Privacy Policy

1. Who we are

FolioATS is a résumé scanning and optimisation service operated by HiringFleet. For the purposes of the UK and EU General Data Protection Regulation, HiringFleet is the data controller for the personal data described here — we decide what is collected and why, and we are accountable for it.

You can reach us about anything in this document at privacy@hiringfleet.com.

2. What we collect

Almost all of it you give us directly. We do not buy personal data, and we do not build profiles of you from other sources.

Account data

Your email address, your display name and profile picture if your sign-in provider supplies them, and which sign-in methods you have linked. If you sign in with GitHub we also store your GitHub username, so that project syncing does not ask you to type it again.

Résumé and career data

This is the sensitive part, and it is extensive by design — it is what the product works on:

• Résumé files you upload, stored as the original PDF and as extracted plain text.
• Everything parsed out of them or entered by hand: your name, email, phone number, location, links, employment history, education, skills, projects, certifications and achievements.
• Job descriptions you paste or fetch by URL, along with the company and role name.
• Everything the product produces from those: scan results and scores, optimisation results, generated résumés and cover letters.

Résumés commonly contain more than the list above — a photograph, a date of birth, a nationality, a gender, a disability disclosure, or a religious or political affiliation through membership of an organisation. Some of that is a special category of data under GDPR. We do not ask for it and we do not use it, but if it is in the document you upload, we store it as part of that document. If you would rather it were not there, remove it from the file before uploading.

Technical and usage data

Request timing and error records used to keep the service working, records of which AI model served a request and what it cost us, and an activity log of the actions you take in the product so that the Activity page can show them back to you.

3. Why we process it, and our legal basis

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and limited what we collect accordingly — which is why the usage events in section 8 carry no résumé content.

4. AI providers, and what we send them

FolioATS cannot score or rewrite a résumé without a large language model, and we do not run our own. The text of your résumé and the job description you are targeting are sent to third-party AI providers to be processed and returned. This is the single most important disclosure in this policy.

What we commit to

• We do not train any model on your data. We do not build models, and we do not contribute your content to anyone else’s training set.
• We use paid API tiers whose terms exclude training on submitted content. Free consumer tiers of some of these services do allow the provider to use submissions to improve their products; we do not use those tiers for your data.
• We send the minimum the task needs. Your email address, your account identifier and your saved history are not included in AI requests.
• Providers may retain request content briefly for abuse monitoring under their own terms. We do not control that retention, which is why they are named here so you can read those terms yourself.

Our scoring service keeps a short-lived cache of keywords extracted from job descriptions, so that scanning the same posting twice returns the same result rather than a different one. That cache holds job-description keywords, not your résumé.

5. Everyone else who touches your data

These are our processors. Each one is used for a single stated function, under a contract that limits them to that function.

We never share your résumé with employers, recruiters, job boards or advertisers. FolioATS does not submit applications on your behalf, and no hiring company can see anything you store here. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.

6. How long we keep things

Deleting your account removes your profile, résumés, scans, optimisations, cover letters, settings and sessions, and deletes the stored PDF files. It is immediate and cannot be undone.

7. Your rights, and how to use them

Depending on where you live you have rights to access, correct, delete, export, restrict or object to our use of your personal data, and to withdraw consent. We apply these to everyone, not only to people in a jurisdiction that mandates them.

Two of them you can exercise yourself, immediately, without asking us:

• Export — Settings gives you everything we hold as a single JSON file: profile, résumés, scans, optimisations and cover letters.
• Deletion — Settings deletes your account and its data outright.

For anything else, email privacy@hiringfleet.com. We respond within 30 days. We will not charge you, and we will not treat you differently for asking. If you are in the EEA or UK and think we have handled your data badly, you may complain to your national data protection authority.

8. Cookies and analytics

We set one kind of cookie: the one that keeps you signed in. It is strictly necessary — without it there is no way to stay logged in between pages. There are no advertising cookies, no tracking pixels, and no third-party marketing tags.

If analytics is enabled, we use Google Analytics configured without client-side storage, so it writes no identifier to your device and cannot recognise you on a later visit. Advertising signals and personalisation are switched off. We record event names such as “a scan finished” and counts — never résumé content, file names, job descriptions, employer names or your email address. That restriction is enforced in code, not by policy alone: the analytics function accepts only numbers and booleans as event data.

9. Security

Traffic is encrypted in transit. Résumé files are held in private object storage that is not publicly listable or reachable by URL guessing. Every database query for your content is scoped to your account identifier at the point of the query, rather than fetched broadly and filtered afterwards. We do not store passwords at all — sign-in is by provider or by emailed link, so there is no password here to be stolen.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

10. International transfers

Our processors operate globally, so your data may be processed outside your country, including in the United States. Where data leaves the UK or EEA we rely on the European Commission’s Standard Contractual Clauses or an equivalent approved mechanism in our contracts with those processors.

11. Children

FolioATS is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, email privacy@hiringfleet.com and we will delete it.

12. Changes to this policy

If we change how we use your data we will update this page and move the date at the top. The date reflects a real change to the terms, not a routine deployment. If a change materially affects your rights — a new category of data, or a new kind of recipient — we will tell you by email rather than relying on you to re-read this page.