PRIVACY POLICY

Privacy Policy

Effective Date: May 27, 2026 Last Updated: October 30, 2026

Welcome to FastMatch, a service operated by Cass Ave Consulting ("we," "our," or "us"). We respect your privacy and are committed to protecting the data you upload and process through our platform.

This Privacy Policy explains how we collect, use, process, and safeguard information in connection with your use of fastmatch.ai and related services (the "Service"). It also outlines rights under applicable privacy laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), where applicable.

This Privacy Policy should be read together with our Terms of Service (https://fastmatch.ai/terms-of-service), which govern your use of the Service, and, for business customers, our Data Processing Agreement ("DPA"). If this Privacy Policy conflicts with a signed agreement between us and a customer, that agreement controls as to that customer.

By using the Service, you acknowledge the practices described in this Privacy Policy.

1. Who We Are and Our Role

The Service is used by businesses, recruiters, and hiring teams ("Customers") to analyze and rank job candidates. Our role depends on the type of information involved:

Account, billing, and usage information. For information about our Customers and their authorized users, we act as a controller (GDPR) or business (CCPA).
Candidate and job information uploaded by Customers ("Customer Data"). For resumes, candidate materials, job descriptions, and related analysis, we act as a processor (GDPR) or service provider (CCPA) on behalf of the Customer. The Customer is the controller of that data and decides why and how it is collected and used. We process Customer Data only to provide the Service, in accordance with the Customer's instructions and our agreement with them.

If you are a job candidate: the employer or recruiter who uploaded your information is responsible for how it is collected and used, including any notice or consent required by law. Please direct questions and privacy requests about your candidate information to that organization. If we receive a request from a candidate, we will, where we can identify the relevant Customer, forward it to that Customer and assist them in responding as required by law and our agreement with them.

2. Information We Collect

Account Information

We collect the minimum information necessary to support authentication, account access, service delivery, and account administration. Depending on how you sign in and use the Service, this may include:

Authentication identifiers from Google, SSO, or other identity providers
Internal account and tenant identifiers
Basic account profile details needed to operate the Service
Security and audit logs related to authentication and account activity
Subscription or billing-related information, if applicable

We do not collect more personal information than is reasonably necessary to provide the Service.

Content You Upload

Customers may upload files and content that contain personal information of third parties, including:

Job Descriptions, which may include role requirements, internal hiring criteria, or proprietary business information
Resumes and Candidate Materials, which may include names, email addresses, phone numbers, work history, education, skills, certifications, and other personally identifiable information

Customers are responsible for ensuring that they have the legal right, authority, and any necessary notice or consent to upload and process this information through the Service.

Sensitive Information

Resumes and candidate materials may incidentally contain sensitive or special category information, such as photographs, dates of birth, health or disability information, or information revealing racial or ethnic origin, religious beliefs, or similar characteristics. The Service does not require this information, and we ask Customers not to upload it beyond what candidates have included in their own materials. Where such information is present, we process it only incidentally as part of the content submitted and only to provide the Service.

Technical and Usage Information

We may automatically collect limited technical information necessary to operate, secure, and improve the Service, such as:

IP address
Browser type and version
Device type and operating system
Access times and usage activity
Error logs, diagnostics, and performance metrics

3. How We Use Information

We use information only as necessary to provide, maintain, secure, and improve the Service. This includes:

Authenticating users and managing accounts
Processing uploaded job descriptions and resumes
Matching resumes against job descriptions
Generating candidate analysis, rankings, and scoring results
Supporting AI-assisted hiring and review workflows
Maintaining security, reliability, and platform performance
Complying with legal obligations and enforcing our terms

We do not:

Sell personal data
Rent personal data
Share candidate data for advertising purposes
Contact job candidates for marketing purposes
Use uploaded content to train our own AI models
Use Customer Data for unrelated commercial purposes, or retain, use, or disclose it outside our direct business relationship with the Customer

4. AI Processing and Third-Party Model Providers

To provide resume analysis, ranking, matching, and related intelligent features, FastMatch uses artificial intelligence services from trusted third-party providers. These may include:

Microsoft Azure OpenAI
Anthropic Claude
Google Gemini
Microsoft Azure cloud services and related infrastructure providers

These services may be orchestrated through our internal application logic using Microsoft Semantic Kernel or similar middleware that manages prompt construction, provider selection, secure routing, and response handling.

How AI Processing Works

When you upload a job description, resume, or related content, relevant portions of that content may be sent to one or more AI providers for processing in order to generate the results you request. We use these services solely to deliver the functionality of the Service.

Content is processed only to perform requested analysis and ranking tasks
Requests are handled programmatically by our system
We apply data minimization and send only the data needed for the task where practical
We do not use uploaded content to train our own models

AI Model Routing

To maintain performance, availability, reliability, and task suitability, FastMatch may dynamically route requests between supported AI providers. Provider selection may be based on factors such as:

Availability
Performance
Cost efficiency
Feature support
Task suitability

AI Data Handling Safeguards

We implement safeguards designed to protect your data during AI processing, including:

Encrypted transmission to AI providers
Secure API authentication
Controlled prompt construction and processing logic
Configuration of supported providers to restrict model training on submitted data where available under enterprise or API terms
Reasonable efforts to limit retention and exposure of submitted content

No Training on Your Uploaded Data

We do not use your uploaded job descriptions, resumes, or analysis results to train internal AI models. We also configure supported third-party AI providers not to use submitted customer data for model training where such controls are available under their enterprise, commercial, or API offerings.

Human Review and Automated Decision-Making

The Service provides rankings, scores, and analysis to support human decision-makers. It does not make hiring, rejection, or other employment decisions, and it is not designed to make solely automated decisions that produce legal or similarly significant effects on candidates. All hiring and employment decisions are made by the Customer, who is responsible for providing meaningful human review of the Service's outputs.

The Service is designed to evaluate candidate materials against the job-related criteria in the job description provided by the Customer. It is not designed to use protected characteristics, such as race, ethnicity, sex, age, religion, disability, or national origin, as factors in scoring or ranking. Because AI systems can still produce unexpected results, Customers should monitor outcomes and review results for fairness.

Customer Compliance with Employment and AI Laws

Customers are responsible for determining whether laws regulating the use of AI or automated tools in hiring apply to their use of the Service, including, where applicable, local, state, national, or international laws such as New York City Local Law 144, state AI and anti-discrimination laws, and the EU Artificial Intelligence Act. Customers are responsible for meeting any resulting obligations, such as candidate notices, consent, bias audits, recordkeeping, and human oversight. Use of the Service does not by itself satisfy these obligations.

Important AI Use Notice

AI-generated outputs are probabilistic and may contain errors, omissions, or incorrect inferences. They are intended to assist human review and decision-making, not replace it. You are responsible for reviewing results before making hiring or employment decisions.

Where GDPR applies and we act as a controller, our legal basis for processing personal data may include:

Contract performance — to provide the Service you request
Legitimate interests — to secure, maintain, and improve the Service
Consent — where consent is required by law
Legal obligations — where processing is required to comply with law or lawful requests

For Customer Data, the Customer, as controller, is responsible for establishing a lawful basis for processing and for providing any required notices to candidates.

6. Data Retention and Deletion

We retain uploaded files, analysis results, and related account data only as long as necessary to provide the Service and meet legitimate business or legal requirements.

Uploaded data is generally retained while your account remains active and the related records remain in your workspace
If you delete a job, resume, or related record, we will remove the associated data from active systems in accordance with our deletion processes
If you cancel your account, we will delete or de-identify associated customer data within a reasonable period, unless retention is legally required
Backup copies may persist for a limited period until rotated out of secure backup systems

Unless a longer retention period is required by law, we aim to permanently remove applicable customer data from our active systems within 30 days of account termination or deletion request.

Customers may request deletion of their data at any time by contacting admin@fastmatch.ai. Candidates should direct deletion requests to the employer or recruiter that uploaded their information, as described in Section 1.

7. Data Security

We use reasonable administrative, technical, and organizational safeguards to protect the information processed through the Service. These measures may include:

Encryption in transit
Encryption at rest
Access controls and authentication safeguards
Role-based or least-privilege access practices
Secure cloud infrastructure
Monitoring, logging, and audit controls
Vulnerability and incident response processes

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We do not sell personal information. We do not disclose uploaded data to third parties except as reasonably necessary to provide the Service, at the direction of the Customer, or as required by law.

We may share or disclose information in the following circumstances:

With service providers and subprocessors acting on our behalf to host, secure, support, or operate the Service
With AI and cloud providers solely to perform the requested processing
At the direction of, or with the authorization of, the Customer that controls the data
To comply with applicable law, regulation, subpoena, court order, or lawful request
To protect the rights, property, security, or integrity of the Service, our users, or others
In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections

A current list of our subprocessors is available on request at admin@fastmatch.ai.

9. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

Request access to personal data we hold about you
Request correction of inaccurate or incomplete information
Request deletion of personal data
Request restriction of processing
Object to certain processing activities
Request portability of your data where applicable
Withdraw consent where processing is based on consent

Customers and account users: to exercise any of these rights, contact us at admin@fastmatch.ai. We may need to verify your identity before fulfilling your request.

Job candidates: because we process candidate information on behalf of our Customers, please submit your request to the organization that received your application. If you contact us directly, we will forward your request to that organization where we can identify it.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have the right to request information about the categories of personal information we collect, the purposes for which we use it, the categories of third parties to whom it is disclosed, and to request deletion or correction of certain personal information, subject to legal exceptions. We will not discriminate against you for exercising these rights.

We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law.

For Customer Data, we act as a service provider to our Customers. California candidates should direct requests about their candidate information to the organization that received their application.

To submit a California privacy request relating to your own account information, contact admin@fastmatch.ai.

11. International Data Transfers

If you access the Service from outside the country where our systems or providers operate, your information may be transferred to and processed in other jurisdictions. Where required, we rely on appropriate safeguards for such transfers, which may include contractual protections such as Standard Contractual Clauses and vendor compliance commitments.

12. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal information directly from children under the age of 16. If you believe information relating to a child has been improperly submitted to the Service, please contact us at admin@fastmatch.ai.

13. Cookies and Similar Technologies

We may use cookies, session storage, or similar technologies as necessary to operate the Service, maintain secure sessions, remember preferences, and analyze service performance. We do not use these technologies for unrelated advertising purposes unless separately disclosed.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as our practices, technologies, or legal obligations evolve. When we do, we will update the "Last Updated" date at the top of this page. Where appropriate, we may also provide additional notice through the Service or by email.

The current version of this Privacy Policy is always available at https://fastmatch.ai/privacy-policy.

15. Contact Us

Cass Ave Consulting

Privacy, support, and sales: admin@fastmatch.ai