Privacy policy
Draft last updated September 23, 2026
What we collect from each kind of user, why we are allowed to, how long we keep it, and how you get it out or delete it.
Draft — not yet reviewed by a lawyer. This page describes how Resuvouch is built to behave, but it is not final legal language.
What we collect, by role
Candidates. Your email address, your name, and optionally a photo and a headline. The positions you list, the claims you write, and, if you upload one, your résumé file (capped at 5MB and checked and scanned before it is ever served to anyone).
References. Your email address, the relationship you declare (your role relative to the candidate; if you worked at the same company, your title and dates there; if you were a client or partner, your organization and context), your per-claim answers and accuracy ratings, and any free-text comment you leave. Comments are encrypted at rest and only shown when the candidate's share scope allows.
Recruiters. Nothing. Recruiters view share links without an account. We count how many times a link is viewed, but we do not record who viewed it.
Why we are allowed to process it
In plain words, two legal bases cover everything we do:
- Consent. You choose to write claims, answer as a reference, upload a résumé, or show your name. Each of those is something you actively do, and each can be undone — you can withdraw answers, revoke share links, and delete your account.
- Legitimate interest. We keep security records (an append-only audit log, rate-limit counters, abuse flags) because a reference product that can be quietly gamed is worthless. This processing protects every user, and it is limited to what that protection needs.
How long we keep things
| Data | Kept for |
|---|---|
| Your account and its personal data | Until you delete the account. Deletion is an immediate soft delete; personal data is hard-purged within 30 days. |
| Answers you gave as a reference, after you delete | Kept anonymized (pointed at a tombstone) so candidates' aggregates stay consistent. Everything identifying you is removed. |
| Pending answers not yet attached to an account | Expire with the invite, after 14 days. |
| Expired sign-in, invite, share, and export tokens | Purged after 30 days. |
| Audit log | 2 years. |
| Data export download links | Valid for 7 days. |
How we protect it
Every token we issue — sign-in links, invite links, share links, export links — is stored only as a SHA-256 hash, so a copy of our database does not contain a single working link. Pending reference answers and reference comments are encrypted with AES-256-GCM. The database enforces row-level security as a second layer under the application. The audit log is append-only: our own database role cannot update or delete its rows. More detail is on the security page.
Your rights
- Export. Download everything we hold about you as JSON from your data settings. The download link works for 7 days.
- Delete. Delete your account from your delete settings. Access ends immediately; personal data is purged within 30 days.
- Edit and withdraw. References can change or withdraw their answers at any time; withdrawn answers are excluded from readings. Candidates can revoke any share link at any time.
Cookies
Resuvouch sets session cookies only — no analytics, no tracking, no third parties. The full list (it is short) is in the Cookie notice.
Sub-processors
We run on a small set of infrastructure providers: a hosting platform, a managed Postgres provider, an email delivery provider (Resend), and object storage for résumé files. The final provider names will be published here at deploy, and this page will be updated before any of them change.
Contact
Privacy questions and requests: [email protected]. See also the Terms of service and the reference consent notice.