Privacy Policy

1. Who we are

Penmark is a resume review platform that lets job seekers share their resume with reviewers who can annotate it inline. We are operated as an independent product. For any privacy questions, contact us at privacy@penmark.app.

2. What data we collect

• Email address — collected when you upload a resume, used to send you your shareable link and login access.
• Name and target role — optional fields collected at upload, used only to personalise your resume link page for reviewers.
• Resume PDF — the file you upload. Stored securely and accessible only via your unique shareable link.
• Reviewer comments — text annotations left by people you share your link with. Reviewers do not need to sign up and we do not collect their personal data.
• Usage data — basic session and authentication data managed by Supabase (e.g. login tokens). We do not use third-party analytics or tracking cookies.

3. Where your data is stored

All data — including your resume file, email address, and comments — is stored on Supabase servers located in the EU (Ireland, AWS eu-west-1). No data is transferred outside the European Economic Area.

4. How we use your data

• To generate and deliver your unique resume review link
• To send you email notifications when a reviewer leaves a comment
• To allow you to log in to your dashboard and manage your resumes
• To automatically delete your resume after the retention period expires (30 days for free accounts)

We do not sell your data. We do not use your resume for training AI models.

5. Data retention

Resume files on the free plan are automatically deleted after 30 days. You will receive a warning email before deletion. Paid plan users have extended retention as described in their plan. You can request early deletion at any time (see below).

6. Your rights

Under UK and EU data protection law (GDPR / UK GDPR), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (the “right to be forgotten”)
• Object to or restrict processing of your data
• Lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or your national DPA in the EU)

To exercise any of these rights, email us at privacy@penmark.app and we will respond within 30 days.

7. How to request deletion

Email privacy@penmark.app with the subject line “Delete my data” and include the email address associated with your account. We will permanently delete your resume files, comments, and account data within 7 days.

8. Cookies

We use only essential session cookies required for authentication. We do not use advertising, tracking, or analytics cookies.

9. Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page. Continued use of Penmark after changes are published constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or requests, contact us at privacy@penmark.app.