Privacy Policy
Last updated: 14 October 2026
1. Who we are
ATS Score ("we", "us") is operated by Ouyikai Technology Co., Ltd. trading as ATS Score, Room A906, Wanhengda Building, Donghuan 2nd Road, Yousong Community, Longhua Subdistrict, Longhua District, Shenzhen, Guangdong, China. For questions about this policy or your data, contact [email protected].
For the personal data described in section 3, we act as the data controller. Where a merchant of record processes payment data on our behalf, that provider acts as an independent controller for its own compliance obligations — see section 5.
2. The short version
- Your resume is processed in your own browser by default. Scoring and rewriting run as JavaScript on your device. The file itself is not transmitted to our servers, and we cannot read it.
- We never sell your data, never use it to train models, and never share it with recruiters or advertisers.
- If you turn on AI enhancement, the text you choose to send is forwarded to a model provider through our proxy — see section 4. This is opt-in and off by default.
- We do not require an account. There is no login, no password, and no profile stored with us.
3. What we collect, and why
| Category | What it is | Why we process it | Legal basis (GDPR) |
|---|---|---|---|
| Resume content | The document you upload or paste. Processed locally in your browser. | To produce your score, keyword gaps and rewrite. | Performance of a contract (Art. 6(1)(b)) |
| AI enhancement payload opt-in | The resume and job-description text you submit when AI enhancement is switched on. | To return an improved rewrite. Not stored after the response is returned. | Consent (Art. 6(1)(a)) — you enable it explicitly |
| Order data | Email address and order reference, received from our payment provider. | To deliver your purchased report, handle refunds, and meet tax and accounting duties. | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Aggregate usage events | Anonymous counts: how many scans started, how many paywalls were shown. No identifier, no cookies, no cross-site tracking. | To understand where the product fails and fix it. | Legitimate interests (Art. 6(1)(f)) |
| Server logs | IP address, user agent, requested URL. Retained by our hosting provider for security and abuse prevention. | To keep the service available and defend against attacks. | Legitimate interests (Art. 6(1)(f)) |
4. AI enhancement — what actually leaves your device
By default, nothing. The scoring engine and the rule-based rewriter run entirely on your device.
AI enhancement is optional. When you enable it and trigger a rewrite, the resume text and the job description you supplied are sent over HTTPS to our proxy function and forwarded to the model provider below, solely to generate the rewrite.
- Model provider: OpenAI (api.openai.com)
- Retention: not stored by us; the model provider retains it per its enterprise policy
- Use for training: OpenAI's API terms exclude training on API inputs
- Do not use AI enhancement if your resume contains information you are not permitted to share with a third-party processor.
5. Who else processes your data
We keep this list deliberately short. Each provider below is bound by a data processing agreement.
| Provider | Purpose | Data involved |
|---|---|---|
| Creem | Merchant of record — takes payment, calculates and remits VAT/GST and sales tax, issues invoices, handles chargebacks and refunds. | Name, email, billing country, card data (we never see card numbers), order value. |
| Cloudflare, Inc. | Hosting and content delivery. Also provides privacy-preserving, cookieless analytics. | IP address, request metadata, aggregate page views. |
| Resend | Delivery of the report link, receipts and support replies. | Email address, message content. |
| OpenAI (api.openai.com) | Generates the AI rewrite when you opt in. | The resume and job-description text you submit. |
6. International transfers
Our providers are based in the United States. Where personal data is transferred out of the EEA or the UK, we rely on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
7. How long we keep things
- Resume content: never stored on our servers; it disappears when you close or refresh the page.
- AI payload: not stored by us; the model provider retains it per its enterprise policy
- Order records: 7 years — we cannot delete these earlier, as tax law requires us to keep them.
- Aggregate analytics: no personal data, retained indefinitely.
- Server logs: 30 days.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive it in a portable format, and to withdraw consent at any time. You also have the right to complain to your local supervisory authority.
Email [email protected] and we will respond within one month. Because we hold almost nothing about you, most requests resolve the same day.
California residents: we do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising.
9. Cookies and tracking
We do not set advertising or cross-site tracking cookies. Anything we store in your browser (your unlocked-report flag, your local funnel counters) is local storage, stays on your device, and is never transmitted to us.
10. Security
All traffic is served over HTTPS. We collect the minimum data needed to run the service. Our payment provider is PCI-DSS compliant and handles card data directly, so card numbers never touch our infrastructure.
11. Children
This service is intended for job seekers aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has used the service, contact us and we will remove any associated data.
12. Changes to this policy
We will post any change on this page and update the date at the top. Material changes will be announced on the service itself.