Privacy Policy

Overview

GlobalMatch helps candidates find roles and helps companies evaluate them with structured interviews and AI matching. This policy explains what we collect, how we use it, and the controls you have.

Information we collect

• Account information (email, username, role) you provide when you sign up.
• Resume files (PDF, DOC, DOCX) you upload, plus the parsed text and structured fields derived from them.
• Video interview recordings and the transcripts and AI analyses generated from them.
• Job postings, requirements, and matching results created by companies.
• Basic operational logs needed to run the service (e.g., authentication events).

How we use it

• Generate interview questions from your resume and produce structured profiles.
• Match candidates to jobs and produce technical and behavioral summaries for hiring teams.
• Operate, secure, and improve the service.

Sharing and access

Candidate profiles, recordings, and analyses are only visible to the company workspace they apply to and to the candidate themselves. We do not sell personal data.

Your controls

• You can replace or remove your resume at any time.
• You can delete your account from Settings, which removes your associated profile data, including videos in object storage.
• You can download a JSON bundle of everything we hold about you (GDPR Art. 15 + 20) from /api/auth/me/export/ while signed in.
• You can contact us at support@globalmatch.io for any data-subject request (access, rectification, erasure, portability, restriction, objection).

Legal basis (GDPR Art. 6 + 9)

• Art. 6(1)(b) — contract performance. Processing your profile, resume, and interview text is necessary to run the hiring-platform service you signed up for.
• Art. 9(2)(a) — explicit consent for the processing of biometric data (your interview video and voice recordings). The consent prompt appears before any recording starts.
• Art. 6(1)(f) — legitimate interests, for abuse / fraud detection and security logging at a minimum level (rate-limit counters, audit log entries).

Sub-processors

We use the following sub-processors. Where the processor is located outside the EU, transfers are covered by the EU Standard Contractual Clauses (SCCs) bundled into each provider's data-processing agreement.

• Anthropic (US) — LLM scoring of your resume and interview transcripts.
• OpenAI (US) — Whisper speech-to-text transcription of your interview videos.
• Cloudflare R2 (EU jurisdiction) — object storage for resumes and interview videos.
• Render (US / Frankfurt) — application hosting + Postgres.
• Vercel (US / Frankfurt) — frontend hosting.
• Resend (US) — transactional email (verification + password reset).

Retention

• Resume files — kept while your account is active. Deleted from R2 immediately when you delete your account.
• Interview videos — kept on R2 while your account is active so you can review your own answers and so our scoring can be re-audited. Deleted from R2 immediately when you delete your account.
• Transcripts, scores, matches — kept while your account is active.
• Audit + usage logs — retained for up to 1 year for security and cost monitoring.
• Session metadata — purged automatically when the underlying session expires.

Automated decision-making (GDPR Art. 22)

We use large language models to score your resume and interview answers and to rank you against open job postings. These outputs are decision-supporting — they help companies shortlist candidates — but the hiring decision itself is always made by a human. You have the right to request human review of any AI output that significantly affects you; contact support@globalmatch.io.