This Privacy Policy details the policies and practices of iFormat Personal Branding ("iFormat", "we", "us", or "our") regarding the collection, storage, processing, transfer, and disclosure of your personal data when using our ecosystem of services. We adhere strictly to international privacy frameworks including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Overview & Privacy Principles
We operate on fundamental privacy-by-design principles:
Data Minimization
We only collect data strictly necessary to deliver ATS resume analysis, job matching, and platform authentication.
Purpose Limitation
Your career data is never used for secondary marketing purposes or undisclosed commercial analytics.
2. Information We Collect
Depending on your interactions with iFormat, we collect the following categories of information:
A. Account & Profile Information
Full name, email address, password hash (bcrypt), telephone number, profile avatar, role selection (Candidate or Employer), and OAuth identifiers (Google Account ID) when signing in with Google.
B. Career & Professional Content (Candidates)
Resumes, CV files (PDF, DOCX), employment history, education, certifications, portfolio links, cover letters, target job titles, and career preferences.
C. Company & Hiring Data (Employers)
Company name, corporate email, industry, company website, logo, job listing descriptions, hiring requirements, and applicant evaluation notes.
D. Technical & Log Data
IP addresses, browser type, device operating system, referring URLs, access timestamps, and session tokens managed via HttpOnly secure cookies.
3. How We Process & Use Your Information
- Service Execution: Generating ATS-optimized resume formats, calculating match percentages, and submitting job applications to employers you select.
- Authentication & Security: Maintaining secure dual-token authentication (short-lived access tokens and 7-day refresh tokens) and rate-limiting brute force attempts.
- Transactional Notifications: Sending OTP verification codes, password resets, application status alerts, and interview invitations via verified Amazon SES / SMTP.
- Financial Processing: Billing subscription tiers through Stripe, managing automated renewal intervals, and maintaining tax compliance records.
4. AI Career Assistant & Responsible AI
Our AI microservice (hosted on ai.iformatbranding.com) leverages enterprise foundation models via Amazon Bedrock:
1. No Public Training: Your resume text, personal background, and application materials are never used to train, retrain, or improve public foundation models.
2. Transient Processing: Prompt payloads sent to the AI microservice are processed strictly in memory during analysis and discarded once recommendations are returned.
3. Data Encryption: All communications between the backend API and the AI engine travel over encrypted HTTPS / TLS channels.
5. Third-Party Subprocessors & Infrastructure
We work exclusively with ISO 27001 and SOC 2 Type II certified cloud infrastructure partners:
| Subprocessor | Purpose | Location | Security Standard |
|---|---|---|---|
| Amazon Web Services (AWS) | RDS PostgreSQL & S3 Media / Resume Storage | Frankfurt (eu-central-1) | SOC 1/2/3, ISO 27001, HIPAA |
| Google Cloud (OAuth 2.0) | Single Sign-On & Account Verification | Global | SOC 2/3, ISO 27001 |
| Stripe, Inc. | Subscription Billing & Invoicing Gateway | United States / Global | PCI-DSS Level 1 Certified |
| Redis Labs / Cloud | Session Store & Distributed Rate Limiting | Europe / Cloud | TLS Enforced, Memory Guard |
7. Data Retention & Permanent Deletion
We retain your profile data and uploaded resumes for as long as your account remains active. When you initiate an account deletion request through your dashboard:
8. Your Privacy Rights (GDPR & Global Rights)
Under international data protection legislation, you enjoy the following enforceable rights:
9. Security & Cryptographic Safeguards
We implement multi-layered physical, administrative, and technological safeguards to prevent unauthorized access, disclosure, or alteration of your records:
- TLS 1.3 Encryption: All browser-to-server traffic is encrypted using modern high-cipher SSL/TLS certificates.
- Role-Based Access Control (RBAC): Server middleware strictly limits route access so candidates and employers can never access each other's private onboarding or management dashboards.
- Automated Secret Protection: API keys, RDS connection credentials, and webhook secrets are isolated in protected environment vaults with zero public exposure.
10. Contact Our Data Protection Team
If you have inquiries, wish to exercise any of your statutory privacy rights, or need assistance regarding this Privacy Policy, our dedicated team is at your service:
Data Protection & Compliance Office
Organization: iFormat Personal Branding & Career Platform
Direct Privacy Email: privacy@iformatbranding.com
Customer Support: support@iformatbranding.com
Response Commitment: All verified data access, export, or erasure requests are addressed within 30 days.