Legal
Last updated: June 25, 2026
We keep this readable on purpose. This policy complies with Turkish KVKK (Law No. 6698) and, where applicable, the EU GDPR. If something is unclear, ask us at challengemyresume@gmail.com.
Challenge My Resume is operated by an individual entrepreneur based in Turkey ("we", "us", or "our"). As the operator of this service, we act as the data controller under the Turkish Personal Data Protection Law (KVKK, Law No. 6698) and, where applicable, the EU General Data Protection Regulation (GDPR). For privacy inquiries, contact us at challengemyresume@gmail.com.
When you upload a resume, we process its text content to generate interview questions and analysis. We do not store your resume file on our servers after your session ends unless you explicitly save your analysis. If you save your analysis, the resume text is retained in your account until you delete it or close your account.
If you create an account, we store your email address, encrypted password (we never store plaintext passwords), account creation date, and subscription status. We do not store payment card details — payments are handled entirely by Stripe.
We collect anonymized usage metrics — such as pages visited, features used, and session duration — to understand how the product is being used. Where we use third-party analytics services, we configure them to anonymize IP addresses. This data does not identify you personally.
We use strictly necessary cookies to maintain your session and authentication state. We may also use analytics cookies (e.g., from Vercel Analytics or similar services) to collect anonymized usage data. We do not use advertising or profiling cookies. You can control cookie preferences through your browser settings; disabling strictly necessary cookies will prevent you from logging in.
If you contact us by email, we retain a record of that correspondence, including your email address and the content of your messages, for as long as necessary to respond and for legal compliance purposes.
We process your resume content and account information to provide you with the service you requested. This is the primary legal basis for our processing activities (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
We process anonymized usage data to improve our service and prevent fraud. We have assessed that these interests do not override your fundamental rights (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
We may process certain data where required to comply with applicable laws, including tax, accounting, and fraud prevention obligations (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
Where we rely on consent — for example, for optional marketing communications — you may withdraw your consent at any time without affecting the lawfulness of prior processing.
Resume content is transmitted to our AI provider (Anthropic, Inc.) to generate analysis results. This is the core function of the product. Anthropic processes this data on our behalf as a data processor under a data processing agreement.
Anonymized and aggregated usage patterns help us understand which features are valuable and what needs improvement. We do not use your resume content to train AI models, and we do not share your resume content with Anthropic for model training purposes.
We use your email address to send transactional communications such as account confirmations, password resets, and billing receipts. We do not send marketing emails without your explicit consent.
We may analyze usage patterns to detect and prevent unauthorized access, abuse, or violations of our Terms of Service.
Resume text is sent to Anthropic, Inc. for AI analysis. Anthropic acts as a data processor on our behalf. Their data handling practices are described at anthropic.com/privacy. We do not permit Anthropic to use your data for purposes other than providing the AI processing service.
Subscription payments are processed by Stripe, Inc. We transmit only the minimum data necessary (email address, subscription tier) to facilitate billing. We never see or store your credit card details. Stripe's privacy policy is available at stripe.com/privacy.
Our service is hosted on Vercel, Inc. infrastructure. Vercel may process technical data (IP addresses, request logs) as part of hosting operations. Anonymized performance analytics may also be collected by Vercel Analytics.
User account data is stored in Supabase (Supabase Inc.) databases. Supabase acts as a data processor on our behalf. Data is stored in servers located in the region configured in our Supabase project.
We do not sell, rent, trade, or otherwise disclose your personal information to third parties for their own marketing purposes. We do not share data with advertisers or data brokers.
We may disclose your data if required to do so by law, court order, or regulatory authority, or if we reasonably believe such disclosure is necessary to protect our rights, your safety, or the safety of others.
Our service providers — including Anthropic, Stripe, Vercel, and Supabase — are primarily based in the United States. When your data is transferred outside Turkey or the European Economic Area, we rely on Standard Contractual Clauses (where applicable) or the adequacy decisions of the relevant data protection authorities to ensure your data is afforded adequate protection. By using our service, you acknowledge these transfers.
Resume content processed during a session is discarded when the session ends, unless you explicitly choose to save your analysis.
Resume text and analysis results you save are retained in your account until you delete them or request account deletion.
Your email address, password hash, and subscription history are retained for the duration of your account. After account deletion, we may retain anonymized records for financial reporting and legal compliance purposes for up to 10 years, as required by Turkish tax law.
Email correspondence is retained for up to 3 years from the date of the last communication.
We implement industry-standard security measures including TLS encryption in transit, encrypted storage for passwords (bcrypt hashing), and access controls limiting who can access your data. Our infrastructure providers maintain SOC 2 compliance.
In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant authorities within the timeframes required by applicable law (72 hours for GDPR; without undue delay under KVKK).
You have the right to know whether we process personal data about you and to obtain a copy of that data.
If any of your personal data is inaccurate or incomplete, you may request that we correct it.
You may request deletion of your personal data. We will comply unless we have a legal obligation or legitimate interest to retain it.
You may request that we restrict the processing of your data in certain circumstances (e.g., while disputing accuracy).
Where processing is based on consent or contract and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
You may object to processing based on legitimate interests. You also have an unconditional right to object to direct marketing.
We do not make decisions with legal or similarly significant effects based solely on automated processing, including profiling.
Submit a request to challengemyresume@gmail.com. We will respond within 30 days. We may need to verify your identity before processing your request. If you believe we have not adequately addressed your request, you have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK, kvkk.gov.tr) or, if you are in the EU/EEA, with your local supervisory authority.
This service is not directed at or intended for individuals under the age of 18. We do not knowingly collect personal data from persons under 18. If we become aware that we have collected data from a person under 18, we will delete it promptly. If you believe we have inadvertently collected such data, please contact us at challengemyresume@gmail.com.
We may update this Privacy Policy as the service evolves. We will notify account holders of material changes by email at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the date of the most recent revision. Continued use of the service after the effective date of changes constitutes acceptance of the updated policy.
Email: challengemyresume@gmail.com. We aim to respond within 5 business days for general inquiries and within 30 days for formal data subject requests.
This policy was last updated June 25, 2026. Material changes will be communicated to account holders by email at least 14 days before they take effect. Questions? Contact challengemyresume@gmail.com.