Overview
MeritSlate ("MeritSlate", "we", "us") helps job seekers get past automated resume screening: we score resumes against job descriptions, simulate how nine ATS vendors parse a file, tailor resumes, draft cover letters and LinkedIn content, run practice AI voice interviews, and offer a free ATS-clean PDF converter. Doing that well means handling some of the most personal documents you have, so this policy is written to be specific about what we actually do — not boilerplate.
This policy applies to meritslate.ai and every feature of the MeritSlate product. MeritSlate is the controller of the personal data described here. You can reach us any time at hi@meritslate.ai.
The short version
We never sell your personal data or resume content — to anyone, for any purpose.
The free ATS converter is stateless — it processes your file in memory and never stores it.
You can export everything or delete everything, in-app — no email required, no waiting period.
AI providers only process your content to produce your result — we never use your content to train AI models.
Information we collect
Account information
- Your email address and sign-in credentials. Authentication is handled by our infrastructure provider (Supabase Auth); passwords are stored hashed and we never see them in plain text. Email verification codes are short-lived and purged automatically.
- If you sign in with Google, we receive your name, email address, and profile picture from your Google account.
- Optional profile details you add yourself, such as a display name or avatar photo.
Content you provide
- Resume files (PDF or DOCX) and their parsed text, or resume text you paste directly, plus the job descriptions and job titles you score against.
- Content the product generates for you and saves to your library: Merit Scores with their evidence, tailored resume versions, cover letters, LinkedIn rewrites, and interview transcripts and scorecards.
- Feedback you submit on scores or outputs.
Billing information
Payments are processed by Dodo Payments, our merchant of record. Your card number, billing address, and full payment details go to Dodo — they never touch our servers. We store what we need to run your account: payment receipts (a payment reference, amount, currency, and the plan or top-up purchased), subscription status, and checkout attempts.
Usage and security data
- Usage metering for your plan (how many scores, tailored applications, or interviews you have used, and any purchased credits).
- A security event log for your own account (event type, IP address, and browser user-agent for actions like data exports) — visible to you in your account settings.
- Free-quota enforcement uses one-way SHA-256 hashes of an IP address and a browser fingerprint — the daily counters store only the hashes, not the raw values, and are purged on a 7-day rolling window.
- A log of the transactional and lifecycle emails we sent you and their delivery status, plus your email preferences.
Optional Gmail connection
If you choose to connect Gmail to send applications from MeritSlate, we request only the minimal "send email" permission (gmail.send). The Google refresh token is stored encrypted (AES-256-GCM) and is deleted — and revoked with Google — when you disconnect the integration or delete your account. We never read your inbox.
Information accessed through this Gmail connection is used for the single purpose of sending the application email you compose and choose to send. It is never used for advertising, never sold or transferred to third parties, and never used to train generalized AI or machine-learning models; human access is limited to what is required for security, abuse prevention, and support. MeritSlate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we use your information
- To provide the service: scoring your resume against job descriptions, simulating ATS parsing, generating tailored resumes, cover letters, LinkedIn content, and running AI interview sessions — and saving those results to your library so you can come back to them.
- To run billing: activating the plan or credits you purchased, showing receipts, and honoring cancellations and refunds.
- To prevent abuse: enforcing daily free quotas (hashed identifiers only) and running a privacy-preserving bot check (Cloudflare Turnstile) on sign-up and the free scorer.
- To communicate with you: transactional email (verification codes, receipts, security notices) and occasional account-lifecycle email. Every non-essential email includes a one-click unsubscribe.
- To keep the product working: error monitoring with personal data scrubbed before events leave the app, and aggregate, cookie-less page analytics.
Where GDPR-style laws apply, we rely on: performance of our contract with you (providing the service and billing), legitimate interests (abuse prevention, security, and product reliability), consent (optional integrations like Gmail, and non-essential email), and legal obligations (financial records held by our payment processor).
The free tools & in-memory processing
The free ATS-clean converter is deliberately stateless: your uploaded file is parsed in memory, the ATS-clean PDF is generated and returned to your browser, and nothing is written to storage — no resume record, no file copy. Once the request finishes, the content is gone. The only thing recorded is a daily usage count against your account.
The free Merit Score on the homepage works differently, because keeping your results is the point: when you score a resume while signed in, the resume and its score report are saved to your library so you can reopen the analysis, tailor from it, and track your progress. You can delete any resume from your library at any time. If you start on the homepage before signing in, your draft is held only in your own browser's session storage (on your device, cleared when the tab closes) until you sign in.
AI processing
Generating scores, rewrites, cover letters, LinkedIn content, and interview questions requires sending the relevant text — your resume, the job description, and conversation context — to third-party AI infrastructure. For scanned, image-only PDFs, page images may also be processed to extract the text. For voice interviews, your microphone audio is streamed in real time to our voice provider for speech-to-text and text-to-speech.
- We send the minimum content needed to produce each result, and the providers process it to return that result to you.
- We never use your content to train AI models, and we don't permit our providers to use it for advertising.
- Our generation pipeline is built with anti-fabrication guardrails: outputs are grounded in what your resume actually says, and the scoring engine must cite evidence for every number.
Service providers we share data with
We share personal data only with the providers below, only to run the service, and never for their own marketing. We do not sell personal data, and we never forward your resume to third-party ATS grading services, recruiters, or data brokers.
Supabase
Database, authentication, and file storage. Resume files live in private, per-user storage buckets; data is encrypted at rest and protected with row-level security.
OpenRouter
AI gateway that routes scoring and writing requests to our configured language-model provider. Receives resume/job-description text (and page images for scanned PDFs) to generate your results.
Deepgram
Real-time voice infrastructure (speech-to-text and text-to-speech) for AI interview sessions. Receives your microphone audio during an interview.
Dodo Payments
Merchant of record for all purchases. Handles checkout, card details, taxes, and invoices of legal record under its own privacy policy and retention obligations.
Cloudflare Turnstile
Privacy-preserving bot detection on sign-up, password reset, and the free scorer. No advertising trackers.
Sentry
Error monitoring, configured to scrub personal data: default PII collection is off, request bodies and cookies are dropped, and email addresses are redacted before an event leaves the app.
Plausible Analytics
Cookie-less, aggregate page analytics with no cross-site tracking and no personal profiles.
Vercel
Application hosting and content delivery.
Only if you use it: Google sign-in for authentication, and the optional Gmail send-only connection described above.
Email delivery (SMTP)
Transactional and lifecycle email is delivered through our SMTP email provider, which processes recipient addresses and message content to deliver mail.
Storage, security & retention
Your data is encrypted in transit (TLS) and at rest. Resume files are stored in private buckets scoped to your account, database access is enforced with per-user row-level security policies, sensitive tokens are additionally encrypted at the application layer, and administrative access is limited to operating the service. No security measure is perfect, but we treat resume data with the care it deserves and review these controls regularly.
Retention. Content in your library (resumes, scores, tailored versions, letters, interview records) is kept while your account is active, subject to per-resume version caps. Operational data is purged automatically on rolling windows by a nightly cleanup job — for example: sign-in codes after 7 days, free-quota counters after 7 days, detailed scoring-evidence blobs after roughly 60 days, derived caches after 30–180 days, the email send log after 90 days, and usage-metering history after about 13 months.
Account deletion is immediate. When you delete your account, your database records are permanently removed (every user-linked table cascades), your storage buckets — including resume files and avatars — are purged, and your email send log and any outstanding sign-in codes are cleared in the same operation. Invoices of legal record remain with Dodo Payments, the merchant of record, under its own retention obligations.
Your rights & controls
The two rights people actually use — access and erasure — are built into the product, so you don't have to email anyone or wait:
- Export (access & portability). In Account settings you can download a ZIP containing every table of your data as readable JSON — profile, resumes, scores, rewrites, letters, interview records, receipts, preferences, usage history — plus time-limited download links for your original uploaded files.
- Delete (erasure). In Account settings you can permanently delete your account by typing DELETE to confirm. The purge is immediate and irreversible, as described above.
- Rectification. You can edit your profile, resumes, and generated content directly in the product.
- Email choices. Every non-transactional email carries a one-click unsubscribe honored instantly; you can also manage email preferences in your account.
Depending on where you live, you may also have rights to object to or restrict certain processing, to withdraw consent, and to complain to your local data-protection authority. For any request you can't complete in-app, email hi@meritslate.ai and we'll respond promptly.
Cookies & session handling
- Essential session cookies. Signing in sets authentication cookies (managed by Supabase Auth) that keep your session alive. The service can't work without them.
- No advertising cookies. We set no third-party advertising or cross-site tracking cookies, which is why you don't see a cookie banner.
- Cookie-less analytics. Page analytics (Plausible) works without cookies and without building personal profiles.
- On-device drafts. An in-progress draft on the free tool may be kept in your browser's session storage so it survives the sign-in step — it stays on your device and clears when the tab closes.
Children
MeritSlate is not directed to children and is not intended for anyone under 16. We don't knowingly collect personal data from children under 16; if you believe a child has provided us personal data, contact us and we'll delete it.
International users
Our service providers may store and process data in countries other than your own. Where that happens, we rely on the safeguards and data protection commitments those providers offer, and we hold every provider to the same rule that governs us: your data is processed only to deliver the service you asked for.
Changes to this policy
When we change this policy we'll update the "Last updated" date at the top. For material changes — anything that meaningfully affects how your data is handled — we'll give you notice by email or in the product before the change takes effect.
Contact
Questions, requests, or concerns about your data: hi@meritslate.ai. You may also want the Terms of Service or the quick answers in our FAQ.