01 — What we collect
Information tied to how the product actually works
- Account & authentication. If you create an account, we process your email address and credentials through our auth provider. You can sign in with email (including one-time codes or magic links) or with "Continue with Google," which shares limited profile information from Google as part of that login flow. Optional security features (such as two-factor authentication) may collect additional verification data.
- Resume files & job descriptions. When you run a scan, you upload resume files (for example PDF) and paste or enter JD text. We may also store a client-generated preview image of the first page of a PDF to power analysis. These materials are stored in our systems (database and secure file storage), not discarded immediately—so we can show your results, your scan history when you are signed in, and purchased reports.
- Derived analysis & reports. We generate and store outputs such as extracted resume text (where applicable), preliminary scores, keyword match lists, and—after you unlock or subscribe—full structured reports (for example section scores, missing keywords, and action items). These are linked to your scan record (and to your account when you are logged in).
- Payments & billing. If you pay for a one-time unlock or a subscription, our payment processor (Stripe) receives the information needed to complete the transaction. We do not store full payment card numbers on our own servers; Stripe handles card data according to its policies and industry standards.
- Transactional email. We send service-related messages (for example payment confirmations, subscription or security notices, and account flows) using our email delivery provider. We do not sell your email address for unrelated marketing.
- Security & technical data. We use Cloudflare Turnstile to reduce automated abuse on sensitive actions (such as starting a scan in production). That process may involve challenge tokens and related metadata. We also collect typical server and application logs (such as IP address, timestamps, and error diagnostics) needed to operate and protect the Service.
- Cookies & similar technologies. We and our service providers (including Cloudflare and Stripe) may set cookies or similar browser storage to keep you signed in, remember session state, prevent fraud, and process payments. We do not run third-party advertising or behavioral tracking cookies. You can control cookies through your browser settings, though disabling them may affect sign-in and payment flows.
02 — How we use data
Purposes that match the workflow above
- Run ATS-style scoring, keyword comparison, and (when purchased) full AI reports.
- Store scans and reports so you can return to them in the app (especially when signed in).
- Authenticate you, manage subscriptions, and process refunds or support requests.
- Send transactional emails related to your account, payments, and security.
- Detect fraud, spam, and abuse; enforce rate limits; and protect infrastructure.
- Comply with law, respond to valid legal requests, and enforce our terms.
- Improve reliability and fix bugs (including aggregate or de-identified insights where appropriate).
03 — AI processing
Google Gemini and your content
We use Google's Gemini models (via the Google AI API) to analyze resume content against the job description—for example to extract text from a preview image, produce preliminary scores, and generate detailed report fields after purchase. When those API calls run, your resume-related content and JD text (or images, where used) are transmitted to Google for processing under Google's terms and policies for that service. We configure the product to minimize unnecessary retention on our side, but you should assume both we and Google process this category of data as part of providing the feature.
Automated outputs (scores and suggestions) are generated for assistance only—they are not a guarantee of hiring outcomes. You remain responsible for the accuracy of what you submit and how you use the report.
04 — Subprocessors & sharing
Who helps us run ATSRank
We use the following categories of service providers. They process personal information only as instructed by us to provide the Service, subject to contractual safeguards where applicable.
- Supabase
- Hosted authentication, application database, and object storage for resume files and previews.
- Stripe
- Payment processing for one-time purchases and subscriptions; handles card data and billing records under Stripe's compliance program.
- Google (Gemini API & optional sign-in)
- AI analysis via the Gemini API; if you use Google to sign in, Google also processes data as an identity provider under your Google account settings.
- Cloudflare
- Turnstile for bot mitigation; may also provide edge networking or security for our site depending on configuration.
- Resend
- Delivery of transactional emails (for example receipts and account-related messages).
- Vercel
- Hosting of the web application and server-side API routes that process requests.
We may also disclose information if required by law, to respond to lawful requests, or to protect the rights, property, and safety of ATSRank, our users, or others.
05 — Retention
How long we keep information
We retain account and scan data for as long as your account is active and as needed to provide the Service—for example to show past scans in your dashboard, deliver purchased reports, and meet legal, tax, and accounting obligations (such as billing records). You can permanently delete your account at any time from Dashboard → Settings → Delete account. When you do, we delete or anonymize personal information associated with that account in line with our technical capabilities and legal requirements, subject to backup retention and fraud-prevention needs (for example, billing records we are required to keep).
06 — Security
Protecting your information
We use industry-standard safeguards such as encryption in transit (HTTPS), access controls on our systems, and reputable vendors for hosting and payments. No online service can guarantee perfect security; you should use a strong password and protect access to your email and Google account used with ATSRank.
07 — Your rights
Choices and requests
Depending on your location, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. You can contact us using the email below. Many controls (profile, security, and account deletion where available) are exposed in your account settings inside the app.
08 — International transfers
Where data is processed
We are based in the United States and use providers that may process or store data in the U.S. and other countries. Those countries may have different data protection laws than your own. By using the Service, you understand that cross-border transfers may occur as part of normal operation.
09 — Children
Age limits
The Service is intended for adults seeking employment support and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have done so, contact us and we will take appropriate steps.
10 — Changes
Updates to this policy
We may update this Privacy Policy from time to time. We will post the new version on this page and change the “Last updated” date. If changes are material, we may provide additional notice (for example by email or an in-product message). Continued use of the Service after the effective date constitutes acceptance of the updated policy.
11 — Contact
Questions about privacy?
For privacy-related requests or questions about this policy, email support@atsrank.com.