Privacy Policy

Effective date: October 13, 2026
Last updated: October 24, 2026

This Privacy Policy explains how Expolious LLC, a Hawaii limited liability company ("Expolious," "we," "us") collects, uses, and protects personal information through expolious.com and the Expolious resume-ranking service (the "Service"). It should be read with our Terms of Use · How we protect your resumes · How we handle your files · FAQ & help.

1. Who This Covers

• Employers and their staff who use the Service ("Customers").
• Job candidates whose resumes Customers upload. For candidate data, the Customer decides what is shared and why, and we process it on the Customer's behalf.
• Job seekers who buy a resume report for themselves.
• Visitors to our website.

2. Information We Collect

Information you give us

• Contact details: name, company, email address, and any message you send us.
• Job details: job descriptions, the hiring variables you choose, and their weights.
• Uploaded resumes (PDF, DOCX, and similar files) sent by upload or email. These usually contain candidates' personal information, such as name, contact details, work history, education, and skills.
• For job seekers: your own resume and the job you are targeting, and, if you choose to attach it, a PDF of your LinkedIn profile. We process LinkedIn PDFs exactly like resumes (same purpose, security, and retention). We never look up or scrape LinkedIn profiles.

Payment information
Payments are handled by PayPal. We do not receive or store full card numbers. We receive a transaction reference, the payer's name and email, the amount, and the payment status.

Resume Builder (free, for job seekers)

• Age. The Resume Builder is only for people 18 or older, matching our Terms of Use.
• What we collect. If you use the Resume Builder at expolious.com/build-my-resume, we collect the answers you type (target job, an optional job posting, your past jobs, duties, accomplishments, skills, certifications and education), the AI-written draft and your edits, and, at the last step, the contact details you choose to put on your resume (name, email, and optionally phone, city and a profile link). We record when you agreed to the consent box.
• What goes to the AI. Your answers are sent to our AI processing provider to write your resume. Before they are sent, we remove email addresses, phone numbers, web links and street addresses. Your contact details are never sent to the AI. The AI is instructed not to ask about or include age, birth dates, graduation years (unless you ask), health, disability, family or marital status, pregnancy, religion, race, national origin, citizenship, photos or salary history, and we automatically screen its output for common mentions of these. Automatic screening can miss things, so please don't include them and check your draft before you use it.
• How it is used. Only to build, show and export your resume, and, if you ask, to email you. We do not use Resume Builder answers or resumes to train AI models, for marketing (other than the optional emails you request), or in Expolious employer rankings or screening. Resumes made with the builder get no advantage or special treatment if an employer uses Expolious.
• Retention. Your interview and draft are deleted automatically 7 days after you start, or right away when you click “Delete my data now”. Copies may remain in our hosting provider's routine backups for a limited time before they are overwritten. To enforce the one-free-resume-per-email-per-week limit, we keep a one-way coded (hashed) version of your email address for 7 days. If you unsubscribe, we keep a hashed version of your email address so we can honor it.
• In your browser. The builder saves a random interview code in your browser's local storage so you can come back to your draft. It is not a cookie, is not used for tracking, and is removed when you click “Delete my data now”.
• Emails. We email you only if you check the box: one “your resume is ready” email and one follow-up a few days later about our paid Resume Report. Every email has an unsubscribe link.
• Speaking instead of typing. If your browser supports it, the Resume Builder shows a microphone button. Speech-to-text is handled by your browser, which may send your audio to its maker’s speech service (for example Google, Apple or Microsoft) or process it on your device. We receive only the text, and only after you tap Next. No audio is sent to our server.
• Designed Resume PDF (paid). If you buy a Designed Resume PDF, PayPal processes your payment; we receive the payment reference, amount and status, not your card details. PayPal may also send us your PayPal name and email; we don't keep them for this purchase. We make the PDF from your edited resume, email it to the address on your resume, and delete it from our server right away. For each purchase we keep only the item, the PayPal (or promo) reference, the amount, the time and a one-way coded (hashed) version of your email address, for up to 7 years for tax and accounting, and then delete it. The preview shown before you buy is made on the fly and never stored. Email copies stay in your mailbox and in our email provider's sent mail.
• Resume Report from the builder. If you click “Get my Resume Report” in the builder, your built resume, name, email and target job are filled into the Resume Report order form in your browser. If you submit that order, it is handled like any Resume Report order, including the 30-day retention described in Section 6.
• No ad pixels. The Resume Builder page loads no advertising or analytics tags. Our own cookie-free visit counter (described below) counts page visits only.

Information collected automatically

• IP address. Our upload server uses your IP address for rate limiting and abuse prevention. It is stored only in a one-way hashed form.
• Server logs. Our host keeps standard logs, such as IP address, browser type, pages requested, and time.
• Site statistics. Expolious LLC runs its own simple visit and download counter; no outside analytics service is involved. When a page loads or a free resume template is downloaded, we record the page or template, the time, the domain of the website that referred you (for example, tiktok.com, not the full address), and whether the visit appears to come from an automated bot. To count unique visitors without cookies, we also record a short daily code made by one-way hashing your IP address and browser type with a secret value; it changes every day and cannot be turned back into your IP address. We do not store your IP address or browser details in these records, and the counter sets no cookies on visitors' devices. The records are kept on our server outside the public website folders and are deleted after 12 months.
• Access links. Paid plans include a private access link that is valid for 30 days. We store only a hashed version of the link's token, along with your plan, expiry date, and usage.
• Fonts. Pages load fonts from Google Fonts, which means your browser connects to Google's servers.
• Cookies and similar technologies. We do not currently set analytics or advertising cookies. The only cookie we set is a sign-in cookie for the Expolious administrator's private statistics page; it is never set for visitors or customers. We plan to add Google Analytics 4, the Google Ads conversion tag, and the TikTok Pixel. If we do, they will set cookies or similar identifiers to measure visits and ad performance. We will update this policy and, where required, ask for your consent before they are used. Before any of these tags go live, we will add a cookie notice with a way to opt out.

3. How We Use Information

• To provide the Service: scoring and ranking resumes, generating interview questions, and emailing results.
• To run the free Resume Builder: turning your answers into a resume you can edit and copy, and, if you buy one, a Designed Resume PDF (see “Resume Builder” above for its limits on use).
• To process payments, prevent fraud and abuse, and secure the Service.
• To answer questions and provide support.
• To improve the Service using aggregated or de-identified information.
• With consent where required, to measure our marketing and advertising.
• To comply with the law and enforce our Terms.

We do not use resumes uploaded by Customers to advertise to candidates, and we do not use them to train AI models for third parties.

4. We Do Not Sell Personal Information

We do not sell personal information. We do not "share" it for cross-context behavioral advertising as defined in the CCPA. The exception is the advertising tags described above, once they are added; any such use will be disclosed here and will include an opt-out.

5. Service Providers We Share With

We share information only with providers that help us run the Service. They are bound to use it only on our behalf.

We may also disclose information when the law requires it, to protect rights and safety, or as part of a merger or sale of the business.

6. Retention

We keep site-statistics records (described in Section 2) for 12 months and then delete them. We keep uploaded resumes and job descriptions (including job seekers' LinkedIn profile PDFs) for up to 30 days, and then delete them automatically. Access-link records expire after 30 days and are deleted within 7 days after that. Resume Builder interviews and drafts are deleted 7 days after they are started, or sooner if you delete them. Copies may remain in our hosting provider's routine backups for a limited time before they are overwritten. We keep payment and transaction records as long as tax and accounting laws require. Results emails stay in the sender's and recipient's mailboxes. You can ask us to delete copies held in our mailbox by emailing ingrid@expolious.com.

7. Security

We use reasonable administrative, technical, and physical safeguards, including:

• HTTPS encryption
• checks of each uploaded file's real type, refusing files with macros, embedded objects or scripts
• uploaded files stored outside public web folders, with restricted permissions
• hashed access tokens and hashed IP addresses
• limited staff access

No system is perfectly secure, and we cannot guarantee absolute security.

8. Employer Responsibilities for Candidate Data

Customers must have a lawful basis to collect candidates' resumes and share them with Expolious for evaluation. This includes giving any required notices, getting any required consents (including under laws on automated or AI-assisted hiring tools), and honoring candidates' rights under applicable law. Customers should not upload sensitive information that is not needed for evaluation.

9. Candidates' Rights

If your resume was submitted to Expolious by an employer, you may ask us to delete it or to tell you whether we hold it. Email ingrid@expolious.com. We may need to verify your identity, and we may also refer your request to the employer who submitted it.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what categories and specific pieces of personal information we collect, use, and disclose;
• Delete personal information we hold about you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information. We do not sell it. If advertising tags are added, an opt-out will be available, and we will honor Global Privacy Control signals;
• Limit the use of sensitive personal information. We do not use it for purposes that require this right;
• Not be discriminated against for exercising these rights.

The categories we collect are identifiers, professional and employment information, education information, commercial (transaction) information, and internet activity information. To make a request, email ingrid@expolious.com. You may also use an authorized agent. We will verify requests and respond within 45 days. If we process candidate data on an employer's behalf, we may direct your request to that employer.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. Some features, including the Resume Builder, require you to be 18 or older. If you believe a child has given us personal information, contact us and we will delete it.

12. Data Breach Notification

If a security breach involving personal information occurs, we will notify affected individuals and authorities as required by law. That includes Hawaii Revised Statutes Chapter 487N, which requires notice without unreasonable delay. Where we process candidate data on a Customer's behalf, we will also notify that Customer promptly.

13. Changes

We may update this policy. We will post the new version with a new "Last updated" date. If changes are material, we will give additional notice where required.

14. Contact

Expolious LLC
Hawaii, USA
Email: ingrid@expolious.com