Privacy Policy

Last updated: September 25, 2026

This Privacy Policy applies to the HREcho website and related services (the “Services”). By accessing or using HREcho, you agree to the Terms of Use and this Privacy Policy. If you do not agree, please stop using HREcho.

• What we collect — only the basics: email, hashed password, social login ID, subscription info, as well as your resumes and vacancy viewing history.
• What we do NOT do — we never see your card numbers, we do not show ads, and we never sell your data.
• AI processing — to generate recommendations, we send the text of your resume and job descriptions to AI providers (currently in the US). They do not store this data or train models on it. We do not train models on your data either.
• Vacancy Data — we store your interaction history with vacancies and recruiter contacts you've saved to help you manage your job search process.
• Analytics — we use Google Analytics to understand how the Services are used and Sentry to find and fix technical errors.
• Where stored — on secured servers that may be located in different countries, in compliance with security standards.
• Legal compliance — we process data in accordance with the Law of the Republic of Armenia “On Protection of Personal Data” and transfer it only to countries that ensure an adequate level of personal data protection.
• Your rights — you can request, delete, export your data, or file a complaint with a regulator.
• Children — the service is strictly 18+. We do not collect data from minors.
• Ads — there are no ads on the site, and we do not sell your data to advertisers.
• Account deletion — when a profile is deleted, all data is erased within 10 days (except for tax reporting on transactions).
• Job listings — we aggregate posts from public sources, remove them on the first request of their author and never keep them longer than one year.

We only collect the minimal amount of personal information necessary to operate and improve our Services:

• Professional Data — the content of your resumes, cover letters, and their AI-driven adaptation history to track your job search progress.
• Email address — used for account identification and login.
• Password — used for account authentication and login.
• Third-party provider ID (Google) — if you choose to sign in with Google.
• Subscription data — such as plan type and activation date, obtained through integrations.
• Search data — vacancies you have saved and recruiter contacts you have found for professional purposes.
• Technical and usage data — IP address, browser and device type, pages visited and actions on the site (such as signing up or applying to a job). This data is collected by Google Analytics, Sentry and our server request logs.

When you use AI features, we send the text of your resume and the job description to an AI provider for real-time processing. The provider uses this data only to generate a response, does not store it, and does not train models on it (see “Third-Party Service Providers” for details). We do not train models on this data either. We keep AI requests and responses on our side for up to one month for quality and cost control, and then delete them.

We store passwords only as hashed and salted data, never in plain text.

We do not collect or store your payment card details. Payments are processed by third-party payment providers. We receive only purchase metadata from them (subscription type, purchase date, renewal status and transaction ID) and use it to confirm your subscription, grant access to paid features and keep accounting and tax records.

We process personal data in accordance with the Law of the Republic of Armenia “On Protection of Personal Data”. Your data may be processed outside your country of residence, but we transfer it only to service providers in countries that ensure an adequate level of personal data protection (for example, the US and EU countries), and only to the extent necessary to operate the Service.

The Service is not intended for users in the Russian Federation: signing up and signing in from its territory are unavailable, so we do not collect data of users located in Russia.

We use browser localStorage and cookies to keep you signed in and to remember your settings. Google Analytics also sets its own analytics cookies to collect visit statistics. You can block them in your browser settings, and the Services will keep working.

Data Controller: IE Mikhail Chuloshnikov, Armenia, Yerevan, Agatangeghos 7, KENTRON, 0010. D-U-N-S: 933896428

Official contact for privacy-related requests: [email protected].

Your data is used exclusively for:

• Authenticating your account and ensuring login;
• Determining your country by IP address to restrict access to the Service from regions where it is unavailable. We use a local database for this, and your IP address is not shared with anyone: IP Geolocation by DB-IP;
• Managing access to subscription-based features;
• Saving and displaying your personal resume adaptation data;
• Improving the overall functionality and performance of the Services;
• Sending optional service-related updates;
• Providing tools for vacancy analysis and relevant skill matching;
• Displaying the history of your requests and generated recommendations for your convenience.

We do not transfer personal data to third parties, except for trusted service providers necessary for the operation of our Services (e.g., AI, analytics, email delivery or hosting providers). These providers act only on our instructions and in accordance with data protection agreements.

To provide certain functions, we use trusted third-party sub-processors:

• Hosting and infrastructure — to host our servers and databases when we use third-party data centers or cloud providers.
• Traffic protection and delivery — CDN and attack protection services (e.g., Cloudflare), when we use them. Such a service processes all traffic between you and the site, including your IP address.
• AI Service Providers — OpenRouter (OpenRouter, Inc., USA), to access AI models that analyze text and generate recommendations. The models run on infrastructure providers in the US (for example, Together AI and DigitalOcean). We use a zero data retention mode only: neither OpenRouter nor the providers store the content of requests and responses or use it to train models. We only add other AI providers that offer the same guarantees.
• Analytics — Google Analytics (Google LLC), for visit and conversion statistics.
• Error monitoring — Sentry (Functional Software, Inc.), for tracking technical errors. An error report may include your IP address, browser details and request information.
• Email delivery — Resend (Resend, Inc.), for delivering service emails such as confirmations, password resets and notifications. It receives your email address and the email content.
• Payment Systems — third-party payment providers. Card details are entered on their side, and we never receive them.

These providers receive only the minimal amount of data necessary to perform their specific tasks.

We apply industry-standard security measures, including encryption in transit (SSL/TLS), the use of hashed and salted passwords, and restricted access to stored data.

We store your account data as long as your profile is active. If you delete your account, all associated personal data will be removed from our systems within 10 days. Purchase-related records may be retained in accordance with applicable legal requirements (e.g., tax or accounting obligations), but after account deletion, they are disconnected from the user's identity.

We do not keep job listings forever. We understand that the original post in a messenger or another public source may be deleted by its author at any time, and we have no technical way to track such deletions automatically.

That is why we limit how long this data lives: every job listing older than one year is removed from the site automatically. We also mark listings older than one month as possibly outdated, so that candidates can see how fresh a post is.

HREcho publishes job listings collected from public sources — public messenger channels and chats, company websites and other publicly available places.

If you are a recruiter, a company representative or the author of a post and you do not want your job listing or your contact details to stay on the site, write to us at [email protected] and include a link to the listing on HREcho.

You can also use this address to ask us to correct inaccuracies in a job listing. We delete or correct data on such requests within 3 business days.

You have the right to:

• Access your data;
• Request correction or deletion;
• Withdraw consent to data processing;
• Export your data;
• Lodge a complaint with the competent personal data protection authority.

To exercise any of these rights, please contact us at [email protected]. For security reasons, we may ask you to verify your identity before fulfilling a request. We provide information about the data we process about you within 5 business days, and correct or delete data on request within 3 business days. We notify you of the deletion of your data within 3 business days.

We do not display ads or share your personal information with advertisers or data brokers. We also confirm that we do not "sell" personal data as defined under the California Consumer Privacy Act (CCPA).

HREcho is not intended for persons under the age of 18. We do not intentionally collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time. Continued use of the Services after such changes signifies your agreement to the revised policy.