GDPR & Data Privacy FAQ

The API runs on Hetzner in Helsinki, Finland. To extract the fields, resume text is sent to OpenAI in the United States, which acts as a subprocessor. If your organization cannot send resume data outside the EU or outside your own network, contact us about on-premise.

The API is built to make GDPR compliance easier: the parse endpoint does not store the PDF or the result, the API is hosted in Finland, and the one subprocessor for resume content (OpenAI, United States) is disclosed. As the data controller, your organization is responsible for having a lawful basis to process candidate resumes, informing candidates, and covering the transfer to a US subprocessor in your own records. Contact us if you need a data processing agreement.

All communication with the API uses HTTPS, so the file you send and the JSON you receive are encrypted in transit between your server and the API.

Not as a ready-made product. If your organization needs resume data to stay on your own infrastructure, contact us about on-premise and we will talk through what it would take.

Yes, with one thing to note: resume text is processed by OpenAI in the United States as a subprocessor, so your records of processing should cover that transfer. The parse endpoint does not store the PDF or the result. Make sure your own application stores parsed results in line with the GDPR, including retention policies and data subject requests.

Resume text is sent to OpenAI as a subprocessor only to produce the parsed result. It is not shared with anyone else or used for marketing. We keep API usage metadata (request time, status, billing) for operations and billing, not resume content.

We do not hold security certifications of our own. The API runs on Hetzner in Helsinki, Finland, uses HTTPS for all connections, and the parse endpoint does not store the PDF or the parsed result. Contact us if you have specific security questions.