Legal
Privacy Policy
Last updated: June 2026
1. Data we collect
Account data (name, email, and a bcrypt hash of your password — never the plaintext; plus your Google profile name and email if you sign in with Google). Service data (the resumes and job descriptions you submit, and the resulting scores and reports). Billing data (a record of your purchases via our payment processor — we never receive or store your card details). Technical data (IP address, request logs, and usage analytics used to operate and secure the service).
2. How we use your data
To provide resume scoring and ranking; to maintain your credit balance and process purchases; to operate, secure, debug, and improve the service and prevent fraud and abuse; and to respond to support requests. We do not sell your data, and we do not use uploaded resumes to train third-party models.
3. Resume processing
Uploaded files are parsed in memory to extract text for scoring and are not written to disk as files. Semantic embeddings are computed in memory at scoring time and are not persisted. The extracted scoring results are stored against your account so you can revisit them in your dashboard, and the working copy of the resume text is purged once scoring completes.
4. Legal bases (EEA/UK users)
Where the GDPR or UK GDPR applies, we process your data on the bases of: performance of our contract with you (to provide the service); our legitimate interests (to secure and improve the service and prevent abuse); your consent (e.g. optional analytics); and compliance with legal obligations.
5. How we share data
We do not sell your data. We share it only with service providers that help us run Rankid: Creem (payment processing and merchant of record — card details are handled by Creem and never touch our servers); cloud and server infrastructure providers that host the service; an email provider used to deliver contact-form and transactional messages; Google (only if you choose Google sign-in); and analytics providers (see Cookies & analytics). These providers are bound by data-processing agreements and may only use the data to provide their service to us.
6. International data transfers
Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions to protect your data when it is transferred internationally.
7. Data retention
We retain account and scoring data for as long as your account is active. You can delete individual analyses, or request full account deletion, after which we remove your personal data within 30 days — except where we are required to retain certain records (such as billing/invoice records) by law.
8. Security
Data is encrypted in transit (TLS). Passwords are hashed with bcrypt; access tokens are short-lived and refresh tokens are stored hashed and rotated on each use; payment webhooks are verified with HMAC-SHA256 signatures. We follow least-privilege practices for internal access to production data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent or object to certain processing. California residents have rights under the CCPA, including the right not to be discriminated against for exercising them. To exercise any of these rights, contact us; you also have the right to complain to your local data-protection authority.
10. Cookies & analytics
We use essential cookies required for sign-in and session management. We also use, or may use, privacy-friendly product analytics — such as Microsoft Clarity and Google services — to understand how the product is used and improve it. Where required by law, optional analytics are used only with your consent, and you can manage your preferences through your browser or our site controls.
11. Children
Rankid is not intended for anyone under 16. We do not knowingly collect personal data from children; if we learn that we have, we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the product or by email, and the “last updated” date above will change. Continued use after an update constitutes acceptance.