Privacy Policy

1. Who is responsible, and how to reach us

For the purposes of the DPDP Act the Data Fiduciary, and for the GDPR and the UK GDPR the controller, is:

2. Personal data we collect

Signing in with Google: when you use Google Sign-In we receive your name and email address from Google. We never see your Google password.

• Identity data: name and email address (verified by email link or by Google), and the country your sign-up came from.
• Resumes and job descriptions: the resume files you upload (PDF or DOCX), their text, the job descriptions you paste or that the extension reads, your scores and the optimized text we produce.
• Your career workspace: if you use Resume Studio, the job tracker or the application workspace, you are building something you expect to find again, and we keep it for as long as you use ATSAlign. It includes your career profile and the contact links you add; your roles, bullet points, projects, education, skills, certifications, awards, publications, leadership and volunteer entries; the evidence you attach; your master resume and every version you save, with its template and section order; the jobs you save and their job descriptions; the tailored copy of your resume for each job; your match results and AI suggestions; your applications, their status history and your notes; your interview stages; and your cover letters. When you import a resume we read it into this structured form and keep that; the original file is deleted after 7 days like any other upload.
• Information about other people: the recruiter or hiring-manager details you may note against an application. Section 9 explains how narrowly we treat these.
• Payment data: payments are processed by Razorpay. We never receive or store card numbers, bank passwords or UPI PINs. We keep the order reference, amount, currency, plan, the receipt we issued and, for buyers in the EU, the EEA and the UK, the record that you asked for immediate access at checkout.
• Technical data: IP address, browser and device type, and the time of each request. These are stored with the record they belong to (your sign-in session, a payment, an analysis, an extension check) and are used for security, abuse prevention, to work out your country for pricing and for the cookie banner, and to count how many checks come from each country.
• Product usage data: when you view Pro plans or checkout we record what happened (for example that the plans were shown, a plan was chosen or checkout was closed) with broad facts such as your country and roughly how long you have used ATSAlign, but without your name, email, account ID or IP address, so it is not linked to you. If you answer our optional “What stopped you?” question we keep your answer; any words you type are deleted after 90 days. So that we ask at most once a month, we note on your account when we last asked, never what you answered.
• Affiliate programme data: if you join our affiliate programme we also hold your payout details (a UPI ID or PayPal email), your PAN verification status and tax status, and your commission and payout records.
• Extension data: described in Section 8.

3. Why we use your data, and on what basis

Under the DPDP Act we process your data on the consent you give at sign-up, and for the specific purpose for which you voluntarily give it to us. Under the GDPR and the UK GDPR each purpose rests on the basis shown.

We do not sell your data, and we never share it with data brokers or marketing agencies. Our marketing email is sent only by us, about ATSAlign.

Automated processing: your ATS score, keyword matches and AI suggestions are produced automatically. They are information for you to act on. We make no decision about you that has a legal or similarly significant effect.

The AI we use

We use Google's Gemini API on a paid tier, under which, per Google's API terms, your content is not used to train Google's models. We do not use it to train any models either. We send only the text a feature needs:

Your resume is never sent to AI for any purpose other than the feature you used.

Service providers and international transfers

We rely on the following processors to operate ATSAlign. Some are located outside India, the EU and the UK, and may process data in Australia, the United States or other regions. We share only what each provider needs to perform its function. Where a transfer out of the EU or the UK needs a safeguard, our providers' data-processing terms include the EU Standard Contractual Clauses and the UK Addendum.

• Google: Gemini AI processing, Google Analytics (with consent), Sign-In.
• Google Cloud: hosts our application servers (Sydney, Australia and Mumbai, India) and stores our encrypted backups.
• Supabase: our database and resume file storage, hosted on Amazon Web Services in Sydney, Australia, encrypted at rest.
• Sentry: error monitoring. Error reports are stripped of personal data before they leave our servers.
• Razorpay: payment processing (we never receive card details).
• Microsoft Clarity: product analytics under a pseudonymous account id, with on-screen text masked (with consent where required).
• Vercel: website hosting and performance analytics.
• Titan Email: transactional and service emails.

4. How long we keep your data

You may delete your account at any time from your account page. When you do, your personal data is erased immediately and cannot be recovered, except financial records, which Indian tax law requires us to keep; those are detached from your identity.

“Without use” means no sign-in, no extension use and no analysis or optimization for 24 months, counted from the latest of those. To keep your data, simply sign in; the reminder email links to sign-in.

5. Your rights

Under the DPDP Act (India)

• Access: a summary of the personal data we process about you and how we use it.
• Correction and erasure: correct inaccurate data, complete it, or have it erased.
• Grievance redressal: raise any concern with our Grievance Officer (Section 13).
• Nominate: name a person who may exercise these rights for you if you are unable to.

If we do not resolve your grievance within the time stated in Section 13, you may complain to the Data Protection Board of India.

If you are in the EU, the EEA, the UK or Switzerland

You also have the right to:

• Access your personal data and receive a copy of it.
• Rectify inaccurate data and erase data we no longer need.
• Restrict processing while a question about it is settled.
• Data portability: receive the data you gave us in a structured, machine-readable format (see “Getting your data out” below).
• Object to processing based on legitimate interest, and object at any time to marketing.
• Withdraw consent at any time where consent is the basis (marketing, analytics), without affecting what was done before.
• Complain to your local supervisory authority, for example the Data Protection Commission in Ireland or the Information Commissioner's Office in the UK. We would appreciate the chance to resolve your concern first.

To exercise any right, email support@atsalign.com from the address on your account. We answer within 30 days. We may ask you to confirm your identity before acting, and we never charge for a request.

Getting your data out

You can download your data at any time from your account page as a single file: your profile, every entry and bullet, every resume version, your saved jobs and their job descriptions, your tailored copies, your applications with their full history, your cover letters, your past analyses and your Pro access records. There is no charge and no reason needed. For anything else we hold about you, email us and we will send it within 30 days.

6. Security

• Encryption: data in transit is encrypted via HTTPS (TLS 1.2+); our database and file storage are encrypted at rest.
• Hashing: passwords are salted and hashed, never stored in plain text.
• Access control: database access is restricted to authorized personnel only; administrative actions are logged.
• Minimisation: uploaded files are deleted after 7 days, guest scans after 48 hours, and error reports are stripped of personal data.

Data breach notification: if a personal data breach is likely to affect you, we will notify you without undue delay, inform the Data Protection Board of India without delay and in detail within 72 hours, and notify the relevant EU or UK supervisory authority within 72 hours where the law requires it.

7. Cookies and analytics

We use two categories of cookies and similar technologies. Essential cookies are always on because the site cannot function without them. Analyticscookies are handled based on your region:

• EU, EEA, UK and Switzerland: analytics cookies load only after you opt in via our cookie banner.
• Other regions (including India and the US): analytics cookies may load by default as permitted by local law, and you can opt out at any time using the “Cookie Settings” link in our footer.

Either way, you can change your choice at any time, we do not use advertising or ad-targeting cookies, and we never sell your data.

Rejecting analytics never affects your access to any feature.

8. Browser extension

The ATSAlign browser extension (Chrome) is optional. When installed and used on a supported job site, it:

• Reads only the visible job description, title, and company on supported job pages (LinkedIn Jobs, Greenhouse, Lever, Naukri, Indeed), and only to compute your match score. It also sends the page's web address with them; from that address, the record of each check keeps only the name of the job site (for example LinkedIn), not the address itself. It does not read any other page, tab, or site.
• Never accesses your credentials, passwords, cookies, or browsing history on those sites.
• Sends the job description and your saved resume profile to ATSAlign servers solely to produce the match score and (if you click Optimize) to pre-fill the optimizer. Job descriptions used for a one-click handoff can only be used for 5 minutes, and are deleted within 3 days.
• Authenticates with the same ATSAlign session token used on the website, stored locally in the browser's extension storage. You can log out from the extension popup at any time, which clears it.
• Records minimal, non-sensitive usage events (for example that a job was analyzed or the Optimize button was clicked) to improve the product. These include the job site's host name (for example www.linkedin.com). If the extension cannot read a job page, the event also includes that page's path (for example /jobs/view/123456), so we can fix the extension for that site. These events contain no passwords and no full resume content.

Data collected by the extension is used only to provide the match-score feature. ATSAlign never uses it for advertising, ad targeting, or building profiles of you, and never sells or rents it to third parties.

Uninstalling the extension removes its local data. Your account data is governed by the retention and deletion policy above.

9. Information you give us about other people

When you track an application you can record the recruiter or hiring manager you are dealing with: their name, role, work email, phone number, LinkedIn profile and your notes about them. This is information about someone who is not an ATSAlign user, so we treat it narrowly:

• we use it only to show it back to you, inside that application;
• we never contact them, and never use it for marketing;
• we never share it, and never combine it across users;
• it is deleted when you delete the application or your account.

Please add only what you need to follow up on your application.

10. Sensitive information

We do not ask for sensitive information such as health, religion, ethnicity, trade-union membership or political opinions, and we do not use it for anything. If your resume includes it, we store it only as part of your resume, and it is deleted with it. Please leave out of your resume anything you would not want an employer to read.

11. Age

ATSAlign is for people aged 18 or over, and you confirm this when you create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, email us and we will delete it.

12. Changes to this policy

When we change this policy in a way that matters, we show you a notice inside ATSAlign the next time you sign in, and we keep it in front of you until you have seen it. Before we delete anything under a retention rule, we email you first. The date and version at the top of this page always identify the current text. This version (pp-v2.0) adds the career workspace, the table of what each AI feature sends, the download of your data, information about other people, and the rights of people in the EU and the UK, and corrects where our servers run and how long technical data is kept.