1. Purpose and Scope
This DPA supplements the Terms of Service and applies whenever an organization workspace customer ("Customer" or "Data Controller") uploads candidate curriculum vitae (CVs), resumes, or applicant materials into LoopResume AI ("Processor") for parsing, ATS keyword alignment, and match ranking.
Individual job seekers creating personal accounts are governed directly by our consumer Privacy Policy.
2. Candidate Data Categories Collected
When an organization workspace uploads candidate documents, the system processes and retains:
- Raw CV Document: Uploaded files (PDF, DOCX, or TXT) stored in encrypted cloud object storage (AES-256).
- Extracted Plain Text: Normalized text extracted from the document to execute algorithmic rubric scoring.
- Candidate Identifiers: Name, email address, phone number, and location parsed from the document or entered by team members.
- Match & Score Snapshots: Algorithmic match scores, identified keyword gaps, and frozen snapshots of target requisition text.
- Recruiter Triage Notes: Internal categorization tags (Shortlisted, Interview, Disqualified) recorded by workspace members.
3. Automated Retention & Deletion Schedule
To guarantee data minimization in accordance with the Indian DPDP Act 2023 and EU GDPR Article 5(1)(e), LoopResume AI enforces automated data retention schedules executed via daily automated workers:
| Data Category | Retention Window | Purge Mechanism |
|---|---|---|
| Candidate CVs & Extracted Text | 12 Months | Permanent deletion of cloud object storage assets and normalized database records |
| Match Scoring History & Requisitions | 30 Months | Candidate PII stripped; anonymized statistical rubric counts retained for reporting |
Individual Deletion Requests: If a job candidate contacts either the Customer or LoopResume AI directly to request erasure of their personal data, we immediately execute a cascading purge across all organization databases, removing documents, text records, and match rows within forty-eight (48) hours.
4. Active Infrastructure Sub-Processors
We engage the following authorized sub-processors under contractual commitments ensuring equivalent data protection safeguards:
- Amazon Web Services (AWS): Cloud object storage (S3) for secure, presigned CV document storage with server-side AES-256 encryption.
- Google Cloud (GenAI Enterprise): Large language model inference APIs for rubric formatting and parsing normalization under enterprise no-training agreements.
- Managed PostgreSQL: Encrypted relational database instances housing workspace permissions and scoring indices.
- Cloudflare: Edge routing, DDoS mitigation, web application firewall (WAF), and global TLS 1.3 network transport.
- Payment Processors: Razorpay Software Private Limited (India) and Dodo Payments / Stripe (International) for customer organization subscription billing.
5. Security Standards & Incident Notification
We maintain rigorous technical and organizational controls including end-to-end encryption in transit (TLS 1.3), AES-256 encryption at rest, principle-of-least-privilege access, and automated vulnerability scanning.
In the event of a confirmed security incident affecting Customer candidate data, LoopResume AI will notify the Customer's primary administrative contact within forty-eight (48) hours of becoming aware of the incident, providing details regarding the nature of the breach and remediation actions taken.
6. Contact & DPA Execution
Enterprise and institutional customers requiring a countersigned copy of this DPA or custom EU Standard Contractual Clauses (SCCs) may contact our compliance team:
Compliance & Legal Desk:
- Entity: Montr AI Labs Pvt. Ltd.
- Compliance Email: hi@loopresumeai.com
- Support Email: hi@loopresumeai.com
- Physical Entity: Montr AI Labs Pvt. Ltd., India