Data processing addendum
Draft last updated September 23, 2026
A forward-looking draft. Company and recruiter accounts do not exist yet, so today nobody needs to sign this — but here is what it will say when they launch.
Draft — not yet reviewed by a lawyer. This page describes how Resuvouch is built to behave, but it is not final legal language.
Why this page exists now
Companies that pay for software usually need a data processing addendum (DPA): a contract that says who is responsible for personal data and under what instructions it is handled. Resuvouch does not have company or recruiter accounts yet — recruiters view share links without any account at all — so there is currently no company whose instructions we process data under. We publish this draft anyway, so prospective customers can see where we are headed before plans launch.
Roles today: Resuvouch is the controller
Right now, Resuvouch decides what data is collected and why, for candidates and references alike. That makes us the data controller for everything on the platform. What we collect, why we may, and how long we keep it is set out in the Privacy policy — that page, not this one, governs your data today.
Roles when company plans launch
When a company signs up for a paid plan, some data handling will happen on that company's instructions — for example, which candidates its recruiters requested profiles from. For that data the company will be the controller and Resuvouch the processor, and this DPA will bind us to:
- Process that data only on the company's instructions.
- Keep the security measures described on our security page in place, and tell the company about a breach without undue delay.
- Help the company answer export and deletion requests from the people whose data it controls.
- Use only the sub-processors listed below, and give notice before adding one.
- Delete or return the company's data when the contract ends.
One boundary will not move: candidates own their profiles and references own their answers, whoever is paying. A company plan buys a better way to request and read verified profiles — it does not buy the data inside them.
Sub-processors
Resuvouch runs on a deliberately small set of providers. At deploy these will be:
- A hosting platform (runs the application).
- A managed Postgres provider (the database).
- An email delivery provider — Resend (sign-in links, invites, notifications).
- Object storage (résumé files).
The final provider names and regions will be filled in here at deploy, before any customer data flows through them.
Getting a signed copy
When company plans launch, a signable version of this DPA will be available as part of the plan agreement. Until then, questions about it go to [email protected].