Privacy Policy

What we collect

When you analyse a resume we collect:

• The resume file you upload, and the text extracted from it. A resume typically contains your name, contact details, employment history, education, and whatever else you chose to put on it.
• Your email address, so we can send you the result and reach you about it.
• The original filename of the upload.
• The job description, if you paste one in for a keyword comparison.
• The analysis we generate from the above: your attention score, section breakdown, and written feedback.
• A visitor identifier used to link repeat scans from the same browser.

How long we keep it

Two different things happen to two different pieces of data, and the distinction matters:

• The uploaded file is deleted as soon as the analysis finishes — on success, and also when the analysis fails. It is not archived or backed up.
• The text we read out of that file is kept for 30 days, then automatically erased by a scheduled job. We keep it that long so you can reopen a past result, re-scan a revised resume against the original, and use the rewrite tools without re-uploading — the same 30 days as the re-scan window you get with a purchase.
• The analysis itself is kept — your score, section breakdown, and written feedback. Once the 30 days are up these no longer contain your resume text, and any paid report you bought stays available to you.

If you want the text gone sooner than 30 days, or want the whole record removed, email us. See Your choices below.

Who else processes it

We use a small number of third-party services. Each one receives only what it needs:

• OpenAI — the text of your resume is sent to OpenAI's API to generate the written feedback and rewrite suggestions. This is the only third party that receives your resume content.
• Dodo Payments — our merchant of record. If you buy a report, Dodo handles the transaction and your payment details. We never see or store your card number. We store only the resulting order identifier.
• Google Analytics 4 — page views and aggregate usage. We do not send it your resume, your email address, or your analysis.
• Our email provider — receives your email address in order to deliver the messages you asked for.

We do not sell your data, and we do not share it with recruiters, employers, job boards, or advertisers.

Legal basis and where data is held

We process your resume to deliver the analysis you requested (contractual necessity) and to operate and improve the service (legitimate interest). Our servers and the third parties above operate in the United States and the European Union, so your data may be transferred outside your country of residence.

Your choices

You can ask us to:

• Send you a copy of everything we hold about you.
• Delete your analyses and the retained resume text.
• Correct anything that is wrong.
• Stop emailing you — every email we send has a one-click unsubscribe link.

Email research@resumeheatmap.com and we will action it. Depending on where you live, the GDPR or the CCPA may give you these rights as a legal entitlement; we extend them to everyone regardless.

Cookies

We set a session cookie to keep you signed in and to carry your analysis between pages, and a CSRF cookie to protect form submissions. Both are strictly necessary for the site to work. Google Analytics sets its own cookies for usage measurement.

Children

ResumeHeatMap is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change how we handle your data we will update this page and move the date at the top. Material changes will be announced by email to anyone who has given us an address.

Contact

Questions about any of the above: research@resumeheatmap.com.