Privacy Policy

This Privacy Policy explains how Topezia ("Topezia", "we", "us") collects, uses, shares and protects your personal data when you use topezia.com and related services (the "Service"). We are the data controller for the personal data described here.

1. Information we collect

We only collect what we need to match you to jobs and run the Service:

• Resume content you provide. The text of your resume (or the answers to our questionnaire): your name, work history, education, skills, certifications, location, and — if your file contains one — a profile photo. We parse your file in memory and do not store the original file; we keep the extracted text, the structured fields, and a small photo thumbnail.
• Preferences. Job type, remote/location preferences, and salary expectations you enter.
• Account data. If you create an account, your email address (authentication is handled by our provider; we never see your password).
• Usage data. Jobs you view, save, or dismiss, and email-alert subscriptions — used to improve your matches.
• Technical data. IP address, device/browser information, and cookies necessary to run the site (see our Cookie Policy).

Some of this may be considered sensitive/special-category data depending on what your resume contains (for example, information revealing your origin or health). Please avoid including sensitive details you don't want processed; where you do provide them, you consent to our processing them to provide the Service.

2. How we use your data, and our legal bases

• To build your profile and match you to jobs (parse your resume, compute honest match scores and skill-gap insights) — to perform our contract with you and, before an account exists, on the basis of your consent.
• To send job-alert emails you opt into — on the basis of your consent, which you can withdraw at any time via the unsubscribe link.
• To operate, secure and improve the Service — on the basis of our legitimate interests in running a functional, safe product.
• To comply with legal obligations.

We do not use your data for advertising, and we do not sell or "share" your personal information as those terms are defined under US state privacy laws.

3. Public profiles

Topezia can generate a public profile page for you at a URL like topezia.com/p/your-name. When public, that page — including your name, photo, headline, experience, skills and education — is visible to anyone with the link and may be indexed by search engines. It never includes your salary expectations or contact details. You can request removal of your public profile at any time (see Section 8); [if you want profiles to be private/opt-in by default, tell us and we will make that the default].

4. Who we share data with (subprocessors)

We share data only with vendors that help us run the Service, under contracts that require them to protect it. We never send your resume or profile to employers. Our key subprocessors are:

• Vercel — website hosting.
• Supabase — database and authentication.
• Anthropic — AI model used to parse resumes and generate match explanations. Inputs are processed to return a result and are not used to train their models under our terms.
• Voyage AI — generates the numerical "embeddings" used for matching.
• Resend — sends transactional and job-alert emails.

We may also disclose data if required by law, to protect our rights or users' safety, or in connection with a merger or acquisition.

5. International transfers

We are based in / process data primarily in the United States. If you are in the EEA, UK or elsewhere, your data may be transferred to and processed in countries whose laws differ from yours. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

6. How long we keep it

We keep your profile data for as long as your account/profile is active. If you delete your account or ask us to erase your data, we remove your profile, skills, matches and activity (see Section 8). We may retain limited records where the law requires.

7. Security

We use industry-standard measures (encryption in transit, access controls, a reputable managed database). No system is perfectly secure, but we work to protect your data and will notify you and regulators of a breach where the law requires.

8. Your rights

Everyone can, from the Settings page, export their data, clear their stored resume text, and delete their account and profile.

If you are in the EEA or UK (GDPR / UK GDPR), you also have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent — without affecting prior processing. You have the right to lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA/CPRA) — or in another US state with a comparable law — you have the right to know what we collect, to access and delete it, to correct it, and to opt out of any "sale" or "sharing" (we do neither). We will not discriminate against you for exercising these rights.

To exercise any right not covered by Settings, email hello@topezia.com. We will verify your request and respond within the timeframe the law requires (generally 30 days under GDPR, 45 days under CCPA).

9. Children

Topezia is not intended for anyone under 16 (or the minimum age in your country). We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy; we will change the "Last updated" date and, for material changes, provide additional notice. Continued use after changes take effect means you accept the updated policy.

11. Contact us

Data controller: Topezia, Sheridan County, Sheridan, WY 82801, United States. Privacy contact: hello@topezia.com. EEA/UK data protection representative: [appoint if required under GDPR Art. 27 / UK GDPR].