Privacy Policy
Last updated: October 2026
1. Who we are
Resume Parser is a product of Herizon Oy, a company registered in Finland. We provide a resume and CV parsing API that converts PDF documents into structured data.
Data Controller: Herizon Oy, Helsinki, Finland
Contact: [email protected]
2. Data we process
We process two categories of data:
Resume/CV data (processed on behalf of our customers)
Documents sent to the API are processed to extract structured data. We act as a data processor. The uploaded PDF is held in a temporary file only while it is parsed and is deleted when the request finishes, whether it succeeded or failed. Only the structured output is returned, and it is not stored.
Customer account data
Email address, sign-in request IP addresses, API keys (stored as hashes), usage records, support messages, and credit purchase records for customers who use our API. A usage record holds the time, the key used, the result (success, failed or rejected), whether it was billed as free or as a credit, the error code, the duration and the processing cost. It holds no resume content. Usage records are kept while the account exists and are deleted with the account.
3. Where data is processed
As a Finnish company, we are subject to the EU General Data Protection Regulation (GDPR). How resume data is handled:
- The API is hosted on Hetzner in Helsinki, Finland
- Uploaded PDFs are deleted after parsing; only the structured output is returned
- Resume text is sent to OpenAI (United States) for processing, as a subprocessor
- Connections to the API are encrypted with TLS
- No data is shared with third parties for marketing or analytics
- Right to deletion: contact us to remove any account data
4. Data processing agreement
For resume data sent to the API, Herizon Oy acts as a processor on behalf of the API customer, who is the controller. A data processing agreement (DPA) is available on request from [email protected].
Uploaded PDFs are deleted after parsing and only the structured output is returned. If your organization needs resume data to stay on your own infrastructure, contact us about on-premise.
5. Subprocessors
Hetzner
Hosting and database. Helsinki, Finland.
Cloudflare
DNS and TLS proxy. EU and global edge network.
OpenAI
Text interpretation. United States. API inputs are not used for training and are retained by OpenAI for up to 30 days for abuse monitoring under OpenAI's API data usage policy. The transfer is covered by OpenAI's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.
Amazon SES
Transactional email, such as sign-in emails.
Stripe
Payments for credit purchases. We do not store card details.
Discord
Support messages sent through the developer dashboard are forwarded to our team as Discord notifications.
6. Cookies and analytics
This marketing website uses a privacy-focused analytics tool that does not use cookies and does not collect personal data. No cookie consent is required.
7. Your rights
Under GDPR, you have the right to access, rectify, erase, restrict processing, and port your personal data. To exercise any of these rights, contact us at [email protected].
8. Contact
For any privacy-related questions, contact us at [email protected].