Privacy Policy
- Effective
- Last updated
This document is awaiting legal review.
It describes how NexumeLab actually handles your data today and is published in good faith, but it has not yet been reviewed by a qualified lawyer. Wording may change once it has been.
This policy explains what personal data NexumeLab collects, what we do with it, and what you can require of us. It is written to be read rather than to be survived, so it says things plainly.
Who is responsible for your data
NexumeLab is a privately operated business in Canada. We are the data controller for the personal data described here.
For anything in this policy — including any request to see, correct, export or delete your data — contact privacy@nexumelab.com. We answer data rights requests within one month, as GDPR requires.
What we collect
You give us
- Account details. Your email address and name. If you sign in with Google, we receive your email, name and Google account identifier instead of a password.
- Career content. Everything you put in your Career Vault: work history, employers, dates, job titles, achievements, projects, qualifications, education and skills.
- Uploaded files. Résumés and other documents you upload, and images you add to a portfolio.
- Applications and job interests. The job postings you save, the applications you build, and the postings you tell us you are interested in.
- Messages. What you write to our AI assistants.
- Billing details. If you buy credits, Stripe collects and holds your card details. We never see or store a card number.
Special categories of data
A CV is a document people often use to disclose things GDPR treats as special category data — health conditions, disability, trade union membership, religious or philosophical belief, ethnic origin, or political opinion. We do not ask for any of it, and we do not want it.
If you include it, we process it only because you have chosen to make it part of your career profile and have asked us to work on that profile — your explicit consent under Article 9(2)(a). You can remove it at any time by editing the content, and you can withdraw that consent by deleting the content or your account.
If you would rather we never held it, leave it out of your Vault and out of any file you upload.
We generate
- AI assessments. Profile quality scores, résumé audits, and rankings of how well your experience matches a job posting. See Automated decisions below.
- Search embeddings. Numerical representations of your work experience that let us match it to job postings.
- Usage records. Credits spent, features used, and which onboarding guides you have completed.
We collect automatically
- Technical logs. IP address, browser type, and request traces, kept for security and to debug faults.
- Cookies. Only the three strictly necessary ones described in our Cookie Policy. We run no analytics, no advertising trackers, and no session recording.
Why we process it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Run your account, store your Vault, build résumés and applications | To provide the service you signed up for | Contract — Art 6(1)(b) |
| Process payments and keep billing records | To charge you, and to satisfy tax and accounting law | Contract; legal obligation — Art 6(1)(b), (c) |
| Score, audit and improve your profile with AI | Core to what the product does | Contract — Art 6(1)(b) |
| Show your profile to a recruiter whose posting you marked as interesting | Because you asked us to put you forward | Consent — Art 6(1)(a) |
| Publish a portfolio page you have chosen to publish | Because you asked us to publish it | Consent — Art 6(1)(a) |
| Send service emails — password resets, receipts, access notices | To operate the account | Contract — Art 6(1)(b) |
| Keep security logs, prevent abuse, protect the platform | To keep the service safe and available | Legitimate interests — Art 6(1)(f) |
| Handle any special category data you choose to include | Only because you put it there | Explicit consent — Art 9(2)(a) |
Where we rely on consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawing consent does not affect processing that already happened.
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded it does not override them. Ask us and we will explain the assessment.
Who else sees your data
We do not sell your personal data. We never have and we do not intend to.
Recruiters
Recruiters can only see you if you told us you were interested in their specific job posting. There is no open candidate database on this platform, recruiters cannot browse or search users at large, and nobody can find you passively. When you express interest in a posting, the recruiter who owns that posting can see the relevant parts of your work experience.
A recruiter who receives your data becomes responsible for it in their own right. What they do with it after that is governed by their own privacy notice.
Service providers
We use a small number of processors to run the service. The current list, what each one receives, and where they are located is published at Sub-processors and kept up to date when it changes.
Everyone, if you publish
If you publish a portfolio page, the content you chose to publish becomes publicly visible on the internet and may be indexed by search engines. That is the point of publishing it. You control what goes on the page and you can unpublish it at any time — but a page that was public may already have been copied or cached by third parties we do not control.
Legal requests
We may disclose data where the law requires it. Where we are permitted to tell you that this has happened, we will.
Sending data outside the UK and EEA
Some of our processors are in the United States — notably OpenAI, which processes your career content to power the AI features, and Amazon Web Services, which stores uploaded files.
Where personal data leaves the UK or EEA we rely on the UK International Data Transfer Agreement and the EU Standard Contractual Clauses, together with the UK and EU adequacy decisions for the US where the recipient is certified. You can ask us for a copy of the safeguards in place for any given transfer.
How long we keep it
| Data | Kept for |
|---|---|
| Account, Vault content, applications | Until you delete your account |
| Uploaded files | Until you delete them, then up to 30 days before permanent erasure |
| AI assessments and embeddings | Until the underlying content is deleted |
| Password reset tokens | 5 minutes, then deleted |
| Previous password hashes | Only enough to refuse your last 2 passwords |
| Waitlist entries | 24 months if you never joined, or until you ask us to remove you |
| Billing and payment records | 7 years, as tax law requires |
| Security and access logs | 12 months |
When you delete your account it is closed the moment you confirm — you are signed out and it can no longer be used — and we then erase your personal data on our side, including the files in our object storage. That usually takes a few minutes, and we email you when the last of it is gone. Two things survive, and you should know about them: entries in our billing records that tax law requires us to keep, and any portfolio page content already copied or cached by a third party.
Your rights
Under UK and EU data protection law you have the right to:
- Access — get a copy of the personal data we hold about you.
- Portability — receive that data in a structured, machine-readable format, and have it sent to another provider where technically feasible.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted. You can delete your account yourself from Settings; it closes immediately and the data is erased shortly after.
- Restriction — have us pause processing while a dispute is resolved.
- Objection — object to processing we base on legitimate interests.
- Withdraw consent — at any time, for anything we do on the basis of consent.
- Not be subject to automated decisions — see below.
Exercise any of these from your account settings, or by emailing privacy@nexumelab.com. We will not charge you and we will not make it difficult.
If you think we have got this wrong, you can complain to your supervisory authority. In the UK that is the Information Commissioner's Office. In the EU it is the authority in the country where you live. We would rather you told us first so we can fix it, but you do not have to.
Automated decisions
Two parts of the product make assessments about you automatically:
- Profile scoring grades the quality and completeness of your profile and produces a numeric score with written recommendations. It looks at how your achievements are written, how specific and measurable they are, and how complete each section is.
- Candidate ranking scores how closely your work experience matches a job posting you expressed interest in, and orders candidates for the recruiter by that score.
Neither produces a legal or similarly significant effect on its own: profile scoring is advice to you, and candidate ranking orders a list that a human recruiter then reads and decides on. We do not make hiring decisions and we do not permit the platform to make them.
You can always ask us to explain how an assessment about you was reached, ask a human to review it, and contest the result. Email privacy@nexumelab.com.
Children
NexumeLab is not for children. You must be at least 16 to use it. We do not knowingly collect data from anyone younger, and we delete it if we discover we have.
Security
We encrypt data in transit, hash passwords, scope session cookies to HTTP-only and secure, and restrict access to production data to the people who need it. No system is perfectly secure. If we suffer a breach that risks your rights, we will notify the supervisory authority within 72 hours and tell you directly where the risk to you is high.
Changes to this policy
When we change something that matters, we will update the "last updated" date and tell registered users by email before the change takes effect. Continuing to use the service after that means you accept the revised policy.