Who is responsible
The controller of your personal data is Evgenii Zakharov (Անհատ ձեռնարկատեր Եվգենի Զախարով Սերգեյի), individual entrepreneur registered in the Republic of Armenia, state registration number 286.1480564, TIN 40325938, 97 Buzand St., apt. 17, Kentron district, Yerevan 0002, Republic of Armenia ("we"). Contact for privacy matters: privacy@tunedhq.io.
Scope
This policy covers the website tunedhq.io, the application app.tunedhq.io, its API and emails we send. It does not cover third-party websites and services you reach from Tuned, such as payment pages or sign-in providers: their own policies apply.
What data we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, name, interface language, sign-in provider and account ID, date and version of your consent, your privacy settings | You; Google, LinkedIn or GitHub if you sign in with them |
| Resume content | Everything you add to a base resume: contact details, work history, education, skills, projects and any other text | You; a PDF or DOCX you upload |
| Job postings | Text and link of postings you add | You |
| Generated content | Tailored versions, cover letters, suggestions, match scores, quality checks, base improvement proposals | Created by the Service from the data above |
| Files | PDF and DOCX files uploaded for import; exported PDF and DOCX files | You; the Service |
| Payments | Plan, status and dates of access, amounts, currency, country, payment provider IDs of the customer and transaction. We never receive card numbers | Polar or the Russian payment service |
| Usage | Number and time of tailoring runs, letters, imports and improvements, model tokens and costs | The Service |
| Technical | IP address, browser type, request times and errors; session cookie; for each device you are signed in on, its browser, operating system and how you signed in | Your browser and device |
| Error reports | When something breaks: the type of error and where in our code it happened, its text with email addresses, identifiers, numbers and quoted text removed, the page path without identifiers, browser and operating system; page load measurements of the application. No account, IP address, cookies or document content | The Service and your browser |
| Service counters | Anonymous counts of how the service runs: requests, errors, refusals, emails sent, tailoring runs, model tokens and their cost. No addresses, identifiers or document content — numbers only | The Service |
| Correspondence | Messages you send to our addresses and our replies | You |
A resume you check on the website without an account is processed only to produce the result and is not stored.
Sensitive information in resumes
We do not ask for special categories of data, such as health, religion, political views, ethnic origin or trade union membership, and you do not need them to use Tuned. Resumes sometimes contain them anyway, for example a disability or membership in an organisation.
If you add such information, you give your explicit consent to its processing for the purpose of providing the Service to you. You can remove it at any time, and you can withdraw consent by deleting it or your account. Please do not add more than a job application needs.
Why we process data, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, storing documents, tailoring, letters, checks and exports | Account, resume content, postings, generated content, files | Performance of the contract (Art. 6(1)(b)) |
| Sending content to AI providers to perform these features | Resume content and postings, with contact details handled as described below | Performance of the contract |
| Sign-in codes and service emails | Email address | Performance of the contract |
| Payments, access, quotas, refunds, tax and accounting records | Payments, usage, account | Contract; legal obligation (Art. 6(1)(c)) |
| Security, fraud and abuse prevention, debugging | Technical, usage, account, error reports | Legitimate interest in a safe, working service (Art. 6(1)(f)) |
| Evaluating and improving quality | Pseudonymised samples of content and output | Legitimate interest; you can object at any time |
| Answering your requests, establishing and defending legal claims | Correspondence and the data the request concerns | Contract; legitimate interest; legal obligation |
| Sensitive information you choose to include | Special categories in resume content | Explicit consent (Art. 9(2)(a)) |
Where the law of your country requires consent for processing or for international transfers (for example, Russia or Armenia), we rely on the Consent to Data Processing you give when signing in.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Match scores and checks are advice about a document that you are free to ignore.
How AI models see your data
Tuned uses AI models from Anthropic and OpenAI through their business APIs. Under our agreements with them, these providers process the data only to return a result to us, may not use it to train their models, and keep it for a limited time (usually up to 30 days) for abuse monitoring. We do not send user data to AI providers based in China.
What reaches the model depends on the feature:
- Tailoring, cover letters and base improvements. Your name, email, phone, location and profile links are replaced with placeholders in the resume and in every line of text before it is sent. The model sees your experience, not whose it is.
- Reading an uploaded resume (PDF or DOCX). Email addresses and phone numbers are removed. Your name and location may still reach the model, because it has to understand the structure of the document to transfer it into your base.
- Editing in words. What you type in the conversation is sent as written, together with the earlier turns of that conversation and the resume or tailored version you are editing, without the contact block. Do not type contact details there. The conversation is stored with your documents, is included in your data export and is deleted with your account.
- Job postings are sent as you added them.
Every tailored line is then checked by our own code against your base before it is saved; no line without a source in the base is written into a tailored version.
Quality evaluations
To compare models and prompts and to catch regressions, we may take samples of resumes, job postings and the output generated from them and run them through our evaluation process. This is done on our legitimate interest in keeping the Service accurate, with these safeguards:
- samples are pseudonymised: names, contact details and links are removed or replaced before use;
- they are never used to train AI models, ours or anyone else's, and never published or shared, except with the AI providers listed on the Subprocessors page to run the evaluation;
- only the operator of Tuned and persons bound by confidentiality have access, and they may read samples to judge the quality of output;
- samples are kept for no more than 12 months and are deleted earlier when you delete your account or turn evaluations off.
You can object at any time without giving a reason: turn off "Use my documents in quality evaluations" under "Account" in the account menu. From that moment your documents are not sampled, and existing samples are deleted within 30 days. You can also write to privacy@tunedhq.io.
International transfers
We are established in Armenia. Our servers are in Finland and files are stored in the EU. Some processors are in the USA and Australia:
| Recipient | Location | Purpose |
|---|---|---|
| Hetzner (Hetzner Online GmbH) | Finland | Servers for the application, database and cache |
| Cloudflare (Cloudflare, Inc.) | USA; files are stored in the EU (R2, EU jurisdiction) | File storage, website delivery, DNS, network protection, bot check on the sign-in screen |
| Anthropic (Anthropic, PBC) | USA | AI processing: tailoring, cover letters, reading imported resumes, base improvements |
| OpenAI (OpenAI OpCo, LLC) | USA | AI processing for the same tasks, on some plans or steps |
| TypeSafe (TypeSafe AI, Inc.) | USA | AI decisions without generated text: relevance of education to a job posting, whether a suggested edit improves a line and stays true to the resume, whether a question is already answered by the resume |
| Sentry (Functional Software, Inc.) | USA; data stored in the EU (Germany) | Error reports from the server and the application, and page load measurements of the application |
| Resend (Plus Five Five, Inc.) | USA | Sending emails: sign-in codes and service notices |
| Rybbit | EU (Germany, Finland) | Website statistics for tunedhq.io only; never inside the application |
| Fastmail (Fastmail Pty Ltd) | Australia; mail is stored in the USA | Mailboxes for support and privacy requests |
Transfers from the EEA and the UK to processors in countries without an adequacy decision are covered by the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements with them. Polar, based in the USA, receives payment data as an independent controller under its Privacy Policy.
Transfers of data of users from countries whose law requires consent for cross-border transfer are made on the basis of your Consent to Data Processing.
How long we keep data
| Data | How long |
|---|---|
| Account and documents | Until you delete them or your account. Deleted items are removed from the database immediately and from backups within 30 days |
| File uploaded for import (PDF or DOCX) | Deleted automatically within 14 days; the text transferred into your base stays until you delete it |
| Exported PDF and DOCX files | Up to 30 days; a document can be exported again at any time |
| Data export file | Up to 7 days after it is prepared, then deleted; you can request a new one at any time |
| Sessions | Up to 30 days after your last visit and no longer than 180 days after you sign in, or until you sign out or end the session from another device |
| Sign-in codes | Until used or expired (minutes), then deleted |
| Technical logs | Up to 30 days |
| Service counters | Up to 30 days |
| Error reports | Up to 90 days |
| Quality evaluation samples | Up to 12 months |
| Payment and tax records | For as long as tax and accounting law requires. After account deletion they are kept without your email, name, country or address |
| Record of your consent, correspondence | For the life of the account and up to 3 years after, to prove compliance and handle claims. After deletion the consent record keeps only a hash of your email, the document version and dates |
We may delete a Free account that has not been used for 24 months, after warning you by email at least 30 days in advance.
Your rights
Depending on the law that applies to you, you have the right to:
- access your data and receive a copy of it;
- correct inaccurate data (most of it you can edit in Tuned yourself);
- delete your data and your account;
- receive your content in a structured, machine-readable format (data portability);
- restrict processing or object to it, including to quality evaluations;
- withdraw consent at any time, without affecting processing done before;
- lodge a complaint with a supervisory authority: in the EU or UK, the authority of your country; in Armenia, the Personal Data Protection Agency; in Russia, Roskomnadzor.
Copy of your data. Under "Account" in the account menu you can download all your content and account data as a JSON file: base resumes, variants, cover letters, job postings, design settings, profile, consent, plans and payments (without payment provider identifiers). The file is prepared in the background and can be downloaded for 7 days.
Account deletion. In the same place you can delete your account; you confirm it with a code sent to your email. Deletion cannot be undone: documents, variants, files and usage history are erased from the database and file storage within an hour, and from backups within 30 days. If you have a Polar subscription that renews, deletion cancels it immediately, and the rest of the paid period is lost; if the cancellation does not go through, the account is not deleted. Payment records we must keep by law stay for the period stated above, without your email, name, country or address.
You can also exercise any of these rights by writing to privacy@tunedhq.io from the email address of your account, so we can confirm it is you — for example, if you cannot sign in. We answer within the time the applicable law sets, and no later than 30 days.
Website statistics
On the public website (tunedhq.io) we count visits with Rybbit, an analytics service hosted in the EU. Inside the application there is no third-party analytics at all: what happens in your account is recorded by our own server, in our own database.
The only outside service the application talks to is Sentry, and only about errors: when something breaks, the application sends an error report, with page load measurements for some of the pages, to our own server, which removes anything that could identify you and forwards it to Sentry. Sentry never sees your IP address or learns who you are.
The counter receives: the page address, the site you came from, campaign tags in the link (utm_*), your country, device type, browser and its language, page load measurements and JavaScript errors on our pages. It also receives a few named events, each a code from a fixed list: opening a sign-in link and where it stood on the page, starting and finishing a resume check, switching the language of the page, reaching the pricing block, opening a question in the FAQ, switching a template in the demo.
A check reports its result as a range, never as an exact score, and never the file, its name or its text. There is no free text in these events at all.
Your IP address is used by the service to work out the country and to join page views into one visit — as a hash with a salt that changes daily, so a visit cannot be followed from one day to the next; the address itself is not stored. The script is served from our own domain, sets no cookies and writes nothing to your device. There is no session recording, no automatic capture of clicks or form fields, and we never tell the counter who you are, so a visit cannot be connected to an account.
Statistics are kept by the service for up to 3 years and are used only to see which pages and steps work.
Security
Connections are encrypted with TLS. Session tokens and sign-in codes are stored only as hashes. Access to production data is limited to the operator of Tuned. Contact details are handled before AI processing as described above. If a breach affects your data, we will notify you and the competent authorities as the law requires.
Age
Tuned is not intended for people under 16. If we learn that an account belongs to someone younger, we will delete it.
Data from Google
When you sign in with Google, we receive only your email address, name and account ID. Tuned's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Changes to this policy
When we change this policy materially, for example add a new purpose or a new category of recipients, we will notify you by email or in the Service at least 14 days in advance. The date of the current version is below.
Contact
Privacy requests: privacy@tunedhq.io. Everything else: support@tunedhq.io. Post: Individual Entrepreneur Evgenii Zakharov, 97 Buzand St., apt. 17, Kentron district, Yerevan 0002, Republic of Armenia.
This policy is effective from September 28, 2026. It is published in English and Russian; if you accepted it in the Russian version, the Russian text prevails.