Privacy Policy

AskTheRecruiter.com Last updated: June 10, 2026 Effective date: May 21, 2026

Recent material changes:

• 2026-06-18 (v1.0.393) — the free estimated match check on the home page now uses AI: a visitor's resume + the job posting are sent to our AI provider (Anthropic via OpenRouter, as already described in "AI processing") to compute an accurate match — including for visitors who are not yet signed in. This replaced an earlier keyword-only estimate that used no AI. No new sub-processor (same Anthropic/OpenRouter flow); not stored as a document on this pre-sign-in path; a notice is shown where you paste your resume. Because the affected processing is for anonymous visitors (who accept this policy at sign-up) and existing signed-in users' data flow is unchanged, this disclosure update did not trigger a re-acceptance prompt.
• 2026-06-10 (v1.0.295) — added Cloudflare (bot protection on the sign-in form via Turnstile + network-layer blocking of abusive traffic) and Upstash (rate-limit counters used for abuse prevention) as strictly-necessary security/infrastructure sub-processors. Neither receives your resume text, job description, generated drafts, or email content. No change to the AI data flow — every AI request still runs exclusively on the Anthropic Claude family via OpenRouter.
• 2026-05-27 (v1.0.066) — added Colorado SB 205 consumer notice, Canadian PIPEDA rights + 72-hour breach-notification commitment, and Brazil LGPD rights section. These are compliance disclosures required by Colorado's AI Act (effective Feb 2026), PIPEDA Breach of Security Safeguards Regulations (SOR/2018-64), and LGPD Art 18. No change to what data we collect or how we process it.
• 2026-05-21 (v0.9.911) — added PostHog as a product-analytics sub-processor (EU/Germany ingestion region, eu.i.posthog.com). PostHog provides operator-facing heatmaps + scroll-depth + click-path analysis; session recording is hard-disabled and form input values are never captured at the SDK level. Same redaction posture as Mixpanel.
• 2026-05-21 (v0.9.876) — replaced Brevo with Mailjet by Sinch as the newsletter sub-processor (EU/France-based; data scope unchanged — email address + consent timestamp only); double-opt-in now applied to all subscribers regardless of jurisdiction.
• 2026-05-17 (v0.9.559) — expanded GDPR rights section with full Article 15 / 17 / 20 self-serve DSAR workflow: 72h SLA commitment, 1/day per-type rate limit, in-app /account "Your data rights" surface, audit trail policy.
• 2026-05-17 (v0.9.558) — disclosed WebFetch as an opt-in processing activity for cover-letter company-specificity.
• 2026-05-17 (v0.9.567) — comprehensive funnel instrumentation: metadata-only intermediate-step events added across signup, checkout, quick-draft, cover-letter, detailed-edit, interview-prep, refinement, and referral funnels.
• 2026-05-17 (v0.9.548c) — disclosed the in-house customer referral program data flow.
• 2026-05-17 (v0.9.547) — added Endorsely as a sub-processor for the affiliate program.
• 2026-05-15 (v0.9.400) — added GDPR Art 22 / UK DPA s.14 automated-decision-making disclosure, Quebec Law 25 explicit-consent paragraph, and CPRA Sensitive PI acknowledgment.

Who we are

AskTheRecruiter.com ("AskTheRecruiter," "we," "us," or "our") is a resume tailoring and career preparation service based in Wyoming, United States. Our primary domain is asktherecruiter.com.

Although we are a US-based operator, we voluntarily apply EU GDPR / UK-GDPR, California CCPA/CPRA, Quebec Law 25, Brazil LGPD, and other international privacy frameworks to all users globally — not just users physically located in those jurisdictions. The rights described in this policy are available to every user, regardless of where you live.

Contact: use our in-app contact form at https://asktherecruiter.com/contact for the fastest response. We do not list an inbox here because the contact form attaches diagnostic context that helps us answer faster.

What this policy covers

This Privacy Policy explains what personal data we collect, why we collect it, how we process and store it, who we share it with, and what rights you have over your data. It applies to all users of asktherecruiter.com and any associated services.

What personal data we collect

Data you provide directly

Resume content — When you paste or upload your resume, we receive the full text, which typically includes your name, email address, phone number, physical address, work history, education, skills, and certifications. Uploaded files (PDF, DOCX, TXT) are normally converted to text inside your browser, so only the extracted text reaches our servers. If that in-browser conversion fails — for example on some mobile browsers — the file is sent to our server solely to extract its text; it is processed in memory and is never stored or written to disk.

Job description text — The job postings you paste into the tool. These generally do not contain your personal data.

Account information — If you create an account: your email address and authentication tokens. We use passwordless magic-link authentication; we never collect or store passwords.

Payment information — If you purchase credit packs, payment is processed entirely by Stripe. We never see, receive, or store your credit card number, CVV, or full billing details. We receive only a Stripe customer ID, transaction confirmation, and the amount paid.

Communication data — If you contact us via the in-app contact form, we receive your email address (so we can reply), your message content, and basic diagnostic context (account ID, browser type, page you were on) that you implicitly attach by using the form.

Data collected automatically

Essential cookies — We use a small number of cookies strictly necessary for authentication and session management. We do not use advertising cookies or tracking cookies.

Analytics data — We use three analytics providers to understand how people use the product (which features are used, where users drop off, session duration):

• Mixpanel — product-usage analytics. Configured to store data in your browser's localStorage (not cookies), with IP forwarding disabled. Mixpanel collects:

  • Explicit usage events we send (see the full event catalogue below)
  • Automatically-captured DOM interactions (button clicks, form submissions, page navigations) — element tag, class, button text, and URL only; we never capture the contents of form inputs such as your resume text, email, or job description
  • Device and browser type

  We do not record session replays (no video-like playback of your activity). We identify signed-in users by their Supabase user UUID (never by email).

• PostHog — product analytics, heatmaps, and funnel analysis hosted in the European Union (Germany) ingestion region. PostHog complements Mixpanel by providing operator-facing heatmaps + scroll-depth + click-paths so we can see which buttons get used and where users get stuck. We configure PostHog with the same redaction guarantees as Mixpanel: it captures element labels and click targets (e.g. "Buy Standard") but never form input values (resume text, email, JD content), DOM attributes are masked so per-record identifiers cannot leak, and session recording is hard-disabled at the SDK level (no video-like replay of your activity). We identify signed-in users by their Supabase user UUID (never by email). PostHog is consent-gated to the analytics-cookie category and honours your browser's Do-Not-Track signal even when analytics cookies are accepted.

• Google Analytics 4 — high-level pageview funnels and conversion attribution. Configured with anonymize_ip: true so IP addresses are truncated before storage, with advertising features and ad-personalization signals disabled (we do not use GA's advertising data).

We do not track individual browsing behavior across other websites. We do not share analytics data with advertisers.

Error monitoring — We use Sentry to detect and fix bugs. Sentry may receive technical error data including browser type, operating system, and the sequence of actions that caused an error. We configure Sentry to exclude personal data (resume text, names, email addresses) from error reports.

Infrastructure logs — Our hosting provider Railway processes server access logs that may include IP addresses, request timestamps, and request paths. These are retained for security and operational purposes.

Analytics event catalogue

The list below names every product-usage event we currently fire to Mixpanel, grouped by purpose. We send only the event name and a small set of named properties (e.g. feature variant, draft length category, currency); we never attach your resume text, job description, or email address to an event payload. Events are subject to change as the product evolves — this list reflects the current state and is not exhaustive of future additions, but any new events we add will follow the same no-PII rule.

Lifecycle & authentication

Tool usage

Conversion & billing

Safety & moderation

Legal-document views

Referral program

We additionally fire a small mp_verify_connection diagnostic event at startup so operators can confirm the analytics pipeline is healthy; it carries no user data.

For Google Analytics 4, we fire a parallel and smaller set of conversion-funnel events (sign_up, login, logout, quick_draft_completed, cover_letter_generated, interview_prep_generated, detailed_edit_opened, subscribe, select_content, view_search_results) with IPs anonymized and advertising signals disabled. (v0.9.567) GA4 also receives every funnel-step event listed above in the lifecycle, tool-usage, conversion, and refinement tables so the GA4 funnel report mirrors the Mixpanel one — same event names, same metadata-only payloads, no PII forwarded.

How we use your data

AI processing — how your data flows through our system

This is important to understand: when you use Ask The Recruiter, your resume text and job description text are sent to a third-party AI provider for processing. Here is exactly what happens:

1. Your resume and job description text are sent to our backend server hosted on Railway.

2. Our server sends portions of your text to AI language models via OpenRouter (our AI routing provider). OpenRouter forwards the request to one underlying LLM provider per request, based on routing rules we set (model availability, cost, and latency). Today we route exclusively to the Anthropic Claude family (Sonnet and Haiku models), selected by task — lighter extraction steps run on Haiku, the main drafting steps run on Sonnet. OpenAI GPT (4o and 4o-mini families) and Google Gemini families remain approved fallback providers on our routing list but are not currently in the active routing path; any given request runs on exactly one provider. The Sub-processors section below lists every approved provider, what they receive, and where they are located, and is kept current — if we change which providers are active, this list is updated and signed-in users are prompted to re-accept on next sign-in.

3. The AI providers process your text and return results. They do not use your data to train their models. We use commercial API tiers with data processing agreements that prohibit training on customer data.

4. Results are returned to your browser and, if you have an account, stored in our database (hosted on Supabase).

Before you sign in. The free estimated match check shown on the home page now sends your resume and the job posting to the AI provider above to compute your fit — so a visitor who is not signed in has their text processed the same way (when this accurate-match feature is enabled). On this pre-sign-in path we do not store your resume as a document and we never sell it; the same provider retention terms above apply, and you see a short notice where you paste your resume. This replaced an earlier keyword-only estimate that did not use AI.

What the AI providers receive

• Your resume text (full or partial sections depending on the feature)
• The job description text
• No other personal identifiers (no email, no account ID, no IP address)

AI provider data retention

• OpenRouter: Acts as a passthrough router. Zero data retention on commercial API plans.
• Anthropic: Commercial API — 30-day safety retention by default, not used for training. We have requested zero-retention where available.
• OpenAI: Commercial API — 30-day safety retention by default, not used for training (API data is excluded from training by default per OpenAI's data-usage policy for API customers).
• Google (Gemini): Commercial API / Vertex AI tier — content is not used to improve Google's foundation models on paid API plans; logs are retained for a limited operational window.

Who we share your data with — sub-processors

We share your personal data only with the service providers necessary to operate Ask The Recruiter. Each is bound by a Data Processing Agreement (DPA) or equivalent and is listed below with what they receive, why, and where they are located.

Infrastructure footnote — Railway. Our hosting infrastructure provider, Railway, runs the frontend and backend application processes on our behalf. Railway sees ephemeral runtime memory and captures process logs (timestamps, request paths, error messages) as part of operating the runtime; it does not store user content (resumes, job descriptions, generated outputs) at rest — that data lives in Supabase. Railway is listed here as infrastructure, not as a data sub-processor in the traditional sense, because the application code (not Railway) decides what is persisted. Railway privacy policy: https://railway.app/legal/privacy.

Infrastructure footnote — Bluehost (marketing site only). The marketing/landing pages at asktherecruiter.com that introduce the product are served by a separate origin hosted on Bluehost. The marketing site does not collect personal data from visitors; it has no forms, no analytics tied to user accounts, and no sign-in surface. The product application itself — where you paste a resume, generate drafts, and manage your account — runs on the infrastructure described above (Railway + Supabase). Bluehost has no visibility into your account, resume content, or generated outputs.

About Resend. Transactional emails — magic-link sign-in, credit purchase receipts, security notifications, and account-deletion confirmations — are delivered via Resend, a third-party email delivery service. Resend processes recipient email addresses and message contents on our behalf under a Data Processing Agreement. Resend never receives your resume text or job description content.

About OpenRouter routing. When we send your resume and job description to OpenRouter, OpenRouter forwards the request to exactly one underlying LLM provider per request. Today that provider is Anthropic Claude (the Sonnet and Haiku families), routed by task. OpenAI and Google remain on our approved-provider list (and in the Sub-processors table above) as fallbacks, but are not currently in the active routing path. OpenRouter's role is purely routing; it does not store the message content on commercial plans. If we change which providers are active, this policy is updated and signed-in users are prompted to re-accept on next sign-in per the "Changes to this policy" section.

<a id="webfetch"></a>About WebFetch (cover-letter company-specificity — opt-in). When you generate a cover letter, you may optionally provide a company web page URL (e.g. the company's careers page or About page) and tick the "Use this page to make my letter more company-specific" box. This is off by default; the box must be ticked anew for every cover letter — there is no global setting and no remembered preference. When you opt in, our backend (not a third party) makes a single outbound HTTP GET request to the URL you provided, downloads up to 5 KB of HTML, extracts the readable text, removes any personal data from the extract using the same scrubber that protects your application logs (src/security/pii_scrubber.py), truncates to 2,000 characters, and threads the result into the LLM prompt as an "unverified company context" block so the model can reference company-specific language. We honor robots.txt (your URL will be skipped if the site forbids automated access) and apply a 5-second timeout, a per-domain rate limit of one fetch every 60 seconds, and an SSRF guard that refuses to fetch private network addresses. The scrubbed excerpt is cached for 24 hours keyed by the SHA-256 hash of the URL — repeat fetches against the same URL hit our cache, never the origin. The cache row contains the scrubbed excerpt and the fetched URL; it does NOT contain your user ID, name, email, resume, or any other personal data, and is purged on a rolling 24-hour cron. To opt out, simply leave the box unticked — the cover letter still generates, just without the company context block, and no fetch ever occurs. We operate the fetcher ourselves; it is not a third-party sub-processor. No data flows to any third party as a result of WebFetch (your URL is sent only to the company's own site, as a normal browser request would).

About Endorsely (affiliate program). We run an affiliate program (/affiliates) using Endorsely, a Stripe Marketplace affiliate platform. If you arrive at our site via an affiliate link and have accepted marketing cookies, Endorsely's script sets a first-click attribution cookie containing a random UUID — no personal identifiers. If you later buy a credit pack within the 30-day attribution window, the UUID is attached to your Stripe Checkout Session as metadata so Endorsely can attribute the commission to the referring affiliate. Endorsely receives the Stripe customer ID and conversion amount from Stripe directly via the Marketplace integration; we do not send Endorsely your name, email, resume, or any other content. If you do not accept marketing cookies, the Endorsely script does not load, no attribution cookie is set, and no data flows to Endorsely from your visit. Endorsely privacy policy: https://endorsely.com/privacy. The DPA is executed via the Stripe Marketplace install consent.

About the in-house customer referral program (separate from the Endorsely affiliate program). We also operate a customer-to-customer "Refer & Earn" program at /referrals where signed-in users can share a personal 8-character referral code with friends. This program does NOT use a third-party platform and does NOT load any external script — all attribution lives in our own Supabase database. When a referred friend signs up using your link, we record: (a) your friend's referral code (the 8 characters from your link), (b) a SHA-256 hash of your friend's signup IP (the raw IP is never persisted — only the hash), and (c) a SHA-256 hash of an optional browser device fingerprint (only if your friend's browser produces one — the raw fingerprint is never persisted). The hashes are used solely to detect obvious self-referral or fake-friend abuse (e.g., the same device signing up twice with two accounts). When your friend buys their first credit pack, we record a "referral granted" row and credit 5 credits to both accounts. Lifetime cap: 25 credits per referrer. Referral codes are NEVER shared with other users; only the link you choose to send carries your code. Refund clawback (v0.9.582 — added 2026-05-17). If your friend's purchase is refunded within 30 days of the grant, the 5 referral credits granted to each of you may be deducted from your respective balances (clamped at zero — your balance will never go below zero). This mirrors Stripe's standard chargeback window and is a routine fraud-prevention safeguard used by Cal.com, Notion, Linear, and other SaaS apps that run referral programs. After 30 days without a refund, the credits become permanent. Referral codes and the associated hashes are retained for the lifetime of the referrer's account; on account deletion (GDPR Art 17 right-to-erasure) the referrer's code, referral rows, and hashes are deleted with the rest of their account data per the standard retention schedule.

About PostHog (operator behavior analytics + heatmaps). PostHog is our product-analytics sub-processor for click heatmaps, scroll-depth analysis, and feature funnels. It sits alongside Mixpanel; we use Mixpanel for explicit event tracking and PostHog for the operator-facing "where did the user click + where did they pause" view, so we can improve the product. PostHog is hosted in the European Union (Germany) ingestion region (eu.i.posthog.com) — your data does not leave EU infrastructure for this sub-processor. The integration is consent-gated to the analytics-cookie category: PostHog does not load and no data is sent until you accept analytics cookies, AND the SDK additionally honours your browser's Do-Not-Track signal (navigator.doNotTrack) even when analytics cookies are accepted. The SDK is configured with privacy-first defaults: (a) form input values are never captured (resume text, email, JD content stay in your browser), (b) DOM element attributes are masked so per-record identifiers (e.g. data-draft-id) cannot exfiltrate, and (c) session recording is hard-disabled at the SDK init — there is no video-like replay of your screen. The signed-in user identity sent to PostHog is the same Supabase user UUID we use everywhere else; we do not forward email, name, or any other contact attribute to PostHog. PostHog cookies sit in the analytics-cookie consent category and you can withdraw consent at any time from the Account → Cookie preferences page; on withdrawal, the SDK will not re-initialise on the next page load.

About Mailjet (optional product-updates newsletter). At signup we present an unchecked-by-default opt-in checkbox separate from the Terms of Service and Privacy Policy acceptance ("Send me product updates + job search tips — optional"). Per GDPR Art 6(1)(a) the box must remain unticked unless you affirmatively tick it; signup succeeds whether you tick it or not. If you opt in, your email address (and only your email address) is sent to Mailjet by Sinch ("Mailjet"), our newsletter sub-processor based in France. Mailjet sends a confirmation email and you are added to the list only after you click the confirmation link — a double-opt-in flow applied to all subscribers, regardless of jurisdiction, per DE-TTDSG §13 and the GDPR Art 7(1) "demonstrable consent" requirement (we apply the stricter EU/UK/DE standard universally rather than route by IP geolocation). Newsletter emails always carry a one-click unsubscribe link. You can also change your preference at any time from the Newsletter card on your /account page. Mailjet never receives your resume text, job description content, generated drafts, user UUID, or any other personal data — only your email address and the consent timestamp. If you do not opt in, Mailjet never receives any data about you. Mailjet privacy policy: https://www.mailjet.com/legal/privacy-policy/.

About Cloudflare (bot protection + network security — strictly necessary). We use two narrow Cloudflare services, both security-only. First, the sign-in form is protected by Cloudflare Turnstile, a privacy-preserving bot check (the puzzle-free alternative to a CAPTCHA). When you request a magic link, the Turnstile widget produces a challenge token in your browser; our backend forwards that token, together with your IP address, to Cloudflare's verification endpoint to confirm you are not a bot. This is transient — we do not store the IP from this check, and the token is single-use. Second, when we detect abusive traffic (e.g. credential-stuffing or scraping), we may block the offending IP address at Cloudflare's network layer in addition to our own application-level block. Cloudflare never receives your resume text, job description, generated drafts, account email, or any other content — only the bot-check token + IP at sign-in, and the IPs of blocked abusive sources. Because this processing is strictly necessary for security, it is not consent-gated (GDPR Art 6(1)(f) legitimate interest in network and information security, Recital 49). Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/.

About Upstash (rate limiting — strictly necessary). To prevent abuse (rapid-fire requests, scripted scraping, brute-force attempts), our backend enforces per-user rate limits. The counters behind those limits are stored in a hosted Redis database operated by Upstash, so the limits hold even when our backend runs on multiple servers. What Upstash stores is minimal: short-lived counter entries keyed by your account UUID (if you are signed in) or by a salted SHA-256 hash of your IP address + browser type (if you are not) — the raw IP address is never sent to or stored in Upstash, and no resume text, job description, draft, or email address ever flows there. Counter entries expire automatically within the rate-limit window (seconds to minutes). Because this processing is strictly necessary for security and service integrity, it is not consent-gated (GDPR Art 6(1)(f), Recital 49). Upstash privacy policy: https://upstash.com/trust/privacy.pdf.

We do not sell your data. We do not share your data with advertisers. We do not share your data with any parties not listed above.

How we store your data

Before you create an account: Your resume text, job description, and generated results are stored only in your browser's local storage (localStorage). We do not have access to this data. If you clear your browser data, it is permanently deleted.

After you create an account: Your data is stored in a Supabase-hosted PostgreSQL database with the following protections:

• Encryption at rest — all database storage is encrypted using AES-256
• Encryption in transit — all connections use TLS 1.2+
• Row-Level Security (RLS) — database rules ensure you can only access your own data; no user can read another user's resume or results
• Backups — daily automated backups with point-in-time recovery
• Access control — only the application server connects to the database; there is no public database access

Resume text is never written to application logs. Our logging configuration explicitly excludes resume content, personal names, and email addresses from log output.

How long we keep your data

Your rights under GDPR

As a data subject, you have the following rights. Articles 15, 17, and 20 — the three GDPR rights with a dedicated self-serve workflow — are exercisable directly from your account settings (the "Your data rights (GDPR)" section at https://asktherecruiter.com/account) without contacting us. All other rights are exercisable by sending us a request through the in-app contact form at https://asktherecruiter.com/contact.

Service-level commitment. GDPR Article 12(3) gives us up to one month to respond to a rights request. We self-impose a faster bar: we acknowledge and fulfil Article 15, 17, and 20 requests within 72 hours. Requests routed through the in-app "Your data rights" section are tracked in a per-user request ledger you can inspect at any time (see the history table inside the same section).

Right of access (Article 15) — Self-serve. Use the "Your data rights" section in your account settings; it returns a ZIP archive containing one machine-readable data.json, one CSV per table, and a metadata.txt cover sheet covering every draft, cover letter, interview prep, credit pack, credit usage row, and user-lifecycle audit event tied to your account. No need to contact us — the export runs against your own account in real time.

Right to rectification (Article 16) — Self-serve where the field is yours to edit (resume, account details). For data you cannot edit yourself (e.g. audit log corrections), use the in-app contact form.

Right to erasure ("right to be forgotten") (Article 17) — Self-serve. Click "Delete my account" in the "Danger zone" section of your account settings. The in-app "Your data rights" section additionally records your Article 17 request to your DSAR history so the timeline is auditable end-to-end. Soft-deletion is immediate (your drafts, cover letters, interview preps, and credit packs are flagged deleted and stop appearing); a 30-day grace window lets you recover the account before the hard-delete cron permanently wipes the rows. After 30 days the deletion is irreversible.

Right to data portability (Article 20) — Self-serve. Use the "Portability" option in the "Your data rights" section to export all your data in a machine-readable format (JSON + CSV). The payload is identical to the Article 15 access export; the framing in metadata.txt is the only difference (portability requests carry an explicit Article 20 cover sheet for transfer to another service).

Right to restrict processing (Article 18) — Use the in-app contact form to request that we stop processing your data while a complaint is being resolved.

Right to object (Article 21) — Self-serve for marketing emails: use the one-click unsubscribe link in any email, or toggle the Newsletter preference in your account settings. For other legitimate-interest processing, use the in-app contact form.

Right to withdraw consent — Self-serve for the common cases: click the unsubscribe link in any email, update your cookie preferences from the cookie banner or account settings, or delete your account from the Danger Zone. For anything not covered by a self-serve control, use the in-app contact form.

Right to lodge a complaint — EU/EEA residents may file a complaint with their national Data Protection Authority (directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en). UK residents may file with the Information Commissioner's Office at https://ico.org.uk. California residents may file with the California Attorney General's Office at https://oag.ca.gov/privacy. Residents of other jurisdictions may file with the supervisory authority responsible for data protection where you live.

Rate limits + audit trail. Each request type (access, deletion, portability) is capped at one self-serve submission per 24 hours per account to prevent abuse; the in-app form will tell you when you can submit again. Every state transition on every request (submitted, fulfilled, failed, downloaded) is written to our audit log with no personal data in the payload — only request id, request type, and per-table row counts. Audit log rows are retained for 180 days per our retention policy.

Automated decision-making (GDPR Art 22 / UK DPA 2018 s.14)

AskTheRecruiter uses AI to analyze your resume against a job description and to generate suggested edits, cover-letter copy, and interview-prep material. We want to be explicit about what this means for you under GDPR Article 22 and the UK Data Protection Act 2018 section 14:

What the AI does. The AI compares your resume text to the job-description text and produces (a) a "fit" analysis, (b) suggested rewrites at the bullet / paragraph level, (c) optional cover-letter and interview-prep drafts. The logic behind each suggestion is the language model's pattern-matching across many resumes and job descriptions — there is no rules-based "score" that gates anything you do.

You are always in the loop. Every AI output is presented to you for review. Nothing is sent on your behalf. The Detailed Edit surface requires you to accept or reject each suggestion individually before it appears in your final resume. You can ignore, edit, or discard any AI output at any point.

No automated decision affects your legal rights. We do not make hiring decisions, we do not score candidates against each other, and we do not communicate with employers on your behalf. The hiring decision rests entirely with the human employer who reads the resume you ultimately submit. AskTheRecruiter is a candidate-side career-preparation tool — not an HR screening, scoring, or ranking system.

Right to human review. Even though no decision is fully automated, you may at any time request human review of any AI output via the in-app contact form. We aim to respond within 3 business days (statutory ceiling is 30 days). You also have the right to object to AI-assisted processing under GDPR Art 21 — to exercise it, use the "Delete my account" self-serve button in your account settings, which closes your account and deletes your data per the "Right to erasure" section above.

Meaningful information about the logic. We route AI requests through OpenRouter, which forwards each request to one underlying large-language-model (LLM) provider from a list we have approved. Today every request runs on the Anthropic Claude family (Sonnet and Haiku models), routed by task; OpenAI GPT (4o and 4o-mini families) and Google Gemini families remain approved fallbacks but are not currently active. We may change which approved provider is active over time; the "Sub-processors" section above always reflects the full approved set, and we prompt signed-in users to re-accept if the active provider changes. The prompts are written by us and instruct the model to (a) preserve all factual claims in your resume, (b) suggest only re-phrasings — never invent experience, employers, dates, or credentials, and (c) emphasise alignment with the keywords and seniority signals in the job description. Output is validated against an anti-fabrication rule before being shown to you; suggestions that introduce unsupported claims are rejected by our backend before they reach your screen.

Your rights under California law (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information we have collected
• Right to correct inaccurate personal information
• Right to opt out of "sale" or "sharing" of personal information — we do not sell or share your personal information, as those terms are defined under California law
• Right to limit use of sensitive personal information — we do not use any data we collect for purposes beyond delivering the service

To exercise any of these rights, use our in-app contact form at https://asktherecruiter.com/contact. We will not discriminate against you for exercising your rights.

Sensitive personal information (CPRA §1798.140(ae))

We acknowledge that resume content routinely contains information classified as Sensitive Personal Information under the California Privacy Rights Act §1798.140(ae). Depending on what you choose to include in your resume, this can include:

• Precise geolocation — your home address or city.
• Racial or ethnic origin — inferable from work-permit status, language certifications, or international education history.
• Religious beliefs — inferable from observance gaps or faith-based organisation affiliations.
• Health information — present in medical-class resumes (clinicians, healthcare workers) or in disability-accommodation disclosures.
• Sexual orientation — present in ERG (Employee Resource Group) line items or LGBTQ+ advocacy affiliations.

We process this Sensitive Personal Information for the single, explicit purpose of resume tailoring against the job description you provide. We do not use it for any other purpose — no profiling, no advertising, no cross-context behavioural inference. Under CPRA §1798.121 you have the right to limit the use of your Sensitive Personal Information; because our only use is service delivery (the purpose you came here for), exercising this right is equivalent to deleting your account. To opt out at any time, use the "Delete my account" button in your account settings — this is a self-serve action; we cannot opt you out on your behalf because the data lives in your account.

Your rights under Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information / Loi 25)

If you are a Quebec resident, Quebec's An Act to modernize legislative provisions as regards the protection of personal information ("Law 25" / "Loi 25") applies to our processing of your personal information. In particular:

Explicit consent for automated processing (s.12.1). Section 12.1 of the Act requires explicit, distinct consent before subjecting an individual to a decision based exclusively on automated processing of their personal information. As described in the "Automated decision-making" section above, AskTheRecruiter never makes a decision about you based exclusively on automated processing — every AI output is presented for your review and acceptance before it becomes part of your final resume, and we do not communicate with employers on your behalf. By creating an account and clicking "Generate" you provide explicit consent for the AI-assisted resume analysis and suggestion generation described in this policy. You may withdraw that consent at any time by deleting your account; we will hard-delete your data within 30 days per the retention table above.

Right to information about the decision (s.12.1 second paragraph). You may at any time request meaningful information about the AI processing performed on your resume, including a plain-language description of the principal factors and parameters that led to a particular suggestion. The "Meaningful information about the logic" paragraph in the GDPR Art 22 section above is provided in fulfilment of this right; for any case-specific question, use the in-app contact form at https://asktherecruiter.com/contact.

Right to portability (s.27). You can export all your data in a machine-readable format using the "Export my data" button — the same bundle that satisfies GDPR Art 20 and CCPA Right-to-Know.

Designated person for protection of personal information. The person responsible for the protection of personal information under Law 25 is the operator of AskTheRecruiter.com, reachable via the in-app contact form at https://asktherecruiter.com/contact.

Complaint right. You may file a complaint with the Commission d'accès à l'information du Québec at https://www.cai.gouv.qc.ca.

Your rights under Colorado law (Colorado AI Act / SB 205)

Consumer notice under Colorado SB 205 §6-1-1703(4) (effective 1 February 2026). AskTheRecruiter uses artificial intelligence to analyse your resume and generate tailored suggestions. Under Colorado's Artificial Intelligence Act we are required to notify Colorado consumers of the following:

• Classification. AskTheRecruiter is a general-purpose AI career-preparation tool — not a "high-risk AI system" as defined in §6-1-1702(6) of the Act. Consequential employment decisions (whether to extend a job offer) are made exclusively by the human employer; we do not make, communicate, or participate in employment decisions.
• Nature of AI use. We use large-language-model APIs to generate resume-tailoring suggestions, cover-letter drafts, and interview-preparation content. Every output is presented to you for review before you choose to use it; no output is automatically submitted to any employer on your behalf.
• Human oversight. All AI-generated content is advisory. You accept, reject, or edit suggestions at your discretion before any use.
• Opt-out. Because AI assistance is the core service, the functional opt-out is account deletion (Account → Danger Zone → Delete my account). Your personal data will be removed within 30 days.
• Contact. Questions about this notice may be directed via our in-app contact form at https://asktherecruiter.com/contact, or to the Colorado Attorney General at coag.gov.

Your rights under Canadian federal law (PIPEDA)

If you are a Canadian resident (outside Quebec, which is covered separately above), the Personal Information Protection and Electronic Documents Act ("PIPEDA") applies to our processing of your personal information.

Your PIPEDA rights (Principle 9 — Individual Access):

• Access — request a copy of the personal information we hold about you and learn how it is used and disclosed. Use the "Export my data" button in your account for instant machine-readable access, or submit a formal request via the in-app contact form.
• Correction — challenge the accuracy or completeness of your personal information; we will correct, delete, or annotate the data as appropriate.
• Withdrawal of consent — withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Deleting your account is the self-serve mechanism.
• Complaint — file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca if you are dissatisfied with our response.

Breach notification (PIPEDA s.10.1 + Breach of Security Safeguards Regulations). If we experience a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we will:

1. Notify the OPC as soon as feasible, and in any event within 72 hours of determining the breach creates real risk of significant harm.
2. Notify you directly as soon as feasible after notifying the OPC.
3. Maintain a breach record for a minimum of 24 months.

We will notify you by email to your registered address. If direct notification is not practicable, we will post a conspicuous notice on our website.

Your rights under Brazilian law (LGPD)

If you are a Brazilian resident, Brazil's Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018, "LGPD") applies to our processing of your personal data.

Legal basis for processing (Art 7). We process your personal data under Art 7(V) (performance of a contract or pre-contractual procedures at your request) and, where applicable, Art 7(I) (your consent). For sensitive personal data that may be present in resume content (racial or ethnic origin, health information, or similar categories inferable from your resume), we rely on Art 11(II)(a) (explicit consent provided when you submit a resume for processing).

Your LGPD rights (Art 18):

• Confirmation — confirm that we process your personal data and learn how.
• Access — obtain a copy of your personal data (use the "Export my data" button in your account).
• Correction — correct incomplete, inaccurate, or outdated data.
• Anonymisation, blocking, or deletion — request anonymisation of unnecessary data, or deletion of data processed with your consent (use "Delete my account").
• Portability — receive your data in a structured, interoperable format (use "Export my data").
• Information about sharing — learn which third parties we share your data with (see sub-processors section above).
• Revocation of consent — withdraw consent at any time (deleting your account is the mechanism; data removed within 30 days).
• Review of automated decisions — request human review of any decision made solely by automated means that affects your interests. Because we never make employment decisions and all AI outputs are advisory, this right does not routinely apply; but we will honour any such request received via the contact form.

Supervisory authority. You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at https://www.gov.br/anpd.

Responsible person. The operator of AskTheRecruiter is the data controller for LGPD purposes and is reachable via the in-app contact form at https://asktherecruiter.com/contact.

Cookies

We use essential cookies required for the service to function, plus a small number of analytics cookies for high-level pageview tracking:

We do not use advertising cookies or third-party cookies for behavioral profiling. Google Analytics is configured with anonymize_ip: true and with advertising features disabled. Mixpanel analytics use anonymized event tracking stored in localStorage (not cookies); autocaptured DOM interactions never include the contents of form inputs.

Cookie consent

On your first visit you will see a non-blocking cookie banner with three options:

• Accept all — enables strictly-necessary cookies, analytics (Mixpanel + Google Analytics 4), and any future marketing cookies.
• Necessary only — enables only the strictly-necessary cookies needed for sign-in and session management. Mixpanel, Google Analytics, and Sentry will not initialize and no events will be sent.
• Customize — opens a panel where you can independently toggle "Analytics" and "Marketing" categories before saving your choice.

We currently do not set any marketing cookies; the "Marketing" toggle is provided so you can pre-decide if we ever add third-party widgets in the future. Until you have made a choice, no analytics or error-monitoring scripts will run.

You can change your preferences at any time from the Account → Cookie preferences page. Updated choices take effect immediately on the same device.

Jurisdiction-specific cookie banner overrides

Effective v0.9.554 (2026-05-17) the cookie banner adapts to the visitor's jurisdiction so the layout matches the local consent standard. Six jurisdictions are supported at launch: US, EU (generic), UK, Canada, Australia, and Germany. The detection is based on your browser's Accept-Language header (or an explicit ?country=XX URL override). We do not geolocate by IP address. If we cannot determine your jurisdiction, the banner defaults to the strictest layout (EU/GDPR).

The full per-jurisdiction policy table is published in docs/JURISDICTION_POLICIES.md for transparency. The summary below covers the user-visible differences.

<a id="eu-uk-gdpr"></a>EU + UK (GDPR / UK-GDPR + PECR)

• Banner layout: Equal-prominence "Accept all" and "Necessary only" buttons per EDPB Guidelines 03/2022 §5.4 and the ICO consent guidance.
• Default analytics: OFF until you explicitly accept.
• Retention: 30 days for user-deletion / inactivity purge (GDPR Art 5(1)(e) data minimisation).
• DSAR (Data Subject Access Request): Available via Account → "Download all my data".

<a id="de-ttdsg"></a>Germany (TTDSG §25)

• Banner layout: "Necessary only" appears as the FIRST visible affirmative-action button (above "Accept all") per BGH "Planet49" (I ZR 7/16, May 2020) and BfDI guidance.
• Default analytics: OFF until you explicitly accept.
• Retention: 30 days.
• DSAR: Available.

<a id="us-ccpa"></a>United States (CCPA + CPRA)

• Banner layout: Lighter — "Accept all" and "Manage preferences" on the front surface; "Necessary only" reachable from the Manage-preferences modal.
• Default analytics: OFF (product choice — California law does not strictly require affirmative-action for first-party analytics, but we keep the OFF default for parity).
• Retention: 90 days.
• DSAR: Available (CCPA §1798.110 right to know).
• Global Privacy Control (GPC): Honored — if your browser sends the GPC signal we record a "necessary only" decision automatically and the banner does not appear.

<a id="ca-pipeda"></a>Canada (PIPEDA + Quebec Law 25)

• Banner layout: Lighter (Accept-all + Manage preferences).
• Default analytics: OFF.
• Retention: 90 days.
• DSAR: Available (PIPEDA Principle 9 + Quebec Law 25 access right).

<a id="au-privacy-act"></a>Australia (Privacy Act 1988 + APPs)

• Banner layout: Lighter (Accept-all + Manage preferences).
• Default analytics: OFF.
• Retention: 90 days.
• DSAR: Available (APP 12 access right).

Children

AskTheRecruiter is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data and you do not have access to that child's account, use the in-app contact form at https://asktherecruiter.com/contact (subject: "Privacy") and we will delete the data once we have verified the request. If you do have access to the account, the fastest path is to sign in and click "Delete my account" in the Danger Zone — that is a self-serve action that wipes the data immediately.

International data transfers

We are a US-based operator (Wyoming) serving users globally. Your data may be transferred to and processed in the United States and other jurisdictions by our AI providers (OpenRouter, Anthropic, OpenAI, Google), payment processor (Stripe), email provider (Resend), analytics/monitoring tools (Mixpanel, Google Analytics, Sentry), and security/infrastructure providers (Cloudflare, Upstash). For EU/UK/Swiss users, these transfers are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission, the UK ICO addendum, and the Swiss FDPIC where each applies
• Data Processing Agreements (DPAs) with each sub-processor
• The providers' compliance certifications (SOC 2 Type II for Supabase, Stripe, Anthropic, and others)
• The EU-US Data Privacy Framework where the provider is certified (https://www.dataprivacyframework.gov)

Note on AI-provider transfers. Our routed LLM providers (Anthropic, OpenAI, Google) are located in the United States. We do not currently route to any AI provider whose primary infrastructure is located in a jurisdiction without an EU Commission adequacy decision or equivalent transfer mechanism. For EU / EEA / UK / Swiss data subjects, transfers to these US-resident providers rely on Standard Contractual Clauses (Module 2 / Module 3 — executed via OpenRouter's routing-layer DPA) plus the EU-US Data Privacy Framework where the provider is certified. In all cases we send only the resume + job description text; no email, name, account ID, IP address, billing identifiers, or device identifiers are attached to the request body.

Security measures

We implement the following security measures to protect your data:

• All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
• Row-Level Security on all database tables
• Passwordless authentication (magic links) — no password database to breach
• Rate limiting on all API endpoints (10 requests per minute per user for AI processing)
• Resume text excluded from application logs
• API keys stored as environment variables, never in source code
• Regular dependency updates and security monitoring via Sentry
• DKIM, SPF, and DMARC configured on asktherecruiter.com for transactional email authentication (via Resend)

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes — including adding or removing a sub-processor, changing the AI provider, or expanding what data we collect — we will notify you by email (if you have an account) and require re-acceptance on next sign-in. The "Last updated" date at the top of this page reflects the date of the most recent change. Your continued use of the service after non-material changes are posted constitutes acceptance.

Contact us

If you have questions about this Privacy Policy or your personal data, use our in-app contact form:

Contact form: https://asktherecruiter.com/contact Location: Wyoming, United States

The contact form attaches diagnostic context (your account ID, browser type, page you're on) which lets us route and answer faster than email. For data protection complaints you may also file with the supervisory authority listed under "Right to lodge a complaint" above.

Last updated: May 21, 2026