Privacy Policy

1. Introduction

Smart Match ("we", "our", or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, process, and protect your information in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Scope of This Policy

This Privacy Policy applies to the following Smart Match products and services (collectively, the "Service"):

• Smart Match web app at smartmatch.wallstrdev.com
• Smart Match Chrome extension
• Smart Match Firefox add-on
• Smart Match iOS app

Some features and data practices differ by product. Where there are differences, we explain them below.

3. Data Controller

Smart Match is the data controller responsible for your personal data. For any questions regarding data protection, you can contact us at: [email protected]

4. Information We Collect

4.1 Account Information

• Email address (required for account creation, authentication, and service notifications)
• Display name (optional)
• Password (encrypted and managed by AWS Cognito; we never see or store it directly)

4.2 Resume Analysis and Structured Resume Data (Web App)

When you upload a resume PDF for analysis in the web app, the following data is stored on our servers and linked to your account:

• Resume file (PDF) — job/match analysis: Transmitted securely to our analysis service and immediately discarded — not stored on our servers
• Resume file (PDF) — resume profile feature: When you use the Resume Profiles feature, your PDF is uploaded to our secure AWS S3 storage (encrypted at rest, access-controlled) and processed by our AI pipeline to extract structured resume data. The file remains in your private S3 folder, accessible only by your account, and is deleted when you delete your account or the associated resume.
• Extracted structured resume data: When you upload a resume PDF for analysis, our AI pipeline extracts structured fields — including your name, contact details (email, phone, location, LinkedIn, GitHub, website), work experience, education, skills, and certifications — and stores them in your private account. This data is stored in our database, linked only to your account, and never shared with third parties except as described below.
• Job posting URL and page content: Stored to power your job history
• Analysis results: Match score, recommendation, reasoning, resume gaps, suggested improvements, and generated cover letter — stored in your account history
• Job metadata: Job title, company name, benefits, application instructions, location, salary range, and job type — stored when extracted from the job posting
• Job notes: Any personal notes you add to a job record are stored on our servers
• Application status: The application tracking status you set (e.g., Applied, Interview) is stored on our servers
• User-reported salary: If you enter your expected salary range for a role (minimum and maximum), it is stored privately on our servers and linked to your account. It is never exposed publicly — not on share pages, not in any public API. A separate anonymous record (job title, location, salary range, currency — no user identity) is also contributed to our community salary database to improve market data for all users.
• Market salary cache:When you view a job's salary benchmarks, we fetch data from third-party sources (Adzuna, BLS) and cache the result server-side (up to 7 days) to avoid redundant API calls. This cached data is private and linked to your job record.

4.3 Community Salary Data

When you save a salary range for a job, we create an anonymous community salary record containing:

• Job title, location (if available), currency, minimum salary, maximum salary
• No user identifier, email address, or account reference of any kind

These records are reviewed by our admin team (approved or rejected) and used in aggregate to provide market salary benchmarks to other users. They are fully anonymized and cannot be linked back to you. Community salary data is retained indefinitely in aggregate form; however, any salary data tied to your individual job records is subject to your data retention preference and deleted accordingly.

4.3b Publicly Shared Resume Profile Data

You may optionally share your structured resume profile (extracted work experience, education, and skills) via a public link. Sharing is off by default and requires explicit opt-in. When you enable resume profile sharing:

• Your name and location may be visible on the public page
• Your professional links (LinkedIn, GitHub, website) may be visible if extracted
• Work experience, education, skills, and certifications are shown
• Your email address and phone number are NEVER shown on any public page, even when you enable sharing
• Public resume pages are always marked noindex — they are never indexed by search engines

You can revoke a resume share link at any time from the resume detail page. Revocation immediately makes the page inaccessible.

4.4 Publicly Shared Job Analysis Data

You may optionally generate a public share link for any completed job analysis. Sharing is off by default. When you enable sharing:

• Default (no personal data): Only job metadata (title, company, location, salary, job type, requirements) and an aggregate average match score are visible. The aggregate score is computed from all users who have analyzed the same job posting and is fully anonymized — no individual user or score is identifiable. These pages are indexed by search engines and listed in our public /companies directory.
• If you opt in to personal data: You may additionally choose to share your resume gaps and/or resume improvement suggestions. When you do, your individual match score and AI recommendation are also shown (instead of the aggregate average). Pages containing personal data are marked noindex and excluded from search engine indexing and the /companies directory.

You can revoke a share link at any time from the job detail page. Revocation immediately makes the page inaccessible to new visitors.

You may also invite others to view a shared analysis by sending them an invitation email via our service. The recipient's email address is used solely to deliver that single invitation and is not stored or used for any other purpose.

4.4 Usage Data

• Web app (authenticated users): Daily analysis counts are recorded on our servers to enforce plan limits and are subject to your data retention preference
• Browser extensions and anonymous web app usage: Daily usage counts are stored locally in your browser only and are never sent to our servers

4.6 Notifications

For authenticated web app users, we store in-app notifications on our servers (e.g., "Your analysis is ready") so they persist across sessions. We also send email notifications to your registered email address when a job analysis completes, including a summary of results and a link to view the full report.

4.7 Payment Information

• Web app and browser extensions: payment details are processed and stored by Stripe (our payment processor)
• iOS app: purchases are processed by Apple In-App Purchases
• We do not store your credit card information on our servers
• We receive transaction confirmations and subscription status from Stripe or Apple

4.8 Service Monitoring and Diagnostics

• We use New Relic to monitor uptime, performance, and errors in our applications
• This monitoring may include technical data such as request metadata, crash/error logs, device/browser information, and IP address
• We use this data only to operate, secure, and improve the Service, not to sell your data or for third-party marketing

5. Legal Basis for Processing

We process your personal data based on:

• Contract Performance: To provide our resume analysis services and job history features
• Consent: For email notifications; you can opt out at any time by contacting us
• Legitimate Interests: To enforce usage limits, improve our services, and prevent fraud
• Legal Obligation: To comply with tax and financial regulations

6. How We Use Your Information

• To provide and improve our resume analysis services
• To store your job analysis history so you can review and track past analyses
• To send in-app and email notifications when your analysis is complete
• To authenticate your identity and manage your account
• To process payments and manage subscriptions through Stripe or Apple
• To enforce daily usage limits
• To compute anonymized aggregate match scores for public job and company pages (no individual user or score is identifiable)
• To fetch and cache market salary benchmarks (Adzuna, BLS) for display in your private job records
• To aggregate anonymous community salary reports into market range estimates shown to all users
• To monitor reliability, detect incidents, and troubleshoot issues using New Relic
• To send essential service-related communications only

7. Data Sharing and Third Parties

We share your data only with trusted service providers:

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

8. Data Retention

• Account Information: Retained as long as your account is active
• Resume Files (job/match analysis): NOT stored — transmitted for analysis and immediately discarded
• Resume Files (Resume Profiles feature): Stored in your private AWS S3 folder (encrypted at rest). Deleted when you delete the associated resume or your account.
• Extracted structured resume data (contact, work experience, education, skills, certifications): Stored in our database linked to your account. Subject to your data retention preference and deleted with your account.
• Job Analysis Records (results, notes, notifications, usage events, user-reported salary, market salary cache): Retained on our servers according to your data retention preference, which defaults to 365 days and can be configured between 30 and 3,650 days in your account settings. Records older than your retention preference are automatically deleted.
• Community Salary Reports: Anonymous aggregate records (no user identity) retained indefinitely to maintain salary benchmark quality. Individual salary data stored on your job records is deleted according to your retention preference.
• Payment Records: Managed by Stripe or Apple according to their retention policies and legal requirements

You can export all your stored data or permanently delete it at any time from your account settings.

9. Your Controls and GDPR Rights

You have the following controls directly within your account settings:

• Data Retention Period: Configure how long your job history and usage data are kept (30–3,650 days)
• Export Your Data: Download all your stored data in a machine-readable format
• Delete Your Data: Permanently delete all your stored job records, notes, notifications, and usage data

Under GDPR, you also have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (e.g., opt out of email notifications)

To exercise these rights, contact us at [email protected]

10. Cookies and Tracking

Cookies are used only on the web app. The browser extensions and iOS app do not use cookies.

We use the following types of cookies:

• Essential Cookies: Required for authentication and core functionality
• Analytics Cookies: To understand how you use our service (with your consent)
• Preference Cookies: To remember your settings (e.g., dark mode)

You can manage cookie preferences through our cookie consent banner or your browser settings.

11. Data Security

We implement industry-standard security measures to protect your data:

• End-to-end encryption for data transmission (HTTPS/TLS)
• Secure authentication managed by AWS Cognito
• Server-side data stored in encrypted PostgreSQL databases
• Regular security audits and updates
• Access controls and data minimization principles

12. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• AWS and Stripe GDPR-compliant data processing agreements
• Adequacy decisions for certain countries

13. Children's Privacy

Our service is not intended for users under 16 years of age (or the minimum age required by local law). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through a prominent notice on our website. Continued use of our service after changes constitutes acceptance of the updated policy.

15. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority in the EU.

16. Contact Us

For questions about this Privacy Policy or to exercise your rights: