What happens to your resume data

Treated casually because it is a document you send to strangers, a CV is nonetheless one of the most complete personal records most people produce: full name, contact details, location, employment history with dates, education, and enough detail to answer most security questions.

Handing that to a tool is a meaningful transfer. It deserves the questions you would ask before connecting a bank account, and it rarely gets them because the format is so familiar.

There is a second sensitivity people miss. The fact that you are looking at all is confidential if you are currently employed, and a tool that stores, shares or accidentally exposes that fact is disclosing something more immediately damaging than your address.

A typical AI job tool sends your CV through several hands: its own storage, a model provider for processing, possibly an embedding service, possibly a monitoring platform that captured it in a log or an error report.

Each is a copy with its own retention period, and the ones nobody thinks about — logs and error tracking — are frequently the longest-lived and least protected, because they were never designed as personal data stores.

Embedding stores deserve a specific mention. A vector derived from your CV is still personal data, and deleting the original document while leaving the embedding behind is a deletion that did not happen in any meaningful sense.

• The vendor’s own database and backups
• The model provider processing the text
• An embedding or vector store, if matching is used
• Application logs and error-monitoring services
• Any employer or board the tool submitted to on your behalf

"Do you train on my data" is the question everyone asks and it is too narrow. The vendor may not train, while the model provider they use might under the terms of the tier they chose — which is a distinction most privacy pages elide.

Ask instead whether data is excluded from training at every layer including sub-processors, and whether they can name those sub-processors. A vendor who cannot answer that has not thought about it, which is itself the answer.

Note also that most providers offer a tier where inputs are excluded from training, and that it usually costs more. A free tool processing your CV is paying for that processing somehow, and it is reasonable to ask how.

These are ordinary questions that a serious product can answer quickly. Vagueness on any of them is the signal, more than any particular answer.

Pay attention to deletion in particular. "You can delete your account" and "deletion removes your data from backups and sub-processors within a stated period" are very different commitments.

Ask in writing, by email or support ticket. A clear written answer is worth having on record, and the willingness to put it in writing is itself informative.

• Which sub-processors see my CV, by name?
• Is it excluded from model training at every layer?
• How long is it retained, including in logs and backups?
• What exactly does deletion remove, and by when?
• Is it used to match me to employers without my initiating that?
• Where is it stored, and under which jurisdiction?

Depending on where you live, this is not only a matter of vendor goodwill. Several jurisdictions give you a right to know what personal data an organisation holds, to obtain a copy, to have inaccuracies corrected and to request erasure.

Those rights typically apply to any organisation processing your data, not only to ones based where you are, which matters when the tool is a start-up on another continent. There are usually statutory deadlines for a response.

The rules differ enough by country that it is worth checking your own regulator rather than relying on a summary. The practical point is that if a vendor refuses to answer the questions above, you may have a route that does not depend on their cooperation.

Keep the harvestable fields out of the document you upload. Full address, date of birth and any identity or tax number are not needed to assess suitability, and they are precisely what makes a leaked CV valuable.

Prefer tools that process without storing, and be deliberate about breadth: a tool that submits applications on your behalf necessarily shares your details with every employer it contacts, and those copies are beyond the vendor’s deletion policy entirely.

Consider a dedicated email address for job searching. It costs nothing, it keeps application traffic out of your main inbox, and if the address begins receiving unrelated marketing you have learned something specific about where your data went.