ResumeCheck

GDPR overview

The publisher is established in the European Union, in Estonia, and the Terms of Use apply Estonian law and Estonian courts. resumecheck.net never claims GDPR compliance in so many words; that wording appears only on jobmojito.com, the About page its footer points to. The privacy policy, version 2.0 last updated in March 2026, sets out the roles: ResumeCheck.net as controller, JobMojito (FreshMint ai OÜ) as processor under a separate data processing agreement. It lists access, rectification, erasure, restriction, portability where applicable, and objection for site and account data, while candidate-data requests must go to the controller. Transfers outside the EEA or the United Kingdom rely on standard contractual clauses or a UK addendum. No Article 27 representative is designated, which an EU-established publisher does not need, and no data protection officer or dedicated privacy address is named.

Who owns the data?

The Terms of Use address ownership from the publisher's side only. Section 6 states that all intellectual property rights in the platform, including its software, algorithms, documentation and AI components, remain the property of JobMojito or its licensors, and that ResumeCheck.net retains ownership of its data. No clause states who owns a resume uploaded by an individual user, nor what rights that person keeps over it. The declared architecture places ResumeCheck.net in the controller role and JobMojito, operated by FreshMint ai OÜ, in the processor role, acting on documented instructions; the processor undertakes not to use identifiable data for its own product development.

Reuse rights

Nothing in the published documents restricts what you do with the resume you build: the file is delivered as a PDF or a re-editable Word document without a watermark, and no clause claims a licence over your content or requires permission to reuse it. What the documents describe instead is the publisher's own processing. The declared data categories are name and contact details, resume or application file, interview audio and video recordings, transcripts, rubric evaluation results, limited behavioural and voice analysis such as pronunciation, pace and sentiment, and system-generated score detail. The stated AI use is producing structured summaries, applying rubric scoring defined by the controller, and analysing those limited behavioural or vocal characteristics when they are enabled. For site visitors, IP address, browser and device data, usage analytics and cookie identifiers are processed for operation, security, analytics and improvement, on legitimate interest or consent; account data such as name, work email, organisation details, login credentials and billing information rests on contract performance and legitimate interest. JobMojito states that it does not use identifiable candidate data to train AI foundation models, to fine-tune shared models across customers, or for independent product development, and that improvement relies only on aggregated, anonymised statistics that cannot re-identify anyone. No fully automated employment decision is made and human review is required; voice biometrics are disabled by default and sit outside the core scoring system. Readers should keep in mind that these categories describe an interview and candidate evaluation platform rather than the consumer resume builder actually offered here.

Data retention & training

Hosting summary

The privacy policy states that primary processing occurs within EU-hosted cloud infrastructure operated by JobMojito. Beyond that, no hosting country, region or provider is named. Transfers outside the EEA or the United Kingdom are covered by standard contractual clauses or a UK addendum where required, and the cookie policy notes that some providers, Google among them, may process data outside the EEA under the same safeguards. The declared security measures are encryption in transit and at rest, role-based access control, tenant data separation, secure cloud infrastructure, logging and audit controls, and incident response procedures. An up-to-date subprocessor list is said to be published on trust.jobmojito.com, which returned HTTP 403 when consulted directly, so it could not be verified; the cookie policy itself names Google Analytics, PostHog, Hotjar and Featurebase. One apparent contradiction deserves an explanation: the domain resolves to 76.76.21.21, an anycast address located in the United States on Amazon's network. That is a content delivery point of presence used to serve the pages, not the place where personal data is processed.