Privacy Policy & GDPR Compliance
Last updated: October 2026 | Effective immediately
1. Data Controller
The data controller is Victor Antonio Orea De Lasala, who runs Rezycle.me (“we”, “our”, or “us”). For anything about your personal data, email support@rezycle.me. We process personal data under the General Data Protection Regulation (GDPR) (EU 2016/679) and the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
Rezycle.me and Rezicla.me have the same data controller and share one mailing list: unsubscribing from one unsubscribes you from the other.
2. Information We Collect
When you use Rezycle.me, we collect the following categories of information:
- Contact Information: Your email address, only if you choose to give it — to send you your scan results, to complete a purchase, or when you leave it in another form on the site, such as the newsletter, the quiz, the contact form or the business enquiry form.
- Professional Data: Resume documents (PDF, TXT, DOCX) uploaded or pasted for AI outplacement analysis.
- Technical & Usage Data: Rezycle.me itself does not store your browser type, device information or a log of what you do on the site. Our hosting provider (Vercel) keeps technical logs of the requests made to the site and Google Analytics and Google Ads receive browser, device and on-site behaviour data only if you accept our cookie banner (see section 4). The one case the banner does not control is the video on some of our job pages: if you press play, your browser loads the YouTube player from Google, which then receives your IP address and browser details whether or not you accepted the banner (see section 4c). We keep a few anonymous counters of how many people reach certain steps; they hold no IP address, user agent or identifier. To limit abuse (for example, how many analyses can be requested in a short time), we store your IP address as it is, not anonymized, in our database (Upstash, Frankfurt), and it is deleted automatically after 10 minutes, or after 1 hour or 24 hours for the few features that limit over a longer period. If you use the feature to resend your report, that limit also stores your email address for 1 hour.
- Payment Information: Processed securely via Stripe. We never store raw payment card details on our servers.
3. Purpose and Legal Basis for Processing
We process your data based on the following legal grounds under GDPR Article 6:
- Performance of Contract: To generate your AI outplacement audit, executive report, and week-by-week career roadmap.
- Legitimate Interest: To improve our service, enhance web security, and prevent fraud.
- Consent: To send you personalized follow-up sequences, promotional discounts, and outplacement resources via email.
4. Third-Party Sub-Processors
Your data is shared only with the following processors, strictly to deliver the service:
- OpenAI: Your resume text is sent to OpenAI's API to generate your AI analysis and outplacement report. API inputs are excluded from OpenAI's model training by default.
- Stripe: Processes payment card details for purchases. We never receive or store raw card numbers. The record of your order in Stripe also holds the first 450 characters of your resume and, only if you accepted cookies, the Google Analytics client and session identifiers. See section 6 for how long.
- Brevo: Sends transactional emails (report delivery, receipts) and manages our marketing contact list, if you opt in. Emails sent through Brevo may include a tracking pixel and tracked links, which tell us whether you opened an email and which links you clicked; this tracking is performed by Brevo on our behalf.
- Sentry: Receives technical error diagnostics (stack traces, the page/route where an error occurred, and your browser type, language and time zone), which Sentry stores in its European Union data region (Frankfurt, Germany), so we can detect and fix bugs quickly. Sentry is a company based in the United States and keeps our account, project keys and usage data there (see section 4b). We configure Sentry not to send request or response content (including resume text) or cookies, we do not include your IP address in these reports, and we remove personal details such as email addresses and parts of payment identifiers from each report before it is sent. We cannot rule out that an error message occasionally quotes a fragment of the text involved. In your browser, error reporting only starts if you tick “Analytics” in our cookie banner: if you reject, or have not chosen yet, errors in your browser are not reported to Sentry. Errors on our own servers are reported regardless of your choice.
- Upstash (database): Hosts the Redis database where we keep the data described in section 6 (your resume text and report for paid orders, your scan score, and short-lived counters that limit abuse). Its servers are in the European Union (AWS, Frankfurt, Germany), with no read replicas outside the EU. On 4 October 2026 we moved the database there from the United States; we keep the old copy in the United States only until we have checked the move, and we plan to delete it on 11 October 2026.
- Vercel (hosting): Hosts and runs the website and its server functions, so the requests you make to this site (including the resume text you submit) pass through its infrastructure. Our server functions run in Frankfurt, Germany. Vercel also keeps technical logs of requests, and its delivery network may serve static pages from other locations.
- Google (Analytics & Ads): Receives anonymized IP-derived location, device/browser type, on-site behavior, and ad-click identifiers, used to measure traffic and ad performance. This only happens if you accept our cookie banner — no Google Analytics/Ads cookie is set, and no data is sent to Google Analytics or Google Ads, until you explicitly click Accept. You can decline or change your choice at any time; see “Cookies & Analytics” below.
- YouTube (Google), embedded video: Some of our job pages include a short video from our YouTube channel. When the page opens, nothing is requested from YouTube: what you see is an image hosted on our own site. If you press play, your browser loads the YouTube player from Google (from the youtube-nocookie.com domain), so Google receives your IP address and technical details about your browser, and the player may store cookies or similar data on your device. This is not controlled by our cookie banner: it happens only when you press play, whether or not you accepted the banner. If you would rather Google did not receive this, do not press play.
4a. Cookies & Analytics
We use a consent banner (shown on your first visit) to control Google Analytics and Google Ads cookies. If you click “Reject” or take no action, these cookies are never set and no data is sent to Google Analytics or Google Ads. If you click “Accept”, we use them to understand site traffic and measure the performance of our ad campaigns. The “Analytics” choice also switches on error reports from your browser to Sentry (see Sentry in section 4); they stay off if you reject or take no action. Strictly necessary storage is not covered by the banner, since it does not require consent under GDPR/ePrivacy: your cookie choice is kept in your browser's local storage, your free-scan result is kept in its session storage while the tab is open, and after a purchase we set a single signed session cookie (rz_sess_auth, deleted when you close your browser) that protects your free re-analysis, so nobody holding your report link can use it for you. You can change or withdraw your choice at any time with the “Cookie settings” button at the bottom of every page, which turns Google Analytics and Google Ads off straight away and shows the banner again. Withdrawing does not by itself delete Google cookies that were already stored in your browser; you can delete them in your browser settings.
The banner does not cover the YouTube video embedded on some of our job pages: pressing play loads the YouTube player from Google even if you rejected the banner. See “YouTube (Google), embedded video” in section 4.
4c. Cookies and browser storage we use
Before you click “Accept”, we set no Google Analytics or Google Ads cookie. The banner does not control the video on some of our job pages: nothing is loaded from YouTube until you press play, and if you do, the YouTube player (Google) may store cookies or similar data in your browser, whether or not you accepted the banner. Below is everything stored in your browser, grouped by whether it needs your consent.
| Name | Set by | Purpose | Duration | Needs consent? |
|---|---|---|---|---|
| rz_sess_auth (cookie) | Us | Proves this browser paid for a report, so only you can use its free re-analysis | Session (deleted when you close your browser) | No (strictly necessary) |
| rezycle_cookie_consent (local storage) | Us | Remembers your cookie choice | Until you clear it or reset it from Cookie settings | No |
| rezycle_scan (session storage) | Us | Restores your scan result if you come back to the page. Holds your result, your email and your resume text, in your browser only | Until you close the tab | No |
| rzref, rezycle_exit_offer, rezycle_exit_offer_shown, rezycle_newsletter_prompt_shown (session storage) | Us | Remember a referral code, a discount offer and which pop-ups you have already seen | Until you close the tab | No |
| rezycle_salida_preguntada (session storage) | Us | Remembers that we already asked you why you left without scanning. It is written the moment the question appears, before you choose, so it is also set if you close it without answering | Until you close the tab | No |
| rezycle_ads_conv:<order id> (local storage) | Us | Avoids reporting the same purchase to Google Ads twice. Only written after you click Accept | Until you clear it | Yes |
| _ga (cookie) | Google Analytics | Tells visitors apart | 2 years | Yes |
| _ga_<container id> (cookie) | Google Analytics | Keeps the state of your session | 2 years | Yes |
| _gcl_au, _gcl_aw, _gac_<id> (cookies) | Google Ads | Measure whether an ad click ends in a purchase | 90 days | Yes |
| YouTube player cookies and storage (only if you press play on a video) | Google (YouTube player, loaded from youtube-nocookie.com) | Plays the short video embedded on some of our job pages. The player may store cookies or similar data; we do not choose their names or read them | Set by Google; we do not control it | Not covered by the banner: nothing is stored unless you press play |
Two requests our pages make in the background use no cookie or storage. When the home page loads, it asks our server for the price tier for your country (/api/geo): the country comes from a header that our hosting provider (Vercel) adds from your IP address; we do not read or keep the IP address itself, and the only thing we record is one anonymous count. When you hide or close a page, your browser sends a short list of anonymous events, such as “scrolled halfway” (/api/signal), which we add to daily counters. For that second request your IP address is used only for the abuse limit described in section 2 (deleted after 10 minutes) and is not stored with the events.
Google's own description of these cookies is on its Analytics cookies page and its Ads cookies page.
4b. International Transfers
Some of the providers in section 4 process data outside the European Economic Area. Stripe (payment and order data) receives it in the United States. OpenAI (your resume text) may transfer it to its affiliates or other third parties outside the European Economic Area or Switzerland. Sentry (error diagnostics) stores error reports in the European Union (Frankfurt, Germany); it is a company based in the United States and keeps our account, project keys and usage data there. Our database (Upstash) and our server functions (Vercel) run in Frankfurt, Germany; Vercel's technical logs and delivery network may be handled elsewhere. Brevo stores its data in the EU (France and Belgium) but uses sub-processors in the United States and India, such as its CDN provider Cloudflare and its group companies Sendinblue Inc. and Brevo CRM Solutions Limited. The table below names the safeguard that covers each of these transfers.
| Provider | Where the data ends up | Safeguard |
|---|---|---|
| OpenAI (EEA data processed by OpenAI Ireland Ltd. under OpenAI's DPA, §4.1) | Outside the European Economic Area or Switzerland | Standard Contractual Clauses adopted by the European Commission on 4 June 2021 (GDPR Article 46(2)(c)), or an adequacy decision issued by the European Commission under GDPR Article 45 |
| Brevo (France) and its sub-processors | United States and India | Standard Contractual Clauses adopted by the European Commission (GDPR Article 46(2)(c)) |
| Stripe | United States (Stripe, LLC) | Data Privacy Framework; where it does not apply, Standard Contractual Clauses (GDPR Article 46(2)(c)) |
| Sentry | Error reports: European Union (Frankfurt, Germany). Our account, project keys and usage data: United States, where the company is based | Data Privacy Framework; if it is invalidated or does not apply, Standard Contractual Clauses (GDPR Article 46(2)(c)) |
| Vercel (hosting; Vercel Inc., United States) | Server functions: Frankfurt, Germany. Technical logs and delivery network: may be handled in the United States or elsewhere | Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (GDPR Article 46(2)(c)), Vercel DPA Schedule 3 |
| Google (Analytics & Ads; Google Ireland Ltd. with Google LLC, United States) | United States and any country where Google or its sub-processors have facilities | Google Ads Data Processing Terms (Analytics) and Controller-Controller Data Protection Terms (Ads), v8.0: an “Alternative Transfer Solution” recognised as adequate under GDPR (currently the EU-U.S. Data Privacy Framework) and, where none applies, Standard Contractual Clauses (GDPR Article 46(2)(c)) |
To get a copy of these clauses, or to ask which safeguard applies to any other provider in section 4, email support@rezycle.me.
5. Your GDPR Rights
Under EU and international privacy regulations, you hold the following rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Correct any inaccurate or incomplete information.
- Right to Erasure (“Right to be Forgotten”): Ask us to delete your uploaded CV, your report and any other data we hold about you, such as your email address, by emailing us. We do not have user accounts. Requests are handled by hand, not through an automatic button.
- Right to Restrict or Object: You can object at any time to the processing of your data based on our legitimate interest, and to receiving our emails (every email has a one-click unsubscribe link). Your score and risk level are generated by an AI model from the text of your resume. They are used to show you your result and to personalise our follow-up emails; they do not decide your price, your access to the service or anything else that produces legal effects for you. If you want a person to look at your result, write to support@rezycle.me and we will review it by hand.
- Right to Data Portability: Receive the data you gave us in a commonly used, machine-readable format.
- Right to Withdraw Consent: Where we rely on your consent (for example, analytics and advertising cookies), withdraw it at any time; this does not affect what was done before.
- Right to Complain: Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
To exercise any of these rights, please email us directly at support@rezycle.me.
6. Data Retention & Security
Free scan. Your resume text is sent to OpenAI to produce your result. We do not write the resume text to our database. We do keep your score, risk level and score band, tied to your email address, for 30 days. So that the link in our email can show your result again, we also keep a copy of the result, without your email address or resume, for 30 days. A copy of your result, your email address and your resume text stays in your own browser's session storage until you close the tab.
Paid orders. When you buy, your full resume text and your generated report are saved in our database (Upstash Redis) under your payment session ID, and expire automatically after 90 days. The record of your order in Stripe holds the first 450 characters of your resume; a cleanup job runs every day and, once an order is more than 90 days old, empties that excerpt. If you accepted cookies, the Google Analytics client and session identifiers are also stored in the same Stripe record; that cleanup does not remove them.
Deleting sooner. Email support@rezycle.me and we will delete it by hand. Data travels between your browser and our servers over an encrypted connection (TLS).
Marketing emails. If you opt in to our emails, we keep a record of your consent with your contact in Brevo: when you gave it, on which form, and which version of the consent text you saw. We keep that record for as long as you stay subscribed. If you unsubscribe, we keep it for 3 years from the date you unsubscribed, only to be able to show that we had your consent if a claim is made, and then we delete it. If a claim or official procedure is open when the 3 years end, we keep the record until it is closed. Your email address stays on our do-not-email list after that, so that we do not write to you again.