Effective date: [EFFECTIVE DATE] · Last updated: [DATE]
Cinchora (the “Service”) is a job-matching application operated by Cinchora Technologies, LLC (“Cinchora Technologies,” “we,” “us,” or “our”), a limited liability company organized in the State of New York, United States. For the purposes of the EU/UK General Data Protection Regulation (“GDPR”), Cinchora Technologies is the “data controller” of the personal data described below.
This Policy applies to personal data we process when you use the hosted Cinchora service, visit our website, or otherwise interact with us. If you run Cinchora locally on your own device, your resume, settings, and search data are stored on that device and are sent to third-party AI providers only as described in Section 5; in that case we do not receive or store that data ourselves.
| Category | Examples |
|---|---|
| Account data | Email address and authentication identifiers (we use email magic-link or third-party sign-in; we do not store passwords ourselves). |
| Resume & profile data | The content of any resume you upload or paste, and the profile derived from it — name, location, work history, skills, seniority, and target roles. This may include information you consider sensitive. |
| Activity data | Your searches, filters, saved jobs, applied-to jobs, dismissed jobs, and match results. |
| Payment data | If you subscribe to a paid plan, payment is handled by our payment processor; we receive limited billing details (e.g., plan, last four digits, status) but not full card numbers. |
| Technical data | IP address, device/browser type, and log data necessary to operate and secure the Service. |
Cinchora’s precision matching sends your resume text and the text of job postings to one or more third-party AI providers for the sole purpose of scoring how well each posting fits you. Depending on the AI model you select, this may be:
These providers process this data on our behalf as sub-processors and, under their API terms, do not use it to train their models by default. We also rely on the following categories of sub-processors: cloud hosting and database providers; a payment processor; an email-delivery provider; and the job-board and aggregator APIs from which job listings are retrieved (for example, public APIs operated by The Muse, Adzuna, USAJOBS, Greenhouse, Lever, Ashby, and Workday). When we query those job sources we send search terms, not your resume.
Cinchora may display advertising within the Service. [To be finalized once the advertising model is selected.] This section will describe whether advertising is contextual (served based on page content and not on your personal data) or personalized (served using personal data), identify our advertising partners and the categories of data involved, and explain the choices available to you. If we ever use or disclose personal information for personalized or cross-context behavioral advertising, that activity may constitute a “sale” or “share” under the California Consumer Privacy Act (as amended by the CPRA); in that case we will provide a clear “Do Not Sell or Share My Personal Information” opt-out, honor opt-out preference signals such as Global Privacy Control, and obtain consent where the GDPR requires it. We will not use the content of your resume itself for advertising targeting.
Where the GDPR applies, we process your personal data on the following bases: performance of a contract with you (to provide the Service); your consent (for example, to process resume data and to send optional job alerts), which you may withdraw at any time; our legitimate interests (to secure and improve the Service); and compliance with legal obligations.
We retain your account and profile data for as long as your account is active. You may delete your resume, individual data, or your entire account at any time; upon account deletion we delete or de-identify your personal data within a reasonable period, except where we must retain limited records to comply with legal, tax, or security obligations.
Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to our processing of your personal data, and to withdraw consent. EU/UK users have these rights under the GDPR; California users have rights under the CCPA/CPRA, including the right to know, delete, correct, and to opt out of the sale or sharing of personal information (see Section 7 for how to exercise any advertising-related opt-out). We will not discriminate against you for exercising any of these rights. To exercise them, contact us using the details below.
We operate in the United States, and our sub-processors may process data in the United States and other countries. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
We use industry-standard measures, including encryption of data in transit and at rest, to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
Cinchora is not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us personal data, please contact us and we will delete it.
We use cookies and similar technologies that are necessary to operate the Service (for example, to keep you signed in). We may also use cookies in connection with advertising as described in Section 7; where required, we will request your consent and provide cookie controls.
We may update this Policy from time to time. If we make material changes, we will notify you by email or through the Service and update the “Last updated” date above.
To exercise your rights or ask questions about this Policy, contact:
Cinchora Technologies, LLC
Attn: Privacy
[MAILING ADDRESS]
Email: [privacy@cinchora.app]