Draft for counsel review. Do not treat this as an in-force legal document.
Legal
Privacy Policy
Version 0.1.0-draftLast updated 16 September 2026
This draft describes how WorkGraph ("we", "us") processes personal data when you use getworkgraph.com and related apps. It is a working placeholder for counsel, not a signed-off policy.
Privacy requests: privacy@getworkgraph.com. Related documents: Cookie Policy, Terms, and DPA.
Who we are
WorkGraph is a job-intelligence product operated from the public site at getworkgraph.com. For most jobseeker accounts we act as a controller of the personal data you submit. When an employer customer asks us to process candidate data on their instructions, we act as a processor under the Data Processing Addendum.
Categories of personal data collected
We collect the following categories. We do not require you to provide special-category data (for example health, religion, or trade-union membership) and our matching features are not designed to infer protected characteristics.
- Account: name, email address, authentication identifiers, and optional contact details you add to your profile.
- Resume content: files you upload, extracted text, skills, work history, education, and links (LinkedIn, GitHub, portfolio).
- Application activity: saved and tracked jobs, Interview Vault listings you publish or buy, employer hiring-signal connections, and notes you store in the product.
- Device / analytics: cookie consent stored in your browser, IP and user-agent on security-relevant requests, and coarse usage needed to keep the service running. We do not run a third-party advertising pixel as of this draft.
Purpose and lawful basis
The table below is the draft mapping we will ask counsel to confirm. Labels such as "contract" and "legitimate interests" refer to GDPR Article 6 where it applies.
| Category | Purpose | Lawful basis |
|---|---|---|
| Account | Create and secure your account, communicate with you, provide the service | Contract (Art. 6(1)(b) GDPR); legitimate interests in securing accounts (Art. 6(1)(f)) |
| Resume content | Profile, ATS scoring, job matching, cover letters, Talent Intelligence | Contract; consent where you opt into optional AI features |
| Application activity | Provide tracker, marketplace, and hiring-signal features you use | Contract |
| Device / analytics | Operate the site, remember consent, detect abuse, measure reliability | Legitimate interests; consent for non-essential cookies where required |
Named subprocessors
We use the following providers to operate WorkGraph. Resume files and profile text stay in our controlled stores except where a listed AI or hosting provider must process them to run a feature you use.
| Provider | Function | Hosting region |
|---|---|---|
| Supabase | Authentication, PostgreSQL database, and object storage for resumes and profile files | United States (AWS) |
| Vercel | Application hosting, edge network, and preview deployments | United States / global edge |
| Stripe | Payment processing for Interview Vault purchases when payments are enabled | United States |
| Resend | Transactional email (account, employer connection, and product notices) | United States |
| Groq | Large-language-model inference for resume parse, ATS scoring, and matching assistance | United States |
| Adzuna | Jobs-API vendor used to ingest public job listings. We do not send resume files or account emails to Adzuna. | United Kingdom / European Union (API); listing data cached in our US database |
| Public job sources (USAJobs, RemoteOK, Arbeitnow, Jobicy, Reddit, GitHub, Hacker News, and similar listing APIs) | Ingest of publicly posted job listings. We do not send resume files or account emails to these vendors. | Various (public internet) |
International transfer mechanism
WorkGraph is hosted with providers that store or process data in the United States. If you access the service from the EEA, UK, or Switzerland, that is an international transfer.
Draft mechanism: where required, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with subprocessors, plus the security measures described in the DPA. This clause will be replaced with the instruments counsel selects (SCCs, adequacy, DPF certification, or otherwise).
Retention periods per data category
Production systems follow the periods below. Encrypted backups typically rotate out within 30 days after deletion unless a legal hold applies.
| Category | Retention period |
|---|---|
| Account | Until you delete the account, then up to 30 days in backups |
| Resume content | Until you delete the resume/profile or the account; backups up to 30 days |
| Application activity | Until you delete the records or the account; backups up to 30 days |
| Device / analytics | Consent choice stored locally until you clear it; security logs typically 90 days |
Data subject rights and how to exercise them
Depending on where you live, you may have rights to access, correct, delete, export (portability), restrict, or object to certain processing, and to withdraw consent.
How to exercise them:
- Use in-product controls where they exist (profile edit, resume delete, application tracker delete, account deletion in settings).
- Email privacy@getworkgraph.com from the address on your account. State the right you want to exercise and enough detail for us to locate your data. We will not ask you to paste a full resume in that email if a less sensitive identifier will do.
- We aim to respond within 30 days (or the statutory period that applies). We may need to verify that the request comes from the account holder.
You may also lodge a complaint with your local supervisory authority. We will name our lead authority here after counsel review.
How automated matching works and your right to object
WorkGraph scores how a job listing compares to skills and experience extracted from your profile or resume. Scores are estimates, not hiring probabilities, and they are not used to make a legal or similarly significant decision about you without a human (we are not an employer).
Optional AI features (resume parse, ATS-style scoring, Talent Intelligence, cover letters) send resume-derived text to Groq to generate structured suggestions. You can refrain from uploading a resume and still browse public listings.
Right to object: email privacy@getworkgraph.comwith the subject line "Object to automated matching". We will disable personalized match scoring on your account where technically feasible and confirm when it is off. Objecting does not stop you from using the tracker or vault with manually added jobs.
Contact for privacy requests and EU Article 27 representative
Privacy requests: privacy@getworkgraph.com. General contact: Contact.
EU Article 27 representative: as of this draft WorkGraph has not appointed an EU Article 27 representative. If counsel determines that Article 27 applies, we will name the representative (name, address, and email) in this section and in the DPA before processing EU personal data at that scale.