Privacy Policy

1. Introduction

This Privacy Policy describes how Atlas Capital SpA, a company incorporated under the laws of Chile with its principal place of business in Santiago, Chile ("CVParserPro," "we," "us," or "our"), collects, uses, discloses, and protects personal data in connection with our resume parsing services, website (https://cvparserpro.com), and application programming interface ("API") (collectively, the "Service").

CVParserPro provides AI-powered resume and CV parsing services that extract structured data from unstructured resume documents. Our customers ("Customers") are typically recruiters, human resources professionals, staffing agencies, applicant tracking system vendors, and enterprises who use our Service to process resumes and CVs of job applicants and candidates ("Data Subjects" or "Candidates").

This Privacy Policy applies to:

• Visitors to our website
• Customers who create accounts and use our Service
• Candidates whose resumes are processed through our Service
• Any other individuals whose personal data we process

By accessing or using our Service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller and Data Processor Roles

2.1 When We Act as Data Processor

When Customers upload resumes to our Service for parsing, CVParserPro acts as a data processor (under GDPR) and service provider (under CCPA/CPRA). Our Customers are the data controllers who determine why and how Candidate personal data is processed.

As a data processor, we:

• Process Candidate personal data solely on behalf of and under the instructions of our Customers
• Do not determine the purposes or means of processing Candidate personal data
• Do not use Candidate personal data for our own purposes except as described in Section 5.3
• Are bound by our Data Processing Agreement with each Customer

2.2 When We Act as Data Controller

CVParserPro acts as a data controller for:

• Personal data of website visitors (cookies, analytics)
• Personal data of Customers (account information, billing)
• Personal data we process for our own business purposes

2.3 Our Customers' Responsibilities

Our Customers are responsible for:

• Obtaining all necessary consents and authorizations from Candidates before uploading their resumes to our Service
• Providing appropriate privacy notices to Candidates
• Ensuring their use of our Service complies with applicable data protection laws
• Responding to data subject rights requests from Candidates
• Determining appropriate retention periods for parsed data

3. Personal Data We Collect

3.1 Categories of Personal Data in Resumes

When Customers upload resumes to our Service, we may process the following categories of personal data contained in those documents:

Special Category / Sensitive Personal Data: Resumes may contain or reveal special category data under GDPR Article 9 or sensitive personal information under CCPA, including racial or ethnic origin (inferred from names or photos), religious beliefs (inferred from education or activities), health information (disability disclosures), or trade union membership. We do not intentionally extract or categorize such sensitive data, but it may be present in the documents processed.

3.2 Customer Account Information

When Customers register for our Service, we collect:

• Business name and contact information
• Account administrator name and email address
• Billing information (processed by our payment processor)
• API credentials and usage data
• Communications with our support team

3.3 Website Visitor Information

When you visit our website, we automatically collect:

• IP address and approximate geolocation
• Browser type and version
• Device information
• Pages visited and time spent
• Referring website
• Cookies and similar tracking technologies (see Section 9)

4. How We Collect Personal Data

We collect personal data through:

1. Direct submission: When Customers upload resumes via our API or web interface
2. Account registration: When Customers create accounts and provide business information
3. Automated collection: Through cookies and similar technologies on our website
4. Communications: When you contact us via email, chat, or support tickets
5. Third-party sources: From our payment processor regarding billing information

5. How We Use Personal Data

5.1 Processing Candidate Resumes (as Data Processor)

We process Candidate personal data contained in resumes solely to:

• Parse and extract structured data from resume documents
• Return parsed data to our Customers via API response
• Provide the parsing services requested by our Customers

Legal Basis (GDPR): Performance of our contract with Customers; our Customers rely on their own legal bases (typically legitimate interests or consent) for their processing of Candidate data.

5.2 Customer Account Management (as Data Controller)

We use Customer personal data to:

• Create and manage Customer accounts
• Process payments and billing
• Provide customer support
• Send service-related communications
• Enforce our Terms of Service
• Comply with legal obligations

Legal Basis (GDPR): Performance of contract (account management, service delivery); legitimate interests (customer support, service improvement); legal obligation (compliance).

5.3 Service Improvement and Model Training

We may use anonymized and aggregated data derived from parsed resumes to:

• Improve the accuracy and performance of our parsing algorithms
• Train and enhance our machine learning models
• Conduct research and development
• Generate aggregate analytics and benchmarks

Important: Before any data is used for these purposes, we apply anonymization techniques designed to prevent identification of individual Candidates. This includes removing all direct identifiers, generalizing quasi-identifiers, and ensuring the data cannot reasonably be used to identify any individual. Anonymized data is no longer considered personal data under applicable data protection laws.

Customers may opt out of having their data used for model training by contacting us at [email protected] or through their account settings.

Legal Basis (GDPR): Legitimate interests (improving our services); consent (where required).

5.4 Marketing Communications

With Customer consent, we may send:

• Product updates and new feature announcements
• Industry news and resources
• Promotional offers

You may opt out of marketing communications at any time by clicking "unsubscribe" in any email or contacting us at [email protected].

Legal Basis (GDPR): Consent.

6. How We Share Personal Data

6.1 Service Providers (Subprocessors)

We share personal data with the following categories of service providers who process data on our behalf:

Information about our subprocessor categories is maintained at: https://cvparserpro.com/legal/subprocessors

Enterprise customers requiring specific subprocessor names for their own compliance purposes may request this information under NDA by contacting [email protected].

We will notify Customers at least thirty (30) days before making material changes to our subprocessor arrangements.

6.2 Other Disclosures

We may also disclose personal data:

• To comply with law: When required by applicable law, regulation, legal process, or governmental request
• To protect rights: To enforce our Terms of Service, protect our rights, privacy, safety, or property, or that of our Customers or others
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, subject to confidentiality obligations
• With consent: With your consent or at your direction

6.3 No Sale of Personal Data

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not receive monetary or other valuable consideration in exchange for personal data.

7. International Data Transfers

7.1 Transfers from the European Economic Area (EEA)

Atlas Capital SpA is located in Chile, which does not have an adequacy decision from the European Commission. When we transfer personal data from the EEA to Chile or to our subprocessors in the United States, we rely on:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor, and Module 3: Processor to Processor) as adopted by Commission Implementing Decision (EU) 2021/914.
• Supplementary Measures: Including encryption in transit and at rest, access controls, audit logging, and contractual commitments.

We have conducted Transfer Impact Assessments evaluating the legal frameworks of destination countries and implemented appropriate supplementary measures.

A copy of the applicable SCCs is available upon request at [email protected].

7.2 Transfers from the United Kingdom

For transfers from the United Kingdom, we use the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, as appropriate.

7.3 Transfers from Other Jurisdictions

We comply with applicable data transfer requirements in all jurisdictions where we operate.

8. Data Retention

8.1 Resume Data

• Parsed resume data is returned to Customers immediately upon processing and is not retained by CVParserPro beyond the duration necessary to complete the parsing request, except as described below.
• Temporary processing: Resume files may be temporarily stored in memory or temporary storage during processing, typically for less than sixty (60) seconds.
• Error logging: In case of processing errors, limited data may be retained in logs for up to seven (7) days for debugging purposes.
• Anonymized data: Anonymized and aggregated data derived from resumes may be retained indefinitely for service improvement purposes.

8.2 Customer Account Data

• Active accounts: Retained for the duration of the Customer relationship
• After termination: Retained for up to three (3) years after account closure for legal and compliance purposes
• Billing records: Retained for seven (7) years as required by tax and accounting regulations

8.3 Website Data

• Analytics data: Retained for up to twenty-six (26) months
• Server logs: Retained for up to ninety (90) days

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

9.2 Your Cookie Choices

You can control cookies through:

• Your browser settings
• Our cookie consent banner (for EU/UK visitors)
• Opt-out links for specific analytics providers

10. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption: TLS 1.3 for data in transit; AES-256 encryption for data at rest
• Access controls: Role-based access, multi-factor authentication, principle of least privilege
• Infrastructure security: SOC 2 Type II certified cloud providers, regular security assessments
• Network security: Firewalls, intrusion detection, DDoS protection
• Monitoring: Continuous security monitoring and logging
• Incident response: Documented incident response procedures
• Employee training: Regular security awareness training

While we implement industry-standard security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of personal data.

11. Your Privacy Rights

11.1 Rights for All Users

Regardless of your location, you may:

• Request information about our data practices
• Contact us with privacy questions or concerns
• Opt out of marketing communications

11.2 Rights for EEA, UK, and Swiss Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under GDPR:

For Candidates: If your resume was processed through our Service, please contact the organization (recruiter, employer, or agency) that uploaded your resume. They are the data controller responsible for responding to your rights requests. If they instruct us to delete or modify your data, we will comply.

For Customers: To exercise your rights regarding your account data, contact us at [email protected].

Supervisory Authority: You have the right to lodge a complaint with your local data protection supervisory authority.

11.3 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

To Exercise Your Rights: Submit a request to [email protected]. We will respond within 45 days (extendable by an additional 45 days if necessary).

Verification: We will verify your identity before processing your request. For Candidates, please contact the organization that uploaded your resume, as they are responsible for responding to your requests under CCPA.

Authorized Agent: You may designate an authorized agent to make requests on your behalf with proper written authorization.

11.4 Rights for Chilean Residents

If you are a resident of Chile, you have rights under Ley 19.628 (and, effective December 1, 2026, Law 21.719), including:

• Access: Request information about your personal data we hold
• Rectification: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of data processed without authorization or that is no longer necessary
• Objection: Object to processing in certain circumstances

To Exercise Your Rights: Contact us at [email protected].

12. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such information promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify Customers via email or through our Service
• Post the updated policy on our website

We encourage you to review this Privacy Policy periodically.

14. Contact Information

14.1 Data Controller Contact

Atlas Capital SpA (operating as CVParserPro)
Badajoz 100, Of. 1004
Santiago, Chile

Email: [email protected]
Phone: +56 2 3358 0539

14.2 Data Protection Inquiries

For data protection inquiries, complaints, or to exercise your privacy rights:

Email: [email protected]
Subject Line: "Privacy Request - [Your Request Type]"

We will respond to your inquiry within thirty (30) days.

15. Additional Disclosures

15.1 Do Not Track Signals

Our website does not currently respond to "Do Not Track" browser signals. However, you can control tracking through cookies as described in Section 9.

15.2 Financial Incentives

We do not offer financial incentives related to the collection, retention, or sale of personal information.

15.3 California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

16. Jurisdiction-Specific Notices

16.1 For EU/EEA Residents

This Privacy Policy serves as our privacy notice under GDPR Articles 13 and 14. Our legal bases for processing are specified throughout this policy.

Important Notice: CVParserPro is incorporated in Chile and operates its services from Chile and the United States. We do not have an establishment in the European Union. If you are an EU/EEA resident or business using our Service:

• For Customers (businesses): You are the data controller for any personal data you process through our Service. You are solely responsible for ensuring your use of the Service complies with GDPR, including obtaining valid legal bases, providing required notices to data subjects, and responding to data subject requests. By using our Service, you represent and warrant that you have fulfilled all GDPR obligations applicable to your processing activities.

• For Candidates: If your resume was processed through our Service by a recruiter or employer, that organization is the data controller. Please contact them directly regarding any data protection concerns or requests.

You have the right to lodge a complaint with your local supervisory authority regarding the data controller's processing of your data.

16.2 For California Residents

CCPA Categories: The categories of personal information we collect correspond to the following CCPA categories: Identifiers (Category A), Professional or Employment Information (Category D), Education Information (Category E), and Internet Activity (Category F).

Sources: We collect personal information from Customers (who upload resume data), directly from you, and automatically through our website.

Business Purpose: We collect and use personal information for the business purposes described in Section 5.

Disclosure: In the preceding 12 months, we have disclosed personal information to service providers as described in Section 6.

Sale/Sharing: We have not sold or shared personal information in the preceding 12 months.

16.3 Para Residentes de Chile

Esta Política de Privacidad cumple con los requisitos de la Ley 19.628 sobre Protección de la Vida Privada. Usted tiene derecho a acceder, rectificar, cancelar y oponerse al tratamiento de sus datos personales contactándonos a [email protected].

© 2026 Atlas Capital SpA. All rights reserved.