Last updated: July 24, 2026
This policy describes how Resume Master handles the personal data contained in résumés and candidate profiles processed through Resume Master, including when we act as a processor for organization customers.
For individual users, we act as a data controller of account data and a processor of the résumé content you submit. For organization customers, the organization is the controller of its candidates’ data and we act as its processor under a Data Processing Agreement (available on request at team@resumemaster.online).
Identity and contact details, employment and education history, skills, and any other information included in a résumé or provided during a résumé-understanding call. We ask that you do not submit special-category data (e.g. health, religion) unless strictly necessary.
Résumé content submitted for AI assistance is transmitted to Anthropic to generate drafting, tailoring, and scoring output. We seek to operate under Anthropic’s commercial terms with a data-processing addendum and a zero-retention / no-training configuration for submitted content. Web-search features used during research may transmit non-candidate query terms (company/role/field) to a search provider.
Each customer’s data is isolated at the database layer (row-level security keyed to the account), so one customer can never read another’s records. Staff access is limited to what is required to deliver a request; privileged operations are logged. Optional two-factor authentication protects administrator accounts.
We retain candidate data for the duration of the engagement and delete or return it within 30 days of account closure or on documented request, subject to legal retention requirements.
Data may be processed in the regions operated by our hosting provider (Supabase) and by sub-processors in other jurisdictions. Where required, transfers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.
In the event of a personal-data breach affecting your data, we will notify the affected controller/customer without undue delay and within 72 hours of becoming aware, with the information needed to meet applicable reporting obligations.
Organizations may request our Data Processing Agreement and current sub-processor list at team@resumemaster.online. A Data Protection Impact Assessment should be completed before onboarding EU-based organization data.