Resume Nexus

Privacy Policy

Last updated: October 11, 2026

This Privacy Policy describes how Guardian Nexus LLC ("we," "us," or "our") collects, uses, and protects your information when you use Resume Nexus ("the Service").

1. Information We Collect

Account Information

When you create an account, we collect:

  • Your name and email address
  • A password (hashed - we never store or access your plaintext password)
  • If you sign in with Microsoft, the name and email address on your Microsoft account, which we store in your account record. Our authentication provider keeps the sign-in identity Microsoft returns (your Microsoft account identifier, name, and email address) so you can sign in again.

Uploaded Content

When you use the Service, you may upload or paste:

  • Resumes (PDF, DOCX, or TXT files, or pasted text)
  • Job descriptions (PDF, DOCX, or TXT files, or pasted text)

Important: Resumes and job descriptions may contain personally identifiable information (PII) of job candidates. You are responsible for ensuring you have the right to upload and process this information.

AI Provider Credentials

If you choose to use your own AI provider API key, the key is encrypted at rest using industry-standard encryption (Fernet/AES-128-CBC). Plaintext keys are never stored or logged.

Usage Data

We automatically collect:

  • Screening session metadata (timestamps, document counts, AI provider and model used)
  • Audit logs of account actions (uploads, screenings, settings changes, data deletion)
  • The IP address of the request, recorded in the audit log for those account actions, and once at registration for abuse prevention

Server logs contain no filenames, email addresses, resume content, or other PII. They record internal IDs and action types only.

The audit log records IP addresses as described above. IP addresses are cleared from audit records after 90 days; the record of the action itself is kept.

2. How We Use Your Information

  • To provide the Service: Processing resumes and job descriptions through AI analysis.
  • To authenticate you: Managing your account and sessions.
  • To improve the Service: Aggregated, anonymized usage statistics (never individual content).
  • To communicate with you: Account emails (verification, password reset, security, onboarding, trial, and billing emails).

3. Third-Party AI Processing

To perform screening analysis, your uploaded resumes and job descriptions are sent to an AI provider. By default that is our AI provider, which processes your content only to score it; Section 5 states how long it keeps that content and that it does not use it to train models.

You may instead supply your own API key in Settings for one of these providers. Your content is then sent to that provider under your own agreement with it, and its terms and privacy policy apply in place of the commitments in Section 5:

We encourage you to review their current policies directly.

4. Data Storage and Security

  • Account data and screening results are stored in Supabase (PostgreSQL) with Row Level Security ensuring data isolation between users.
  • Uploaded files are stored in Supabase Storage with per-user path isolation.
  • All data is encrypted in transit (TLS/HTTPS) and at rest.
  • API keys are encrypted using Fernet symmetric encryption before storage.
  • We implement rate limiting and input validation.

5. Data Retention

Candidate data (resumes, job descriptions, screening sessions, and results, including stored files) is kept for the period that applies to your plan and then permanently deleted by a nightly job:

  • Free trial: 7 days
  • Starter: 30 days
  • Professional: 1 year
  • Enterprise: custom, set per agreement

You may choose a shorter period in Settings (minimum 7 days). The period follows your current plan: upgrading extends it on everything not yet deleted; downgrading shortens it 7 days after the change. Suspended accounts keep their data for 30 days after suspension, after which it is deleted.

You may delete all your data, or close your account, at any time via Settings. Deletion is permanent and includes all resumes, job descriptions, screening sessions, results, and stored files. Deleted data may remain in encrypted database backups for up to 14 days before it is overwritten. Audit records of account actions are kept; they lose their IP address after 90 days and are not linked to a deleted account.

Resumes and job descriptions are sent to our AI provider only to score them. Our provider deletes them within 30 days and does not use them to train models, unless its automated systems flag them for a usage policy violation or the law requires longer retention. If you use your own AI provider, that provider's terms apply instead.

6. Data Sharing

We do not sell, rent, or share your personal information or uploaded content with third parties, except:

  • AI providers: As described in Section 3, to perform screening analysis.
  • Infrastructure providers: Supabase (database, authentication, storage), Vercel (web hosting), Render (API hosting and processing), Stripe (billing), Resend (email delivery) - operating as data processors under their respective DPAs.
  • Legal compliance: If required by law, regulation, or valid legal process.

7. Your Rights

You have the right to:

  • Access your data through the Service interface.
  • Export your screening results (Excel or HTML format).
  • Delete any or all of your data at any time.
  • Close your account, which triggers permanent deletion of all associated data.

8. Cookies

We use strictly necessary cookies for authentication and session management. We do not use advertising or tracking cookies. No third-party analytics are embedded in the Service.

9. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top indicates when the policy was last revised.

11. Contact

For privacy-related questions or to exercise your data rights, contact us at support@resumenex.us.