How PickMe handles personal information

Chino is the controller of personal information processed through PickMe, unless a separate written agreement says that PickMe acts only as a processor for an agency or business customer.

• PickMe Crew: a hiring person pastes a job description and uploads the CVs they received from applicants. Most of the personal information processed here belongs to the applicants, not to the person using the site.
• PickMe Job: a candidate uploads their own CV together with a job they want to apply for.

This is the most important section of this policy. When you use PickMe Crew, you are submitting other people's personal information: their identity, contact details, work history, qualifications, and anything else their CV contains.

• You confirm that you received those CVs legitimately, normally because their owners sent them to you or your organisation as part of a job application, and that screening them for that position is within what the applicants would reasonably expect.
• You must not upload CVs obtained from scraping, purchased lists, leaks, or any source their owners did not choose.
• You remain responsible under the laws that apply to you for having a lawful basis to process your applicants' information.
• Use the results only for the recruitment decision at hand. Do not republish other people's CV information.
• Downloaded reports contain applicants' personal details. Store and share them with the same care as the CVs themselves, and delete them when the position is filled.

PickMe's own design limits what can go wrong: nothing a hiring user uploads is stored on PickMe's servers (see section 6), no candidate is auto-rejected, and every statement the AI makes is tied to the CV's own words.

• CV files and the text extracted from them: identity, contact details, work history, education, qualifications, certifications, skills, languages, and personal statements the CV contains (for example an availability date or a non-smoker line).
• Job descriptions and the requirements you mark as important.
• Communications sent to the legal, privacy, safety, or support contact.

Do not upload passport or national identity numbers, bank details, medical information, criminal records, or other information that is not necessary for a job application, whether it is yours or an applicant's.

• Technical request information normally processed by hosting infrastructure, such as IP address, browser information, timestamps, security logs, and per-visitor usage counters used to prevent abuse.
• Anonymous, cookieless page-view analytics (visit and page counts via Vercel Web Analytics), used only to understand how many people use the tool and how far they get. No advertising identifiers and no cross-site tracking.
• Locally cached working data in your own browser while you use the tool.

PickMe does not currently use advertising cookies, cross-site tracking pixels, or behavioural advertising profiles.

PickMe keeps no server-side database of CVs, candidates, jobs, or screening results. There is exactly one thing PickMe stores, described below, and it is stored only when you ask for it.

• Uploaded files are held in server memory only long enough to extract their text, and are not retained as files.
• Extracted text and job text are sent to the AI provider (section 7) to produce the analysis, and the result is returned to your browser.
• Screening results exist in your browser tab. Closing the tab discards them unless you downloaded the report.
• The downloaded report is a file on your device, under your control and your responsibility.

Published CV pages. On the CV page builder, you can choose to publish your own page as a link. Only then does PickMe store something: the finished page, built from your own CV, at an address made of eight random characters. Nothing else is stored with it, no account, no email address, and not the original file.

• The page is private by an unguessable address, not by a password. Anyone you give the link to can open it, and so could anyone they pass it to.
• There is no directory, no listing, and no way to move from one published page to another. Every published page is served with instructions telling search engines not to index it.
• You can delete a published page at any time from the builder, which removes it from PickMe's storage. Proof that the page is yours is kept in your own browser, so clearing your browser data removes your ability to delete it from the builder. In that case, contact the operator (section 15).
• A published page stays stored until you delete it.

If PickMe later adds saved screenings or accounts, this policy will be updated first and the change will be visible in the product.

CV and job content is sent to a paid third-party AI provider to perform reading and matching. PickMe's currently configured provider is DeepSeek, with Google's Gemini API and the OpenAI API available as automatic fallbacks if the primary provider is unavailable. The operator may change the primary provider over time; this section is updated when that happens. PickMe does not use unpaid or free-tier AI services for production CV processing, because those services may use submitted content to improve the provider's own products and may involve human review.

• DeepSeek API terms.
• Gemini API terms and Gemini retention information.
• OpenAI API data controls.

AI providers may retain limited request data for abuse monitoring and service security under their terms. PickMe does not opt in to provider model training with API content.

• The AI classifies what the CV shows; the final grouping is calculated by fixed rules in code, not written by the AI.
• No candidate is rejected automatically. Every uploaded CV stays visible to the user with its evidence, including files that could not be read.
• Statements about a person are tied to their CV's own words. Where the CV is silent, PickMe reports that it does not know rather than guessing, and personal matters a CV need not mention (for example smoking) are never counted against anyone.
• The screening is decision support for a human. The hiring decision, and responsibility for it, stays with the person hiring.

Information may be processed by the hosting, network, security, and AI vendors used to run PickMe, including Vercel. Information may also be disclosed when required by law, to investigate fraud or security threats, to protect rights and safety, or as part of a business transfer subject to appropriate safeguards.

PickMe does not sell personal information and does not share it for cross-context behavioural advertising.

Service providers may process information outside your country. The currently configured AI provider, DeepSeek, processes data in China; the fallback providers process in the United States. Hosting and operations are in Israel and the United States. Where required, the operator will use a lawful transfer mechanism and contractual or organisational safeguards.

• CV and job content: not retained on PickMe's servers beyond the processing described in section 6.
• A CV page you chose to publish: retained until you delete it. See section 6.
• Security and infrastructure logs: retained for the periods described by the relevant provider or as required by law.
• Correspondence and legal records: retained for the applicable limitation period.

Depending on your location, you may have rights to access, receive a copy of, correct, delete, restrict, or object to processing of personal information, withdraw consent, and complain to a privacy regulator.

• If you are a candidate whose CV was uploaded by someone else: you can contact the operator using the details in section 1. Because PickMe does not store CVs or results server-side, there is usually nothing held about you to delete, but the operator will confirm that, answer questions about the processing, and take up any concern with the uploader where appropriate.
• If you used the tool yourself: your working data lives in your own browser and your downloaded files; clearing site data and deleting the files removes it.

The operator may need to verify your identity and may retain limited information when legally required. You may complain to the Israeli Privacy Protection Authority or the competent authority where you live.

PickMe uses technical and organisational measures intended to reduce unauthorised access, alteration, disclosure, and loss, including request-size limits, per-visitor usage ceilings, input normalisation, restricted service credentials, and a design that stores nothing on a server except a CV page you chose to publish yourself. Published pages are protected by an unguessable address rather than by a password, which is stated plainly where you publish one. No online service is completely secure.

PickMe is for adults aged 18 or older and is not directed to children. Do not submit information about a person under 18. Contact the operator if you believe a minor's information was submitted.

Material changes will be identified by a new effective date and, where required, a new consent request. Continued use after a non-material update means the updated policy applies to future use.