provider that processes your CV text to generate your analysis and rewrite, our cloud hosting and database provider, our email provider for sign-in links, and our payment provider for subscriptions. Each is bound by contract to process your data only for the purpose we instruct.

No Model Training

Your CV data is never used to train AI models. Your files are processed, results generated, and data deleted per our retention schedule.

Your Rights

• Data Export: Download all your data from the Dashboard
• Data Deletion: Request account deletion from the Dashboard (processed within 30 days)
• Access: View all your analysis history in the Dashboard

Cookies

We use only essential cookies for authentication (session JWT). No tracking, analytics, or advertising cookies are used.

GDPR & CCPA Compliance

Hirelytic complies with GDPR (EU/UK) and the California Consumer Privacy Act (CCPA). We provide data portability, right to erasure, and transparent data processing. Californian users can review the full California privacy disclosures. EU/UK users can review our Data Processing Agreement. We do not sell or share your personal information, and we never use it to train AI models. For any data-related requests, use the controls in your Dashboard or send us a message through our contact form, selecting the privacy or data request category. Messages go directly to our team and we aim to respond within two working days, and in any event within the statutory time limits.