Privacy Policy
Last updated: 12 October 2026
Refmee helps people prove what's on their CV. Applicants list their experience, the people who know their work (referees) confirm it, and organisations that are hiring (hirers) receive verified applications. This policy explains what personal data we hold, why, who we share it with, and the rights you have.
It covers three groups of people: applicants, referees and hirers. If you're a referee, you probably never signed up to Refmee. The section "If you're a referee" is written for you.
Who we are
Refmee (refmee.com) is run by Armin Hosseinghorbani, an individual based in the United Kingdom. In this policy, "we" means Refmee and its operator. We are the "controller" of your personal data under the UK GDPR and the Data Protection Act 2018. If Refmee becomes a company, we'll update this section.
Questions or requests about your data: armin.h.ghorbani@gmail.com. Postal address available on request.
What we collect
Applicants
- Account details: name, email address, password (stored only as a secure hash) or the account you signed in with (Google or Microsoft).
- Your CV file, and the items we extract from it (education, jobs, skills, achievements and similar), including any edits you make.
- Your referees' names, email addresses and organisations, which you give us.
- Your applications: which positions you applied to, when, and which references you attached.
- If you filled in our launch survey: country, gender, year of birth, degree and universities you're applying to, how you heard about us, and your marketing preferences.
- If you buy a paid plan: your plan and payment status. Card details are handled by our payment provider (Stripe), and we never see them.
Referees
- Your name, email address and organisation, given to us by the applicant who listed you.
- Your responses: whether you agree, disagree, or can't comment on each claim, plus any ratings and notes you write, and when you responded.
- If you sign in with Microsoft or Google to confirm your identity, the name, email address and organisation information that service shares with us.
Hirers
- Account details: name, email address, job title, organisation name and website, and how you signed in.
- A trust level we assign based on how you signed in (for example, a verified work account).
- The positions you create, and the applications you receive and open.
Everyone
- Basic technical data needed to run the site securely: IP address, browser type and the times you used the service, held in our hosting and database providers' logs.
- Emails we send you and whether delivery succeeded.
- Reports you send us about a position, including your email address if you give it.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Run your account, extract claims from your CV, send reference requests and reminders, deliver applications to the positions you choose | Contract: it's the service you asked for |
| Hold a referee's details and responses, and send them requests and reminders | Legitimate interests: applicants need a way to have their claims confirmed, and referees can decline, ignore or withdraw at any time |
| Verify hirers and detect scam or misleading positions | Legitimate interests: protecting applicants from fraud |
| Launch survey answers and product updates | Consent: you can withdraw it at any time |
| Payment records | Contract and legal obligation (tax records) |
| Security logs | Legitimate interests: keeping the service secure |
We don't sell personal data, and we don't use it for advertising.
How we use AI
- Reading your CV. When you upload a CV, its text is sent to our AI provider, Anthropic, to identify and organise the claims on it. You review and can edit every item before it's sent to anyone. Under its commercial terms, Anthropic does not use this data to train its models, and it keeps the data only for a limited period before deleting it.
AI never decides on its own whether someone gets a job. Hirers make their own decisions.
If you're a referee
An applicant gave us your name and email address and asked you to confirm claims on their CV. You don't have to take part. You can:
- decline using the link in our email, and we'll stop contacting you about that request;
- ignore the request. We won't keep chasing you: we send at most two reminders, then stop;
- withdraw a response you've already given by emailing us. We'll remove it, and the applicant will see that the reference is no longer available.
Your responses are shown to the applicant (unless you choose otherwise where the form offers that) and to hirers who receive an application containing your reference.
Who we share data with
- Hirers, but only when an applicant submits an application to a position. The hirer then sees the application, the claims and the referees' responses. Once received, the hirer is responsible for how it uses that information under its own privacy policy.
- Applicants see their referees' responses.
- Service providers who process data for us under contract:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in | EU (Frankfurt) |
| Netlify | Website hosting | USA / global |
| Resend | Sending emails | USA |
| Anthropic | Reading CVs | USA |
| Google, Microsoft | Sign-in, if you choose it | USA / global |
| Stripe | Payments, if you buy a plan | USA / global |
- Authorities, if the law requires it.
International transfers
Some providers are outside the UK. Where data leaves the UK, it's protected by UK adequacy regulations (for example, for the EU), the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Addendum to the standard contractual clauses.
How long we keep data
- Accounts, CVs and CV items: while your account is open. When you delete your account, we delete these within 30 days.
- Reference responses: while the applicant's account is open, or until the referee withdraws them.
- Applications sent to a position: the hirer can see them while the applicant's account exists. If you delete your account, your applications are deleted with it and hirers can no longer see them in Refmee. We can't delete copies a hirer has already made outside Refmee.
- Position reports and hirer verification records: as long as we need them to investigate and prevent misuse.
- Payment records: 6 years, as UK tax law requires.
Deleted data may remain in backups for a short period until they are overwritten.
Your rights
You can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict or object to how we use it;
- send your data to you or another service in a portable format;
- withdraw consent you've given.
Email armin.h.ghorbani@gmail.com. We'll reply within one month. Applicants can also delete their account themselves in account settings.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We'd appreciate the chance to sort it out first.
Cookies and local storage
We use only what's needed to keep you signed in and the site working, held in your browser's local storage. We don't use advertising or analytics cookies. Some pages load code libraries from jsDelivr, a content delivery network, which receives your IP address when it serves them.
Age
Refmee is intended for people aged 16 and over. If you're under 16, please don't use it.
Security
Data is encrypted in transit and at rest. Access is restricted so each user sees only their own data and what has been shared with them. Staff access is limited to what's needed to run and support the service.
Changes
If we make important changes to this policy, we'll update the date at the top and tell account holders by email. We'll update this policy before we add new kinds of processing, such as background checks on referees.