ResumeStudio, Inc. ("Candix", "we") operates a hiring marketplace: candidates join to be introduced to companies, and companies pay for introductions candidates have accepted. This policy explains what personal information we collect, why, who receives it, and what rights you have. It covers candidates, users at client companies, website visitors, and people who have not joined Candix but whose public professional information we collect (Section 2). For privacy questions and requests, email support@candix.com.
The most important rule of the platform: no hiring company receives your Candix profile from us until you accept an introduction to that specific company.
1. What we collect
If you are a candidate:
- Account data: name and email address from the sign-up method you choose (email or LinkedIn sign-in), and a photo where that method provides one.
- Profile data you provide: work experience, education, and skills; your preferences (the salary you are asking for, where you want to work, and whether you would need visa sponsorship); and any notes you share with us. We treat your visa-sponsorship answer as sensitive: we use it only to match you and, when you accept an introduction, to deliver it as part of your profile. If we collected public professional information about you before you joined (Section 2), it is linked to your account and governed as profile data from then on.
- Interview data: if you interview with us, we record and transcribe the conversation only with your permission, which we ask for at the start of the call. We do not ask what you earn now or earned before, only what you are asking for; nor do we ask about protected characteristics, with one exception: the visa-sponsorship question in your profile, which we treat as sensitive (Section 9). Because what you tell us, in interviews or elsewhere, may appear in what we deliver to companies you accept, do not share anything confidential, or anything you would not want a company to see. We take care in what we include, but treat that as best effort, not a promise.
- Activity data: sign-ins and which features you use, such as viewing and responding to introductions.
If you are a user at a client company: name, email address, photo, your company and role, and your use of the platform. Commercial inputs (budgets and stated values) are handled as your company's confidential information under the Client Terms.
If you are a visitor: analytics data (see Cookies, Section 5). We do not run advertising trackers.
Whoever you are, we also automatically collect technical data (IP address, device identifiers and browser type, and log data) to operate, secure, and analyze the platform.
2. Information about people who have not joined
We may collect professional information from publicly accessible sources about people who have not joined Candix (non-members): name, headline, current and past roles, employer, education, skills, location, and profile photo. We do not collect contact details of non-members.
We keep this data only as long as it is needed for matching (Section 3), and delete it on request. If you want no data about you on Candix, email support@candix.com; no account is needed, and we will remove your information, keeping only what we need to honor the request going forward. Section 6 describes how deletion works. You can also ask to see or correct the information we hold about you.
3. How we use personal information
- Matching and pricing: deciding which introductions to propose and, on the company side, pricing them; we also use platform data to improve these systems. Our systems compare profiles with each company's brief and select which introductions to propose; a person may review a match before we propose it. We do not send companies scores, rankings, or probabilities about you. The only number we generate about you that companies see is the price of an introduction; it reflects market conditions, not an assessment of your skills or fit, and they agree not to use it to evaluate you.
- Introductions: delivering your profile to a company when, and only when, you accept.
- Operating the platform: accounts, support, scheduling, billing (companies only; candidates pay nothing), safety, and fraud prevention.
- Communications: transactional messages about your account and introductions. We do not send marketing emails today.
We may also create aggregated or de-identified data, such as aggregate website statistics, that no longer identifies you; we may use and share it for any lawful purpose; we do not attempt to re-identify it, and we require recipients not to.
4. Who receives personal information
- Client companies, at your direction only. When you accept an introduction, we deliver your profile to that company, together with a short summary of why we think the match fits, drawn only from your profile, your interviews with us, and public professional information about you; it is not a score. From that moment the company holds your profile under its own privacy notice and is directly answerable to you for it as an independent business. You can direct access and deletion requests to the company as well as to us.
- The company that referred you, if you joined through a referral. Referrers see aggregate numbers: how many of the people they referred have signed up, and the credits they have earned; they do not see who. If a company referred only a few people, those numbers can still give away that you joined or accepted an introduction. Beyond those numbers, referrers receive nothing about your activity, matches, or outcomes, and we do not confirm anything about you to them.
- Service providers that process data on our behalf, across categories including hosting, AI, analytics, communications, support, and payments. The current list is on the Subprocessors page.
- Authorities and successors. We disclose data in response to valid legal process or where law requires it. In a corporate transaction, the data moves with the business, subject to this policy.
We do not sell or share your personal information as the CCPA defines those terms, and have not in the past 12 months. Companies pay us for introductions you choose to make, not for your data.
5. Cookies
We use a small set of cookies: sign-in and session (Clerk), security and bot protection (Cloudflare), support chat (Intercom), and product analytics (PostHog). Plausible, our other analytics tool, sets no cookies. We set no advertising or cross-site tracking cookies. Our sites do not respond to Do Not Track signals; because we do not sell or share personal information, opt-out signals do not change how we process it.
6. Retention
- Candidate account and profile data: kept for as long as you have a Candix account; deleted when you close your account or ask us to.
- Interview recordings and transcripts: kept while your account is active; deleted on request.
- Public professional data (non-members): per Section 2.
- Client-user account data: kept while you use the platform for your company; deleted on request, except records required for billing.
- AI processing logs and error logs: kept for the vendors' fixed retention periods, then deleted automatically.
- Technical data (IP address, device, and log data): kept as long as needed to operate, secure, and debug the platform, then deleted or aggregated.
You can request deletion at any time (Section 8). We delete your account and profile from our database and revoke your sign-in, and we instruct the service providers that hold copies to delete those copies; providers complete deletion on their own schedules. Some records survive where law requires, such as billing records on the company side. Routine backups rotate out on a fixed schedule.
7. Security
We use reasonable administrative, technical, and physical safeguards to protect personal information. No security is perfect; if a breach affects you, we will notify you as the law requires.
8. Your rights
You have the following rights over your personal information:
- Access: a copy of the personal information we hold about you, including material we generated about you, with anything about other people removed.
- Correction: inaccurate data fixed; you can also edit your profile directly in the app.
- Deletion: your account and your data deleted (Section 6 describes how deletion works).
- Portability: the data you provided, in a machine-readable format.
To exercise any of these, email support@candix.com; we will verify the request comes from you. We confirm receipt within 10 business days. We respond within 45 days, and may extend by a further 45 days for complex requests, with notice. We will not discriminate against you for exercising these rights, and an authorized agent may act on your behalf with proof of authorization.
If your profile has already been delivered to a company, you can direct these requests to that company as well as to us.
9. California notice at collection
This notice describes what we collect from California residents and why.
- Categories collected: identifiers (name, email, IP address, and device identifiers); professional and employment information (experience, skills, salary expectation); education information; commercial information (billing records; client users only); sensitive personal information (citizenship or immigration status, from candidates' visa-sponsorship answers); inferences (matching-related assessments); internet activity (platform usage); and audio and visual information (profile photos and, with permission, interview recordings).
- Sensitive personal information: we collect citizenship or immigration status only to perform the matching service candidates ask us for: matching them to roles and delivering their profiles as they direct. Because we use it only for that requested service, we do not offer a separate right to limit its use.
- Sources: the individual, their sign-in provider, and publicly accessible sources.
- Purposes: see Section 3.
- Retention: see Section 6; inferences, activity data, and sensitive information are kept with the account and deleted with it.
- Sale or sharing: we do not sell or share personal information as the CCPA defines those terms, and have not in the past 12 months. In the past 12 months we disclosed the categories above to the recipients described in Section 4.
- Your rights: see Section 8.
10. Eligibility
The platform is for individuals 18 or older. We do not knowingly collect data from anyone under 18. The platform is not directed to, or offered to, residents of the EEA, the UK, or Switzerland.
11. Changes to this policy
We may update this policy. Changes are posted here with a new date, and for material changes (such as new uses, new categories of data, or new categories of recipients) we notify account holders before they take effect.
12. Contact
ResumeStudio, Inc.
415 Mission Street, Floor 37
San Francisco, CA 94105, USA
Email: support@candix.com