Privacy Policy

Section 1Personal data we collect

In the course of your use of the Platform, we may collect the following personal data:

1.1 Account registration data

• Email address
• Password (stored in hashed form — we cannot read your original password)
• Display name
• If you sign in via a third-party account (e.g. Google): the email address and display name from that account

1.2 CV and job-search data

• The original text of CVs you upload
• Structured data produced by AI parsing (including name, contact details, work history, education, skills, professional certifications, etc.)
• The current master résumé content you store

1.3 Preference settings

• Target job-search direction
• Interface language preference
• Default CV language
• Target region, date format, and currency preferences

1.4 Job-operation data

• Job links you save and the AI-parsed job details
• Application-stage labels, memo notes, follow-up dates, and priority settings
• AI-generated job-match analyses (match scores, company background, etc.)

1.5 AI-generated content

• AI-tailored CVs, cover letters, and application email bodies
• AI-polished and translated text
• Job-match analysis reports

1.6 Automatically collected technical data

• We use anonymous website-analytics tools to collect website-usage statistics; these tools do not use cookies and do not track individual identities
• Our hosting provider may automatically log basic access data (such as IP address and access time) in server logs, solely for site-security maintenance and technical troubleshooting

1.7 Payment-related data

• Subscription-plan data (plan type, amount, start and end dates)
• Payment transaction reference
• We do not receive or store your full credit-card number — all payment data is processed directly by a third-party payment provider

1.8 Chrome browser extension

• The HoiSum Chrome extension does not silently collect or upload your browsing data in the background. Job-description content from the page is sent to HoiSum servers for parsing only when you actively click "Preview job analysis", "Save job", or confirm saving/pasting content inside the extension.
• The extension is used to preview and save job pages on recruitment websites. It does not read or import LinkedIn profile pages; LinkedIn link parsing for your master résumé is submitted by you inside the HoiSum web app.
• The extension stores your interface-language preference locally on your device. Sign-in state is determined through HoiSum first-party cookies and server-side sessions; the extension does not store your password, access token, or login credentials.

1.9 Parsing data from signed-out visitors

• When you use "paste a job link / description" or the extension's preview feature while signed out, the job link and text you submit are associated with the anonymous visitor identifier (hsm_anon, see Section 6), sent to our servers and AI engines for processing, and temporarily stored on our servers (parse-task records and a parse-result cache that expires after about 30 days). Such content should be public job information — please do not paste your own sensitive personal data into signed-out parsing.

Section 2Purposes of collection

We collect your personal data only for the following purposes:

• Account management: creating and maintaining your account, verifying your identity, and managing login credentials
• AI processing services: using AI engines to parse job descriptions, parse and structure CVs, generate match analyses, tailor CVs, cover letters, and application email bodies, and polish and translate text
• Application-pipeline management: providing you with a job-tracking board, stage management, memos, and follow-up reminders
• Subscription management: processing your subscription, payment transactions, and sending payment-confirmation notices
• Service improvement: analysing anonymised usage statistics to improve platform features and service quality
• Customer communication: responding to your enquiries and sending service-related notices
• Legal compliance: meeting applicable legal and regulatory requirements

We will not use your personal data for purposes outside the above. If new services or new uses require your data in future, we will notify you separately and obtain your consent.

Section 3Use of artificial-intelligence services

The Platform’s core functionality relies on artificial-intelligence technology. The following explains how we use AI to process your data:

3.1 AI service providers: We use third-party AI engines to process your data; the relevant providers are located in the United States and China.

3.2 Data sent to AI engines: When you use the relevant features, we may transmit the following data to AI engines for processing:

• Your CV text content
• Job-description text you have saved
• Job-description text extracted by the Chrome extension from recruitment websites (sent only when you actively preview, save, or confirm)

3.3 Purposes of AI processing: Including but not limited to job-description parsing, CV structural parsing, job-match scoring, CV and cover-letter tailoring, text polishing, and language translation.

3.4 AI-training statement: We access the above AI services through their commercial APIs and use them, under their current terms, in a manner that does not participate in model training. If a provider's terms change adversely, we will switch providers accordingly or update this policy and notify you.

3.5 Accuracy of AI output: AI-generated content (including match scores, analysis reports, tailored text, etc.) is provided for reference only. AI output may contain inaccuracies; we recommend that you review all AI-generated content carefully before use.

Section 4Use and disclosure of personal data

4.1 Your personal data is used only by the HoiSum internal team in the course of delivering the service.

4.2 We use the following third-party service providers to process your data; each provider receives only the data necessary for its service:

• Authentication and database services: user authentication and data storage
• Payment processing services: payment processing (we do not receive or store your full credit-card number)
• Cloud infrastructure: website hosting, edge computing, file storage, and DNS services
• AI engine services: artificial-intelligence processing (see Section 3)
• Website analytics services: anonymous website-usage statistics (no personal-identity data collected)
• Transactional email services: sending transactional notification emails such as payment confirmations
• Document rendering services: PDF file generation
• Third-party account sign-in services: supporting sign-in via third-party accounts
• Font services: web font loading
• User-feedback services: collecting user feedback

Each of the above providers' handling of your personal data is governed by its own privacy policy. We have considered each provider's data-protection capabilities when making our selection.

4.3 Legal requirements: Where required by applicable law, regulation, legal process, or government request, we may be required to disclose your personal data.

4.4 Protection of rights: Where necessary to protect the rights, property, or safety of HoiSum, our users, or the public.

4.5 Other than the situations above, we will not sell, rent, or trade your personal data to any third party.

Section 5Direct marketing

5.1 We will not use your personal data for direct marketing without your consent.

5.2 If we offer a promotional-newsletter subscription option in the future, subscribing will be entirely voluntary.

5.3 If you have opted in, every promotional email we send includes a free unsubscribe option.

5.4 You may withdraw your direct-marketing consent at any time. Reply to a promotional email, or email [email protected], and we will stop sending you promotional material immediately.

Section 6Cookies and local storage

The Platform uses the following cookies and browser-storage technologies:

6.1 Essential cookies:

• hs_at (JWT access token): used to authenticate your login session; validity 1 hour; HttpOnly attribute
• hs_rt (refresh token): used to renew your login session automatically; validity 30 days; HttpOnly attribute
• hsm_anon (anonymous visitor identifier): set only when you use the free parsing feature while signed out; used to count the anonymous parsing quota and prevent abuse; validity 1 year. Once you sign in, this identifier is no longer relied upon.
• hs_oauth_state (third-party sign-in security nonce): set only when you start a third-party sign-in; used to prevent cross-site request forgery; validity 10 minutes and cleared once sign-in completes.

6.2 Local storage (localStorage):

• hs_lang: stores your interface-language preference
• In-progress parse / batch task IDs: used to restore parsing progress after a page refresh; they expire once the task completes
• Interface layout preferences (e.g. sidebar width, resume preview width): used only to remember your display settings

6.2A Session storage (sessionStorage): When you use "paste a job description" on the homepage, that text is held temporarily in your browser's sessionStorage so the parse page can pick it up; it is cleared once parsing succeeds, and closing the tab also clears it.

6.3 Analytics tools: The website-analytics tools we use are cookie-free and do not set any tracking cookies in your browser.

6.4 Extension local storage: The HoiSum Chrome extension stores your interface-language preference locally. On supported job sites it also caches detected job-description text temporarily in the browser's session storage (chrome.storage.session, capped at roughly 12,000 characters) so it is ready when you click preview, save, or confirm — this cache lasts at most 30 minutes, is cleared when you close or leave the tab, and is never transmitted to any server until you actively preview, save, or confirm the job. The extension's content script runs automatically only on the listed job sites; on any other site it activates only when you click the extension icon. The extension does not read or import LinkedIn profile pages.

6.5 You may manage or refuse cookies through your browser settings at any time. Disabling essential cookies will prevent you from logging in and using the Platform normally.

Section 7Data security and storage

7.1 We apply reasonable technical and administrative measures to protect your personal data from unauthorised access, processing, deletion, loss, or use, including but not limited to:

• SSL/TLS encryption for all data in transit
• Database access rights strictly controlled on a least-privilege basis
• Passwords stored in hashed form; data at rest encrypted
• Periodic review of security measures and access controls

7.2 We retain your personal data only for as long as needed for the purpose for which it was collected. Specifically:

• Account and CV data: retained continuously for the lifetime of your account so you can use the Platform at any time. You may delete your account and all associated data at any time via the self-service deletion function in your account settings.
• Transaction records: retained for 7 years in line with Hong Kong tax and commercial requirements
• We reserve the right to remove data from accounts that have had no login activity for 12 consecutive months.

Section 8Cross-border data transfers

Because some of the third-party service providers used by the Platform are located outside Hong Kong, your personal data may be transferred to other jurisdictions for processing. Specifically:

• United States: AI service processing, authentication and database, cloud infrastructure and edge computing, PDF rendering, email delivery
• China: AI service processing
• Globally distributed: Cloud CDN nodes span the globe; some of your requests may be processed by the node nearest to you

We have entered into contractual arrangements with the above providers requiring them to adopt data-protection measures comparable to the PDPO, and we use each provider's services, under its commercial API terms, in a manner that does not participate in its model training.

Section 9Your data rights

Under the PDPO, you have the following rights:

9.1 Right of access: You may enquire whether we hold personal data about you and request a copy of such data.

9.2 Right to correction: If you believe the personal data we hold is inaccurate, you may request correction.

9.3 Right to deletion: You may request deletion of your personal data (except where the law requires us to retain it). The Platform provides a self-service account-deletion function — you may delete your account and all associated data directly from your account settings in the console, without needing to contact us.

9.4 Data export: You may export your saved job library (including job title, company, source URL, application status, notes, and dates) in CSV format via your account settings in the console. To request a copy of other types of personal data, please contact us through the manual process described in clause 9.6.

9.5 Data portability: The job library data you obtain through the export function is in CSV format, which can be opened directly in Excel, Google Sheets, or similar spreadsheet applications.

9.6 To exercise any of the above rights manually, email [email protected] with enough identifying information for us to process the request.

9.7 We will respond to access or correction requests within 40 days (as required by the PDPO). If a request is complex and requires more time, we will let you know and explain why.

Section 10Third-party links

The Platform may contain links to third-party websites or services (including job links you have saved). We are not responsible for the privacy policies or practices of those third parties. We recommend reviewing their privacy policies before sharing any personal data with them.

Section 11Minors

The Platform is intended for adults with a legal right to work. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected data from a minor, we will delete it as soon as practicable.

Section 12Changes to this Privacy Policy

12.1 We may revise this Privacy Policy from time to time to reflect changes in our practices or in applicable law.

12.2 The revised Policy will be posted on this page, with the "last updated" date at the top refreshed.

12.3 Where a revision materially affects your rights, we will notify you by email or by a notice on the site.

Section 13Contact and complaints

For questions about this Privacy Policy, or to exercise your data rights, please contact:

• Email: [email protected]
• Web: https://hoisum.hk

13.1 If you believe that the Platform has contravened the PDPO in handling your personal data, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong. For details, please visit: www.pcpd.org.hk

The Traditional Chinese version of this Privacy Policy is the authoritative version. In the event of any discrepancy between the English (or any other) version and the Traditional Chinese version, the Traditional Chinese version shall prevail.