Privacy Policy

1. Who We Are (Data Controller)

TrueDraft is operated by TrueDraft, Inc., based in California, United States, and runs the pre-launch ATS resume scoring page at truedraft.ai. TrueDraft, Inc. is the data controller for all personal data collected through this page.

Privacy contact: support@truedraft.ai

2. What We Collect

2a. Email address

If you choose to join our launch notification list (Purpose 1) or consent to research retention (Purpose 2), we collect your email address. We do not collect your email simply because you upload a resume for scoring; email is only collected when you actively submit it at the save step.

2b. Resume file

You can provide your resume in one of two ways, and they are handled differently:

• Pasted text. If you paste your resume text, it is processed only in memory to generate your score and is never written to disk or storage on our systems. A copy of the analysis it produces is kept in your own browser, as described below.
• Uploaded file (PDF or DOCX, up to 5 MB). If you upload a file, it is written to transient encrypted storage (encrypted Azure Blob Storage) so we can generate your score. If you reach the save step and do not consent to research retention (Purpose 2), the uploaded file is deleted at that point. If you never complete the save step, the file is deleted by an hourly clean-up job once your 45-minute scoring window has run out — normally within about two hours of upload. Only if you explicitly consent to research retention (Purpose 2) at the save step is the file kept; see Section 4.

To produce your score we parse the file into sections (such as summary, experience, and skills) and compare it against a role benchmark. Your parsed sections, your ATS Readiness Score, and the gap analysis (including which commonly-listed keywords are missing from your resume) are shown back to you on the results screen. This analysis is displayed only to you, in your own browser session, and is not shared with anyone. So that changing the page's language, or reloading it, does not make you upload your resume again, your browser also keeps a copy of that results screen in the session storage of the tab you are using: your parsed sections, your score and its breakdown, the gap analysis, and the reference number for your analysis. If you go on to submit your email address, a masked form of it (for example kar***@example.com) is kept there too — never the full address, and never your deletion link. We do not send that copy anywhere; it stays on your device. Your browser normally clears it when you close the tab, though reopening a closed tab can restore it, so we also expire it 45 minutes after it was saved. You can remove it yourself at any time with “Start over” on the results screen.

Important: Resume files can contain sensitive personal information within the meaning of California privacy law, for example health conditions, religious or philosophical beliefs, union membership, or racial or ethnic origin that may appear incidentally in a resume. You should be aware of this before consenting to research retention under Purpose 2.

2c. IP address

Your IP address is handled in three ways, each described in full in Section 5. A one-way keyed hash of it is written to our abuse log and deleted after 90 days; your un-hashed address is sent to Cloudflare so it can run the bot check; and it is necessarily visible to Microsoft Azure, which hosts this page for us. We never store your un-hashed IP address ourselves.

2d. Your score, our email check, and your consent record

If you submit your email at the save step, we store the following alongside it. If you never submit your email, none of it is stored.

• Your ATS Readiness Score. We keep the numeric score we showed you, so we can measure how our scoring performs. We do not keep the keyword gap analysis or the parsed sections shown on the results screen.
• The result of our email check. Before we save your address we check that it is well-formed and that its domain can receive mail (see Section 5). We keep the one-word result of that check — valid, invalid, or undeliverable — so we know whether we can reach you. If the check itself cannot be completed, we record no result.
• Your consent record. We keep which of the two consent boxes you ticked, the date and time you ticked them, and the version of this notice that was in force at that moment, so that we can show what you agreed to. It is deleted together with the rest of your record when you delete your data (see Section 7).

3. Purpose 1: Launch Notification

What we do with your data

We store your email address so we can tell you when TrueDraft opens to the public. When you submit your email, we first send you a confirmation email (which also carries your one-click deletion link), and then a single launch email when we go live. That is two emails in total under this purpose. We do not send any other marketing, newsletters, or promotional messages under this purpose.

Your consent

We do this only if you ask us to. You do so by ticking the checkbox labelled “Email me once when TrueDraft launches.” The box is never pre-ticked. It is separate from Purpose 2 consent; you can tick either, both, or neither, and you can withdraw at any time (see Section 7).

Automated scoring

Your ATS Readiness Score and its sub-metric breakdown are produced automatically by our scoring software, with no human review. The score is an informational estimate only; it does not produce any legal or similarly significant decision about you, and no automated decision is made about you on the basis of it.

Retention

We retain your email for launch notification for 180 days from the day you submit it, or until you delete it, whichever comes first. After 180 days it is deleted automatically. If you do not consent to research retention (Purpose 2), no resume file is kept under this purpose.

What is not retained

If you consent only to Purpose 1 (notify) and decline Purpose 2 (research), your resume file is not retained: we delete it at the save step, when you submit your email. If that deletion does not succeed, or if you never complete the save step at all, the file is removed instead by an hourly clean-up job once your 45-minute scoring window has run out — normally within about two hours of upload. Resume text you pasted rather than uploaded is never written to our storage in the first place; what your own browser keeps for the tab you are using is described in Section 2b.

4. Purpose 2: Research Retention (180 Days)

What we do with your data

We retain your uploaded resume file and your email address together for up to 180 days as a research dataset. This dataset is used solely to improve our AI suggestions and ATS scoring accuracy, not for any other commercial purpose.

Your consent

We do this only if you ask us to. You do so by ticking the checkbox labelled “Let TrueDraft keep my uploaded resume and email together for 180 days to improve our AI suggestions and ATS scoring. I can delete it anytime via the link in my email.” The box is never pre-ticked, and this is separate from Purpose 1 consent.

Retention period

Your resume file and associated email are retained for a maximum of 180 days from the date you submit. After 180 days, your data is automatically and permanently deleted.

Sensitive information

Before you consent, please be aware that resume files can contain sensitive personal information within the meaning of California privacy law (as noted in Section 2b), for example information that may reveal health conditions, disability, religious or philosophical beliefs, union membership, or racial or ethnic origin. By ticking the research-retention checkbox you agree to our keeping any such information your resume happens to contain, solely for the stated research purpose. We do not use it to infer characteristics about you. You can withdraw this consent at any time (see Section 7).

5. Recipients

We disclose limited personal information to the recipients below, each solely for the purpose shown. Each entry says how that recipient handles it: a service provider acts on our instructions and for no purpose of its own, while an independent recipient also determines its own purposes under its own terms and privacy policy.

We do not sell your data to any third party. Your resume file is never sent to Resend or to Cloudflare, and it is never used to generate advertising; the only recipient that ever holds it is Microsoft Azure, which stores it for us as described above. Your resume is not sent to any AI model at this stage — the score is produced by our own scoring software. Your email address is validated in-house (an email-format check plus a DNS lookup of the domain’s mail servers) — it is not sent to any third-party validation service. Resend’s privacy policy is available at resend.com/legal/privacy-policy.

Our hosting infrastructure (Microsoft Azure) processes your data on our behalf in the United States under a Data Processing Agreement. Any uploaded resume file is stored in encrypted Azure Blob Storage in the United States. See Section 8 for where we offer the Service and where your data is held.

Abuse prevention. Whenever you have a resume scored on this page, and again if you submit your email at the save step, we record a one-way hashed (pseudonymised) form of your IP address in our internal abuse log. We use it only to detect and rate-limit abuse of this page. The hash is keyed with a secret we hold, so it cannot be reversed to your real IP address by anyone else, and we never reverse it ourselves. It is not shared with anyone. It is deleted automatically 90 days after it is recorded — note that this abuse log is kept separately from your saved lead, so deleting your data removes your email and resume immediately but does not remove these entries before their 90 days are up.

Bot protection (Cloudflare Turnstile). Separately from the hash described above, this page uses Cloudflare Turnstile to tell real visitors apart from automated bots. The Turnstile script loads from Cloudflare in your browser when the scoring page opens, so Cloudflare receives your IP address at that point whether or not you go on to submit anything. When you submit a resume to be scored, we also send Cloudflare the challenge token together with your IP address so it can confirm the check passed. That IP address is sent in its ordinary, un-hashed form — it is the only case where we deliberately transmit your IP address to a company other than our hosting provider. Cloudflare handles it under its own terms; its privacy policy is available at cloudflare.com/privacypolicy.

Analytics (usage measurement). To understand how visitors use this page and where they drop off — so we can improve it — we collect usage analytics using Microsoft Azure Application Insights (a Microsoft Azure service, United States). This is cookieless: we set no tracking cookies and use only a random, per-visit identifier kept in your browser’s session storage (cleared when you close the tab) to group a single visit’s steps together. The events we send are non-identifying, and cover: which funnel step you reach and the step you were on when you left; which pages you viewed and how long you spent on them; whether you chose to upload a file or paste text, and the file extension if you uploaded; whether scoring succeeded, and if not, the category of the problem; a coarse score band rather than your actual score; and which consent boxes you ticked. We do not send your resume content, the text you paste, or your email address to analytics. Your IP address may be processed by Microsoft Azure for security and coarse location but is not used by us to identify you. These analytics are retained for 30 days and then deleted. If you would rather we did not measure your visit, email support@truedraft.ai.

6. Your Rights

We offer the rights below to everyone who uses this page, whichever state you live in and whether or not your state’s law requires them. Where your state gives you a right that goes further, that right applies too.

California residents (CCPA/CPRA)

TrueDraft, Inc. is based in California. To the extent the California Consumer Privacy Act, as amended by the CPRA, applies to us, California residents have the rights set out below. We have not, in the preceding 12 months, sold or shared personal information, and we do not use it for cross-context behavioural advertising.

Right to know. You may request the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties we disclose it to. For this page that is: your email address (only if you submit it), your resume content, your IP address, your ATS Readiness Score, the result of our email check, and your consent record, each as described in Section 2. We collect all of it from you directly, and we disclose it only to the recipients named in Section 5.

Right to delete and to correct. You may request deletion of the personal information we hold about you, or correction of anything inaccurate. The one-click deletion link in your confirmation email does this immediately; see Section 7.

Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of and we do not offer a “Do Not Sell or Share My Personal Information” link. If that ever changes, this notice and a conspicuous opt-out link will be published before it takes effect.

Right to limit use of sensitive personal information. A resume may incidentally contain sensitive personal information if you choose to include it (see Section 4, “Sensitive information”). We do not collect it to infer characteristics about you, and we process it only to generate the score you asked for — not for any purpose that would trigger the right to limit its use.

Right to non-discrimination. We will not deny you the Service, charge you a different price, or provide a different quality of service because you exercised any of these rights.

Authorized agents. You may use an authorized agent to submit a request on your behalf. The agent must provide proof that you gave them signed permission to act for you, and we may also ask you to verify your identity directly with us or to confirm that you authorized the request. Requests we cannot verify this way may be denied.

To exercise any of these rights, contact support@truedraft.ai. We respond within the period required by law and will tell you if we need longer.

7. Right to Withdraw Consent

You may withdraw your consent at any time, without any negative consequences. Withdrawing consent is as easy as giving it.

Deletion token link: Every confirmation email we send you includes a one-click deletion link. Clicking the link opens a confirmation page; clicking “Yes, delete my data permanently” on that page immediately and permanently deletes your email address and any retained resume file from our systems. This covers withdrawal of both Purpose 1 and Purpose 2 consent simultaneously.

You can also withdraw consent by emailing support@truedraft.ai with “Delete my data” in the subject. We will process your request within 72 hours.

Withdrawing your consent stops us using your data from that point on; it does not undo what we had already done with it while your consent was in place.

8. Where We Offer the Service, and Where Your Data Is Held

TrueDraft, Inc. is based in California, United States, and your data is processed and stored on Microsoft Azure infrastructure in the United States. The recipients named in Section 5 receive it in the United States, except that Cloudflare’s bot check runs on its global edge network.

We offer this page only to individuals located and resident in the United States. We do not offer, market, or direct it to individuals in the European Economic Area, the United Kingdom, or Switzerland; we do not target advertising or content to those territories; and we do not monitor the behaviour of individuals in them. We apply technical measures intended to restrict access to the United States, but we do not represent that they are complete. If you reach this page from outside the United States you do so on your own initiative and no offer is made to you. This Policy describes the rights available to you under United States federal and state privacy law.

If you believe we have handled your personal information unlawfully, please contact us first at support@truedraft.ai — we take all privacy concerns seriously and will respond within 72 hours. You may also complain to your state attorney general, and California residents may complain to the California Privacy Protection Agency.

9. Children

This page is not directed to children. You must be at least 18 years old to use it, as set out in our Terms of Use, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us their personal information, email support@truedraft.ai and we will delete it.

10. Changes to This Policy, and Do Not Track

Changes. We may update this policy as this page changes. When we do, we revise the “Last Updated” date at the top and post the updated policy at this same address, so you can always see the current version here. If a change is material — for example, if we started using your data for a new purpose — we will say so prominently on this page, and, where we hold your email address because you consented, we will email you before the change takes effect. We will not apply a materially different purpose to data we already hold without asking you again.

Do Not Track. Some browsers can send a “Do Not Track” signal. There is still no common standard for how sites must respond to one, so this page does not respond to Do Not Track signals. What we collect is described in Section 2, and you can ask us not to measure your visit as described in Section 5.

Tracking by others. We do not allow third parties to collect personal information about your activities over time and across other websites through this page. The only script this page loads from another company’s servers is Cloudflare’s bot check, described in Section 5; we run no advertising, no marketing pixels, and no cross-site trackers here.

11. Contact Us

For any questions about this privacy policy or your personal data:

TrueDraft, Inc. (Data Controller)
548 Market St, PMB 99938
San Francisco, CA 94104
United States
Email: support@truedraft.ai
Website: truedraft.ai