California Privacy Policy
1. Scope and Relationship to Other Notices
This California Privacy Policy (“California Policy”) applies to California residents who use the websites, mobile applications, and career-support services operated by Workscaler Inc., doing business as Resumás (“Resumás,” “Workscaler,” “we,” “us,” or “our”). It supplements the general Privacy Policy.
This California Policy describes the rights available under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), and how eligible California residents may exercise them. If this California Policy conflicts with the general Privacy Policy concerning California-resident personal information, this California Policy controls.
This Policy applies to personal information collected online and offline in connection with the Services. Separate notices may apply to Workscaler personnel, job applicants for Workscaler employment, business contacts, and other contexts where required by law. The existence of a separate notice does not limit any non-waivable right under applicable California law.
2. Notice at Collection
At or before we collect personal information, we provide a Notice at Collection that identifies the categories of personal information and sensitive personal information we collect, our purposes for collecting and using it, and whether we sell or share it. The Notice at Collection appears at the relevant point of collection, such as account registration, resume upload, optional location access, AI feature activation, purchase flow, or cookie-consent interface.
We do not collect additional categories of personal information or use personal information for materially different, unrelated, or incompatible purposes without providing notice and, when required, obtaining consent.
3. Personal Information Collected
In the preceding 12 months, we may have collected the categories below from California residents. Categories marked [VERIFY] must be confirmed against actual production systems and removed if not collected. “Personal information” includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a consumer or household.
| CCPA category | Examples relevant to Resumás | Sources | Primary business or commercial purposes |
|---|---|---|---|
| Identifiers | Name, email address, phone number, username, account ID, IP address, device or app identifier, authentication records. | You; your device or browser; authentication, support, payment, and service providers. | Account creation and security; service delivery; support; communications; fraud prevention; analytics; legal compliance. |
| Customer records | Account profile, contact details, subscription status, transaction history, and limited payment information or payment tokens. Full card numbers are processed by payment providers, not stored by Resumás. | You; payment providers; app stores; service providers. | Deliver Services; administer purchases and subscriptions; customer support; accounting; fraud prevention; compliance. |
| Commercial information | Plan, purchase history, subscription status, saved-service preferences, and Service usage history. | You; app stores; payment providers; Service activity. | Provide and improve Services; billing; support; analytics; communications. |
| Professional or employment-related information | Resume/CV content, employment history, job titles, skills, certifications, accomplishments, job preferences, applications, desired roles, and career goals. | You; content you upload or enter; connected services that you authorize; public or licensed sources where permitted. | Resume and job-search tools; career guidance; AI features requested by you; coaching; job matching; application tracking. |
| Education information | Schools, degrees, certificates, coursework, and training history included in your career materials. | You; content you upload or enter; authorized connected services. | Provide resume, career, and job-matching features requested by you. |
| Internet or other electronic network activity | Browser and device type, operating system, app version, screens or pages viewed, features used, links clicked, session information, referral source, crash reports, performance data, and security logs. | Your device or browser; cookies, SDKs, logs, analytics, and crash-reporting providers. | Operate, secure, debug, analyze, and improve the Services; prevent fraud; measure performance. |
| Approximate geolocation | General city, region, or approximate location inferred from IP address, and location-search settings you enter. | Your device or browser; you. | Local job-search and location-based Service features; security; analytics. |
| Precise geolocation [VERIFY] | GPS or device-derived precise location, only if an app feature requests it and you grant device permission. | Your device, after permission. | Provide a user-requested local-jobs or location feature. |
| Audio, electronic, visual, or similar information [VERIFY] | Support messages, chat records, feedback, coaching-session recordings or transcripts, or documents you upload. | You; Service interactions; support or coaching providers. | Provide requested coaching, support, and AI features; maintain records; quality assurance; security. |
| Inferences | Career preferences, job-fit assessments, MatchScore results, AI-generated recommendations, Ghost Job Detector results, Do Not Apply Guidance, and other conclusions derived from your submitted career information and interactions. | We generate these from information described above. | Provide requested career and job-search features; personalize your experience; improve the Services consistent with your settings. |
4. Sensitive Personal Information
We do not ask you to provide sensitive personal information unless it is necessary for a feature you request or you choose to include it in your resume, profile, prompt, support request, or other content. Depending on what you provide and the features you use, this may include:
- Government identifiers, financial-account information, or account credentials [not requested for career tools; remove unless actually collected].
- Precise geolocation, if you enable a feature requiring it.
- Racial or ethnic origin, religious or philosophical beliefs, union membership, citizenship or immigration status, health or disability/accommodation information, sex life or sexual orientation, genetic data, or biometric information that you choose to include in career materials.
- The contents of communications, including support messages, prompts, and coaching communications.
We use and disclose sensitive personal information only as necessary to provide Services and goods you request; ensure security and integrity; detect, prevent, and investigate security incidents, fraud, or illegal actions; comply with law; perform services on our behalf; or for other purposes permitted by the CCPA. We do not use or disclose sensitive personal information to infer characteristics about you or for other purposes that would trigger a right to limit, unless we provide the required notice and choice.
5. Purposes for Collection, Use, and Disclosure
We collect, use, and disclose the categories described above for the following business or commercial purposes:
- Providing, maintaining, personalizing, and securing the Services and accounts.
- Creating, optimizing, storing, exporting, and managing resumes and other career content; providing AI-assisted content and career tools requested by you; and supporting coaching and job-search workflows.
- Processing payments, subscriptions, cancellations, refunds, and related records.
- Sending transactional communications, job alerts you request, security notices, support responses, and, where permitted, marketing communications.
- Debugging, auditing, analytics, product research, reliability, fraud prevention, and improving Services.
- Protecting the rights, safety, security, and property of Workscaler, users, and others; complying with legal obligations; and establishing, exercising, or defending legal claims.
- Creating aggregated or deidentified data that cannot reasonably be linked to a consumer.
We do not use identifiable resumes, profiles, job-search materials, private communications, or AI prompts to train generalized AI models unless we first provide a separate, specific notice and obtain affirmative opt-in consent. [Revise if actual practices differ.]
6. Disclosure of Personal Information
In the preceding 12 months, we may have disclosed the categories of personal information listed in Section 3 to the following categories of recipients for the business or commercial purposes described in Section 5:
| Recipient category | Categories that may be disclosed | Purpose |
|---|---|---|
| Cloud hosting, storage, and infrastructure providers | Identifiers, account information, career content, professional and education information, usage data, communications, and inferences. | Host, secure, back up, and provide the Services. |
| AI service providers [NAME EACH PROVIDER] | Only the data required for the AI feature you choose, such as resume text, job description, prompt, relevant profile data, and requested output. | Generate or assess requested AI-assisted career content. We provide a clear AI disclosure and obtain affirmative permission before sending personal information to a third-party AI provider. |
| Authentication, analytics, crash-reporting, and customer-support providers [NAME EACH PROVIDER] | Identifiers, account information, device and usage data, diagnostics, support communications, and limited relevant content. | Account access, security, customer service, performance, reliability, and analytics. |
| Payment processors and app stores | Identifiers, contact details, transaction, subscription, and payment-token information. | Process payments, subscriptions, refunds, accounting, and fraud prevention. |
| Email, communications, and push-notification providers [NAME EACH PROVIDER] | Contact details, push token, communication content, and delivery information. | Deliver transactional, support, security, and user-selected marketing or alert messages. |
| Professional advisers, auditors, insurers, and service providers | Information relevant to the specific service. | Legal, accounting, security, insurance, compliance, and professional advice. |
| Government agencies, law enforcement, or parties to a legal proceeding | Information required or reasonably necessary in the circumstances. | Comply with law or valid legal process; protect rights, safety, and security; establish, exercise, or defend legal claims. |
| Successors in a corporate transaction | Relevant personal information and business records. | Merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to applicable law. |
| Third parties you direct us to use or receive your information | Information you choose to export, connect, submit, or share. | Carry out your instruction. |
We require service providers and contractors to use personal information only for specified business purposes, protect it, and not sell or share it except as permitted by law and contract.
7. Sale, Sharing, and Cross-Context Behavioral Advertising
We do not sell personal information as the CCPA defines “sell.” We do not share personal information for cross-context behavioral advertising as the CCPA defines “share.” We do not use personal information for targeted advertising based on activity across unaffiliated businesses’ apps or websites.
Accordingly, we do not currently provide a “Do Not Sell or Share My Personal Information” link. If our practices change, we will provide required notices, opt-out methods, honor opt-out preference signals such as Global Privacy Control where applicable, and update this Policy before the changed practice begins.
8. Retention
We retain personal information only for as long as reasonably necessary and proportionate to the purpose for which it was collected, considering the nature and sensitivity of the information, the purpose and duration of processing, legal or contractual obligations, security needs, and the potential risk of harm from continued retention. We use the following general retention periods:
| Data category | Standard retention period | Purpose or basis |
|---|---|---|
| Account profile, resumes, career content, saved jobs, application records, AI inputs, and outputs | While the account remains active; deleted or deidentified within [30] days after a verified deletion request, subject to narrow legal exceptions. | Provide Services; honor deletion requests. |
| Third-party AI request content | [INSERT VERIFIED PROVIDER-SPECIFIC PERIOD], configured for the shortest practical retention and no provider training [VERIFY]. | Deliver requested AI feature; safety and abuse prevention where permitted. |
| Transaction and tax records | Up to 7 years, or longer if required by law. | Tax, accounting, fraud prevention, and legal compliance. |
| Support communications | Up to 3 years after the relevant matter closes, unless longer retention is necessary for a legal or security matter. | Support continuity, quality assurance, legal claims, and security. |
| Security, access, and fraud logs | Normally up to 12 months; longer for an active investigation, legal requirement, or security defense. | Security, integrity, fraud prevention, and compliance. |
| Analytics and crash data | Normally 90 days to 12 months, depending on the system and whether data is aggregated. | Performance, reliability, debugging, and product improvement. |
| Marketing contact data | Until you unsubscribe or the relationship ends; a minimal suppression record may be kept to honor the opt-out. | Marketing preferences and legal compliance. |
| Backups | Removed through scheduled rotation within [90] days after deletion from active systems, unless technically isolated for disaster recovery. | Security and disaster recovery. |
| Aggregated or deidentified data | May be retained as long as it cannot reasonably be reidentified. | Analytics, research, and Service improvement. |
9. Your California Privacy Rights
Subject to exceptions and limitations in the CCPA, California residents may have the rights below:
- Right to know/access: Request the categories and specific pieces of personal information we collected about you; categories of sources; purposes for collection, sale, or sharing; and categories of third parties to whom we disclosed, sold, or shared information.
- Right to delete: Request deletion of personal information we collected from you.
- Right to correct: Request correction of inaccurate personal information we maintain about you.
- Right to opt out of sale or sharing: Opt out if a business sells personal information or shares it for cross-context behavioral advertising. Resumás does neither at this time.
- Right to limit: Limit certain uses and disclosures of sensitive personal information when the right applies. See Section 4.
- Right to non-discrimination: Receive equal service and price when exercising a privacy right, subject to lawful financial-incentive programs.
- Right to data portability: When you make an access request electronically, receive certain information in a portable and, where technically feasible, readily usable format.
- Rights concerning automated decisionmaking technology: Beginning with applicable compliance dates, you may have notice, access, and opt-out rights when we use automated decisionmaking technology in a manner covered by the CCPA regulations. Resumás’s job-search recommendations, match scores, Ghost Job Detector results, and Do Not Apply Guidance are decision-support tools; they are not used to make employment, housing, lending, insurance, education, healthcare, or other similarly significant decisions about you on Resumás’s behalf. [Confirm and revise if this changes.]
10. How to Submit a Request
You may submit a privacy request through either of these methods:
- Online: resumas.com/privacy-request/
- Email: support@resumas.com
To delete an account and associated personal information, you may use the in-app route Settings > Account > Delete Account or the public web page at resumas.com/delete-account/. You do not need to create an account to submit a privacy request.
State the right you wish to exercise and provide enough information for us to understand and locate the information relevant to the request. Do not include passwords, full payment-card information, Social Security numbers, or unnecessary sensitive information.
11. Verification, Authorized Agents, and Appeals
11.1 Verification
We verify requests using information reasonably necessary to confirm the requester’s identity and authority, considering the sensitivity of the information and risk of harm from unauthorized disclosure or deletion. Verification may include sending a confirmation link or code to the email associated with the account or matching limited information you provide with our records.
We will not ask for your password, full payment-card number, Social Security number, or unrelated sensitive information merely to process a standard privacy request. If we cannot verify your identity, we may be unable to fulfill a request to know, correct, or delete, but we will explain why unless prohibited by law.
11.2 Authorized agents
You may designate an authorized agent to submit a request on your behalf. We may require proof that you signed a permission authorizing the agent to act for you, and may ask you to verify your identity directly or confirm that you authorized the request, as permitted by law. A person acting under a valid power of attorney may be treated in accordance with California law.
11.3 Appeals
If we deny a request in whole or in part, we will explain the basis for the decision and any available appeal process. To appeal, reply to the decision notice or email support@resumas.com with the subject line “Privacy Request Appeal” within [60] days of our decision. We will review the appeal and provide a written decision within the period required by law. If your appeal is denied, we will provide information about other available remedies, including the option to contact the California Privacy Protection Agency or California Attorney General where applicable.
12. Timing and Cost
We will confirm receipt of a request to know, delete, or correct within 10 business days and describe our verification process. We will respond to a verifiable request within 45 calendar days. If reasonably necessary, we may extend the response period by up to an additional 45 days after notifying you of the reason and extension within the initial 45-day period.
We generally provide required information free of charge. If a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or decline to act as permitted by law and will explain our decision.
13. Financial Incentives
We do not currently offer a financial incentive or price/service difference in exchange for the retention, sale, or sharing of personal information. [Remove or replace this section if Resumás offers referral rewards, discounts, loyalty benefits, sweepstakes, or similar programs involving personal information.] If we offer a covered financial-incentive program in the future, we will provide a separate notice describing its material terms, how to opt in, how to withdraw, and a good-faith estimate of the value of the consumer’s data.
14. Children and Minors
The Services are not directed to children under 16, and we do not knowingly sell or share personal information of consumers under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will take appropriate steps to delete it. Parents or guardians may contact us at support@resumas.com with concerns.
15. Security Incidents
We use reasonable administrative, technical, and physical safeguards designed to protect personal information. If a security incident occurs, we will investigate, take steps to contain and remediate it, and provide notices to affected individuals, regulators, consumer-reporting agencies, or others when required by applicable law. This Policy does not create a specific breach-notification deadline beyond the deadlines required by law.
16. Changes to This Policy
We may update this California Policy to reflect changes in our practices, technology, providers, Services, or legal obligations. We will post the revised version, update the “Last Updated” date, and provide additional notice when required. Where a change materially expands the collection, use, or disclosure of personal information, we will provide notice and obtain consent where required before applying the change.
17. Contact and Complaints
For questions about this Policy or our privacy practices, contact:
Workscaler Inc. / Resumás
Attn: Privacy Team
717 K Street
Sacramento, CA 95814
Email: support@resumas.com
You may also submit a complaint to the California Privacy Protection Agency or the California Attorney General.