Trust & compliance · EU regulatory readiness
Privacy by default, explained by design
Every claim on this page maps to something the product does today — and where something is not done yet, we say so.
In plain language
What this means for you, in plain language
- Your profile is anonymous by default — employers see skills and experience, never your name or contacts, until you decide to share them.
- Nothing is disclosed without your action: applying to a role or granting a reveal request. You can later revoke the employer's platform access; information already viewed, downloaded, or copied cannot be taken back.
- We never sell your data. We make money from employer subscriptions, not from your information.
- Every AI match comes with a plain-language reason — no unexplained rejections, no black box.
Data flow
Who sees what, at each step
Your data flow through MatchPRO is gated, not gradual leakage. Here is exactly what is visible to whom at every stage of the funnel.
Explore an example · choose a situation · What the employer sees
An anonymized handle, skills, experience level, salary band, and location preference — no name, no contacts, no CV file.
The full table, stage by stage
| Stage | What the employer sees | What the candidate sees | What MatchPRO stores |
|---|---|---|---|
| Anonymous browse | An anonymized handle, skills, experience level, salary band, and location preference — no name, no contacts, no CV file. | Vacancy details, salary range, and company name (if the employer chose to disclose it) — full visibility, no gating. | Your profile, identity and any CV file you uploaded, held server-side, never rendered to the employer at this stage. |
| Application / consent | Nothing new yet — the reveal grant happens at the moment of application, immediately after this step. | A plain consent notice before applying: applying shares your name, contact details, profile and — if you uploaded one — your original CV file with this employer, revocable anytime from Reveals. | The application event and the resulting consent grant, timestamped and auditable. |
| Reveal | Name, contact details and profile — plus the original CV file if the candidate uploaded one — granted either by the candidate's application or by an explicit reveal request the candidate approved. | A record of exactly which employer now holds their identity, with a one-click revoke. | The reveal grant (who, when, origin) — a durable, queryable audit trail. |
| Chat | Messages exchanged directly with the now-identified candidate through the in-app conversation. | Messages from the employer who holds their reveal — no other employer can message them. | Message content and metadata, stored to deliver and audit the conversation. Sent to the AI provider only when someone asks for reply suggestions, and only a short recent excerpt — and while a conversation is anonymous, contact details are stripped from every message as it is stored, so the excerpt cannot carry them. |
Data protection
GDPR & data protection
Your data is yours. We hold it under EU rules and handle it with structural safeguards — not policies alone.
We never sell your data to brokers
We do not resell, share for advertising, or transfer your personal data to third-party data brokers — ever. Your information is used solely to operate the matching service.
Right to erasure (GDPR Art. 17) — hard cascade
Deleting your account triggers a hard cascade: matches, contests, flags and your personal data are permanently removed, while analytics-only records such as the AI-cost ledger and matching feedback are irreversibly anonymized (the link to your identity is severed). One step, irreversible, immediate.
Automated data retention purge
A single-runner retention-purge job prunes stale data on a schedule — it runs once per window across the entire cluster, preventing both data accumulation and duplicate execution.
We do not currently hold any third-party security auditing attestations or conformity marks. We list only what is structurally in place.
We earn when employers hire — not when we sell your data. Our business model is structurally aligned with your privacy.
MatchPRO business model — privacy as product, not as policy
In detail
For lawyers and DPOs
The AI Act article by article, pay transparency and every sub-processor — open what you need.
EU AI Act (high-risk hiring): what is in place
AI matching in hiring is high-risk under Annex III. What is below is shipped and can be checked; the note under it says what is not done yet.
High-risk obligations for recruitment systems apply from the date set by the AI Act as amended
Explainability — right to explanation
Every match shows the factors behind its score — skills, experience, salary, location, whichever both sides filled in — each with a short reason. A candidate can read it on any vacancy page.
Human oversight — contest & admin review
Either side can contest a match. A person reviews the contest and records the outcome, with an audit trail.
Bias & fairness testing — counterfactual, without collecting the attribute
We test whether a protected attribute moves the score: profiles identical except for a signal read as sex, age, origin or family status run through the real ranking, and a difference above the threshold fails the run. We do it without collecting those attributes.
Data governance — the AI never hands identity back
The AI reads a CV as its author wrote it, so the guarantee is that it never hands identity back: the CV Q&A refuses identity-seeking questions, and contact details are scrubbed from its answers.
Not in place yet: the formal technical documentation (Art. 11) and registration in the EU high-risk database (Art. 49). The fairness check has limits too: a first name or a graduation year can still move a score slightly, below the threshold.
Pay transparency
In line with EU Pay Transparency Directive 2023/970, a structured salary range is mandatory on every vacancy posted on MatchPRO. A vacancy without a salary range cannot be published — this is enforced by the API schema, not an optional field.
Subprocessors — who else touches your data
We use a small, named set of subprocessors to run the service. Each one is scoped to a specific purpose and never receives more than it needs.
| Subprocessor | Purpose | Region |
|---|---|---|
| OpenRouter | AI inference for CV parsing, moderation, match explanations and CV Q&A. Receives resume and vacancy text as written, never your account identity; nothing it returns is shown to others together with contact details. | US-based routing to multiple model providers |
| Stripe | Payment processing for subscriptions and one-time purchases (boosts, reveal top-ups). | EU/US, PCI-DSS compliant |
| Meilisearch | Full-text search and filtering over published resumes and vacancies — indexes only already-anonymized, publicly listed fields. | Self-hosted alongside our infrastructure |
| Hetzner | Application, database, and file storage infrastructure. | EU-region infrastructure |
| Cloudflare | Traffic protection in front of the site and encrypted (AES-256-GCM) object storage of uploaded CV files. | Global edge; file storage under EU jurisdiction |
| Centrifugo | Realtime delivery for chat messages and live notifications — self-hosted, short-lived connection tokens only. | Self-hosted alongside our infrastructure |
| Resend | Transactional email delivery (notifications, digests you opted into) and bounce or complaint feedback. | US-based; EU–US Data Privacy Framework / SCCs |
| Telegram | Notifications and sign-in through the MatchPRO bot — only if you connect it; receives your chat ID, never your CV. | Telegram Messenger Inc. |
Employer-controllers who need a signed Data Processing Agreement for their own compliance file can request one.
Request a DPARead the full details
Our privacy policy covers data processing, retention, and your rights in full.