Privacy Policy

Last updated: July 27, 2026

The short version

We don't sell your data. Not to recruiters, not to employers, not to anyone. Our business model is subscriptions, not data.

We don't train on your resume. Not on the text, not on a stripped-down version of it, not at all. Our models are trained on public job postings and data we build ourselves — never on what you paste in.

The free BS-O-Meter deletes your resume immediately. It reads your resume, pulls out the skills, and deletes the text right then — within seconds, before you even see your score. What's left is the report: your score and the findings, including the specific lines it quotes back at you. No account, no signup, nothing to delete later because it's already gone.

About Anthropic (only if you get coaching). The core scoring engine runs on our own trained models. Nothing about your match score, evidence, or gap analysis touches an external AI. Your resume isn't sent anywhere for that. Anthropic's API (the company behind Claude) is only used to generate the written coaching narrative that explains how to improve your resume. Coaching is optional and you control when it runs. When it does run, the text of your resume and the job description are sent to Anthropic's API at that moment. Anthropic's commercial API terms prohibit training on customer data, and they retain it for a maximum of 30 days for abuse monitoring before deletion.

You can delete everything. One click from your account. For anonymous scans, email [email protected] and it's gone.

We don't share with employers or recruiters. Your resume is yours.

Full legal policy below.

1. Introduction

FitToHire ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our resume analysis service.

2. Information We Collect

Account Information

  • Email address (for authentication and communication)
  • Name (if provided)
  • Payment information (processed securely by Stripe)

Uploaded Content

  • Resumes (PDF, DOCX, or text)
  • Job descriptions

Usage Data

  • Analysis requests and results
  • Device fingerprint for abuse prevention
  • IP address and browser information
  • Usage patterns and feature interactions

3. How We Use Your Information

  • To provide and improve the resume analysis service
  • To process payments and manage subscriptions
  • To communicate service updates and support
  • To prevent abuse and enforce usage limits
  • To generate anonymized, aggregated analytics. For the free BS-O-Meter we record the referring domain (e.g. "linkedin.com"), whether you're on mobile or desktop, and a one-way hash of your IP address — enough to count visitors, not enough to identify one.

4. Data Processing

When you upload a resume or job description:

  • Documents are stored securely in encrypted cloud storage (Cloudflare R2)
  • Text is extracted and processed to identify skills
  • Analysis results are stored linked to your account
  • BS-O-Meter (free): the resume text is deleted from storage as soon as skills are extracted — seconds after you submit it. Only the report remains.
  • Job scans: resume and JD text stay in your account so you can re-run and compare them. They remain until you delete them — from your account, or by emailing [email protected] for anonymous scans.
  • Extracted skills and scores are retained for your analysis history

5. Data Sharing

We do not sell your personal data. We share data only with:

  • Stripe - for payment processing
  • Cloudflare - for content delivery and storage
  • Anthropic - only when you choose to run coaching, and only then. Your resume text is sent as written so the coaching can quote it back to you. Anthropic's commercial terms prohibit training on it and they delete it within 30 days. Nothing else on the site sends your resume to an outside AI — not the BS-O-Meter, not your job scans.
  • Legal authorities - when required by law

6. Data Security

We implement industry-standard security measures:

  • All data transmitted over HTTPS/TLS
  • Encrypted storage for sensitive data
  • Regular security audits and monitoring
  • Access controls and authentication

7. Data Retention

  • Account data: retained while your account is active
  • Analysis history: retained until you delete it, or until you close your account
  • BS-O-Meter resume text: deleted within seconds, as soon as skills are extracted. The report it produces (score, findings, and the lines quoted in them) is kept.
  • Job scan resume and JD text: kept until you delete it, so you can re-run and compare your scans. Delete any scan from your account at any time; closing your account removes them all.
  • Usage logs: retained for 90 days for security purposes

8. Your Rights (GDPR/CCPA)

You have the right to:

  • Access - request a copy of your personal data
  • Rectification - correct inaccurate data
  • Erasure - delete your account and associated data
  • Portability - export your data in a standard format
  • Objection - opt out of certain processing
  • Restriction - limit how we use your data

To exercise these rights, contact us at [email protected]

9. Cookies

Essential cookies always run — they are what keep you signed in and protect the forms. Everything else is off until you say otherwise. We ask once, and “Reject” is one click, exactly like “Accept”.

Essential — always on, no choice involved:

  • Session cookies - to keep you logged in
  • Security cookies - for CSRF protection
  • Preference cookies - to remember your settings

Analytics — only if you accept. Microsoft Clarity, so we can see which pages confuse people and fix them.

Advertising — only if you accept. LinkedIn, Meta and Google, so we can show ads to people who have visited before. If you reject, these never load at all: no script is fetched and no cookie is set, rather than being loaded and told not to track you.

To change your mind, clear this site's cookies and site data in your browser and reload — you will be asked again. Scripts already loaded in the current tab stop at the next reload.

10. International Transfers

Your data may be processed in the United States. By using our Service, you consent to this transfer. We use Standard Contractual Clauses and other safeguards for international data transfers.

11. Children's Privacy

Our Service is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email at least 30 days before taking effect. The "Last updated" date indicates when changes were made.

13. Contact Us

For privacy-related inquiries: [email protected]

For general support: [email protected]