What happens to your resume during matching is a fair question before you upload one. A resume holds your name, your employers, your dates and often your phone number, so it is worth knowing where it goes. This post follows a resume through Zorlya’s matching, step by step, and says what is stored, what leaves, what you can delete, and what the privacy policy does not promise. It restates the policy and the security page. If this post and those pages ever differ, the pages are the authority.
Step 1: the file
When you upload a resume, the original file is stored as you uploaded it, so Zorlya can re-read it and keep earlier versions. A file that yields no readable text, such as a scan, is refused and nothing is saved.
Step 2: parsed fields
The text is parsed into fields: skills, experience, headline. These make up your profile and drive the skills, location and seniority parts of a score. You can edit most of the profile yourself. Parsing is one of the places a language model is used.
Step 3: passages and embeddings
The resume is split into passages, and each passage is turned into an embedding, a list of numbers that lets Zorlya compare your experience with a job’s text. The embeddings are stored with your account. A profile needs them before it is scored, and they pick the passages a model reads when it drafts a letter for one job. The first matching pass compares each job with one embedding of your headline, skills and track, as the post on embeddings explains.
The whole path in one table
| Step | What is stored | What leaves Zorlya’s Cloudflare account |
|---|---|---|
| Upload | The original file | Nothing |
| Parsing | Profile fields | The text, to the model that parses it, inside the same Cloudflare account by default |
| Passages and embeddings | Passages and their embeddings | Nothing beyond the embedding model, which runs in the same place |
| First matching pass | A provisional fit number per job | Nothing beyond the embedding model, for the short query built from your profile |
| Refresh, explanations, letters | Scores, explanations, drafts | The passages and job text that one request needs |
| Applying through Zorlya | The application | Your name, resume and note, to that one company |
What sits in the database
The policy lists what is kept and for how long. For a resume, it comes to this:
| Data | Kept until |
|---|---|
| Resume files, as uploaded | You delete the file or your account |
| Fields parsed from the resume | Your account is deleted |
| Embeddings of resume passages | Your account is deleted |
| Profile settings such as salary floor, location and remote preference | You change them or delete your account |
All of this is stored in Cloudflare D1, and resume files in Cloudflare R2. The API reaches both from inside Cloudflare, and the connection from your browser uses TLS. Passwords are stored as bcrypt hashes.
What leaves Zorlya
To score a job, explain a score or draft a letter, the relevant passages of your resume and the job text are sent to a model. Each request carries only what that one request needs.
By default the model runs on Cloudflare Workers AI, inside the same Cloudflare account that hosts Zorlya, and embeddings are made there too. The policy and security page say no other model provider receives your data today. Cloudflare states that it does not use content processed by Workers AI to train AI models, and it counts inputs, outputs and embeddings as that content. If Zorlya adds a provider such as OpenAI or Anthropic, the policy and the security page are to be updated before any of your data goes to it, and a change to who handles data is emailed to every account 30 days ahead.
Model answers are cached by a hash of the prompt so the same request is not paid for twice. A cached answer carries no account id.
Who sees your resume
Not employers, by default. The policy says a company sees nothing about you until you act. If you apply through Zorlya, that company sees your name, your resume and your note. It sees your fit score and its four parts only if you tick the box to share them.
If you turn on “Open to being found”, companies see an anonymous card with what you do, where and what you know, with no name, no address and no current employer. A company learns your name and address only if you accept its request to talk, and only that company does. You can hide any company, and your current employer is always hidden.
Nothing is sold, rented or shared for advertising, and your data is not used to train anyone’s model.
What you can delete
- Piece by piece. Applications, cover letters, outreach drafts, saved jobs, stored resume files and connected AI clients can each be deleted as you go.
- The whole account. Settings, then Privacy, then Delete account. It asks for your password, happens at once and signs you out. It removes your profile, resume files, embeddings, letters, applications, notes, settings and client tokens in one operation.
- A copy first. In the same place, Download my data gives you everything as one JSON file. Passwords, tokens and embeddings are left out of it, and so are support tickets.
Three things stay after you delete. Model usage records remain as token counts and cost, with the link to you removed. The log of requests made by AI apps you connected expires on its own, the contents after 90 days and the rest after 13 months, unless you write to ask for it to be deleted sooner. And support tickets are kept for as long as the service runs, with the link to your account cut. You can ask for a ticket to be deleted by writing from its address.
Before you upload: what to leave off
These choices apply to any job site, not only Zorlya. A resume does not need these to be scored:
- A national ID or passport number.
- Your full date of birth.
- Your full home address. The city is enough for location matching.
- A photo, unless it is the custom where you apply and you want one.
- References’ phone numbers and emails. Write “available on request” or leave the line out.
- Salary history. Your salary floor goes in your profile settings, where matching uses it.
Keep a fuller version on your own computer for employers who ask for more after an offer.
Questions people ask
Does an employer see my resume when I upload it?
No. A company sees your resume only if you apply to it through Zorlya, or if you accept its request to talk after it found your anonymous card.
Is my resume used to train AI?
Not by Zorlya, and the policy says your data is not used to train anyone’s model. The default model host states that it does not train on what it processes.
How do I delete my resume?
Delete the file from your profile, or delete the whole account under Settings, then Privacy. Download your data first if you want a copy.
Can I upload a resume without my phone number?
Yes. Matching does not need it. Add it later to an application if the employer asks.
What this post cannot promise
The privacy page says what it says, and no more. It does not describe how long Cloudflare keeps its Worker logs, which are switched on for the API. It does not claim the database is in any particular region. It places company mail and the contents of the AI app request log in the European Union, and the security page says the same of every file in Cloudflare R2, resume files included. The security page lists every service that touches data, and is the place to check before you upload anything you consider sensitive.
If you want a smaller footprint, upload a resume with only what you are willing to have scored, leave the optional GitHub and WordPress.org fields empty, and delete files you no longer need. For anything else, the privacy contact on the policy page answers within the time the policy states.
What we know and what we do not
We know what Zorlya stores and sends from the code, the privacy policy and the security page. We do not know how long Cloudflare keeps its own Worker logs, and the policy makes no promise about the region of the database.