Privacy policy

Resurface is an API that scores a resume against a job description. This page explains what we store, why, and who processes it. Questions: office@bulldog-adv.com.

Your account

When you sign up (email, GitHub or Google, through our authentication provider Clerk) we store your email address and name. We use them to run your account, show your usage and contact you about the service. You have to give us your email address and name to create an account; without them we can't open one. We do not sell them or use them for advertising. We also note how you found us when you sign up: a campaign tag in the link you followed, or the website that linked to us. It is kept with your account, without cookies, and we only look at it in totals.

What you send to the API

• Resumes are read in memory to produce a score. We do not store the resume file or its full text. We keep a one-way hash of it (to detect repeats) and the scoring result, which includes the short resume lines quoted as evidence for each answer.
• Job descriptions and the screening questions drafted from them are stored as a rubric in your account so you can reuse them.
• Usage records (time, key used, latency, billing) are stored to count your free scores and bill usage.

The same applies to calls made through our MCP server (getresurface.dev/api/mcp), which signs in with your Resurface account or an API key and runs the same API.

You are responsible for having the right to send the resumes you submit, and for telling candidates how their data is processed.

Who processes data for us

• TypeSafe (the Jev model): reads resume text and questions to answer them, under zero data retention, so it deletes them as soon as it answers.
• Cloudflare (Workers AI, the Clef models): reads resume text and questions to answer them only when TypeSafe is unavailable, as an automatic fallback.
• Anthropic (Claude): reads job descriptions to draft screening questions. Resumes are not sent to it.
• Clerk: sign-in and account management.
• Paddle: payments for score packs. Paddle is the merchant of record and collects your payment and billing details directly; we receive the order, your email and the amount, never your card details. The checkout loads from Paddle only when you buy a pack.
• Neon: database hosting. Vercel: application hosting. Microsoft Clarity: website analytics on public pages.

Our trust center lists what each one receives, where data is hosted and how we protect it.

Retention and deletion

Results and rubrics stay in your account until you ask us to delete them or close your account. Email us and we will delete your account and everything linked to it.

Website analytics

With your permission, our public pages (home, docs, legal) use Microsoft Clarity to see how visitors use the site (clicks, scrolling, anonymised session replays). Clarity also receives your IP address. It loads only after you accept analytics in our consent banner, runs without cookies, masks form fields and never loads on the dashboard or sign-in pages. API calls are not tracked. You can change your choice at any time: Privacy preferences.

Cookies

Besides the sign-in cookies set by Clerk, we set one cookie of our own: rs_promo, when you arrive through a launch offer such as Product Hunt. It remembers the offer for 30 days so your new account gets the extra free scores, and holds nothing else. Your consent choice is kept in your browser's local storage for up to 12 months.

Security

API keys are stored only as hashes. Traffic is encrypted in transit (HTTPS) and the database is encrypted at rest. Details are in our trust center.