Privacy Policy

1 Who We Are

HyreMe is a standalone AI-powered resume optimisation and job-matching platform. When this policy refers to "HyreMe," "we," "us," or "our," it refers to the operator of hyremeapp.com and its subdomains.

HyreMe allows job seekers to upload resumes, receive ATS scoring, generate tailored CVs and cover letters, and find matching job opportunities — using an AI provider of their choice (BYOAI).

For questions about this policy, contact us via the contact form.

2 What Data We Collect

We collect the following categories of personal data:

Account & Identity Data

• Full name
• Email address
• Password (stored encrypted; never visible to us)
• Account creation date

Profile & Resume Data (HyreMe)

• Uploaded resume files (PDF, DOCX)
• Work history, education, skills, and other career details you provide
• AI-generated profile enhancements and ATS reports stored with your consent
• Job descriptions and postings you submit for matching or tailoring
• Tailored CVs and cover letters generated for your applications

Usage & Technical Data

• IP address, browser type and version
• Pages visited, features used, session duration, and click behaviour
• Device type and operating system

Payment Data

• Billing name and address
• Payment method type (card type, last 4 digits) and transaction history

Communications Data

• Messages sent via the contact form
• Support correspondence
• Waitlist and newsletter subscriptions

Third-Party API Keys (BYOAI)

If you connect your own LLM API key to use AI features, that key is stored in AES-256 encrypted form. We do not use your API key for any purpose other than passing requests on your behalf to the provider you selected.

3 How We Use Your Data

We use your data to:

• Create and manage your account
• Deliver HyreMe's core features: ATS scoring, resume analysis, profile optimisation, job matching, tailored CV and cover letter generation
• Process your subscription and payments
• Send transactional emails (account confirmations, password resets, receipts)
• Send product updates and newsletters — only with your consent; unsubscribe at any time
• Improve platform performance and fix bugs
• Respond to your support or contact form enquiries
• Comply with legal obligations

4 Legal Basis for Processing

Depending on your jurisdiction, our legal basis for processing your data includes:

• Contract performance: To deliver the services you signed up for
• Legitimate interests: To improve our platform and prevent fraud
• Consent: For marketing communications and optional AI training participation
• Legal obligation: To comply with applicable laws and regulations

If you are located in Canada, we process your data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

If you are located in the EU or UK, we process your data in accordance with the General Data Protection Regulation (GDPR) and UK GDPR.

5 Data Sharing & Third Parties

We only share your data with trusted third-party service providers who help us operate the platform. These include:

• Cloud hosting providers (e.g., AWS, Google Cloud) — for data storage and infrastructure
• Payment processors (Stripe) — for subscription billing
• Email service providers (e.g., SendGrid, Postmark) — for transactional emails
• Analytics providers (e.g., Plausible, Google Analytics) — for usage analytics
• Your chosen AI/LLM provider — only when you connect your own API key and initiate an AI action. We route your request to the provider you selected; we do not choose or switch providers on your behalf.

All third-party providers are contractually required to protect your data and may not use it for their own purposes. We may also disclose your data if required by law, court order, or to protect the rights and safety of our users or the public.

6 Data Retention

We retain your data for as long as your account is active or as needed to provide services.

• Account data: Retained until you delete your account
• Resume & profile data: Retained until you delete it or close your account
• Payment records: Retained for 7 years for accounting and legal compliance
• Support messages: Retained for 2 years
• Usage / analytics data: Anonymised after 13 months

Upon account deletion, your personal data is permanently removed within 30 days, except where legal retention obligations apply.

7 Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Ask us to correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data ("right to be forgotten")
• Portability: Request your data in a machine-readable format
• Objection: Object to certain types of processing (e.g., marketing)
• Withdrawal of consent: Withdraw consent at any time where processing is consent-based
• Complaint: Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us via the contact form. We will respond within 30 days.

8 Cookies & Tracking

We use cookies and similar technologies to:

• Keep you logged in (essential cookies)
• Remember your preferences and settings
• Analyse platform usage and improve performance (analytics cookies)

You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling non-essential cookies will not affect your ability to use the platform.

9 Data Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest, including your API keys
• Secure password hashing (bcrypt)
• Access controls and role-based permissions for internal staff
• Regular security audits and vulnerability assessments

10 International Data Transfers

Our servers are primarily located in North America (Canada and the United States). If your data is transferred to or processed in another country, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) for EU/UK data transfers and equivalent mechanisms under PIPEDA for cross-border transfers.

When you use BYOAI and connect an API key from a provider located outside your jurisdiction, your request data will be transmitted to and processed by that provider. Please review the privacy policy of your chosen AI provider for details on how they handle data.

11 Children's Privacy

HyreMe is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their personal data, please contact us and we will delete it promptly.

12 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective Date" at the top of this page. Where changes are significant, we will notify you by email or in-app notification.

Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

13 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy:

• Contact form: hyremeapp.com/contact

We aim to respond to all privacy-related enquiries within 5 business days.