Your account and payment details stay private.

Stripe collects card information

Checkout opens on Stripe’s hosted payment page. CandidateLift does not collect card numbers, security codes, or bank login details. It stores purchase references, payment status, amounts, and plan entitlements needed to deliver the service.

The server selects the plan and validates the configured price. Account access is granted through a verified Stripe payment notification. A return URL or a change in the browser cannot grant paid access. Billing management opens a Stripe portal session associated with the signed-in customer.

Account data requires your verified sign-in

The server checks identity before returning a profile, saving account history, starting checkout, or editing a paid PDF. Customer requests are tied to the signed-in account. The business dashboard checks the owner allowlist before loading sales and customer information.

Private responses are marked against caching and search indexing. Payment API secrets, authentication secrets, database access, and the owner allowlist are kept in the server runtime. The public sign-in key is designed to identify the sign-in service; it does not authorize access to customer records.

Resume text stays in the current working session

Text comparison runs in your browser. Account history stores analysis metadata rather than your full resume or job-description text. Paid PDF editing sends the original PDF and approved sentence changes to the server for temporary processing; uploaded and edited files are not saved in file storage.

An edited PDF must match the document fingerprint associated with an analysis owned by your account. A failed edit does not spend an export credit, and downloading an unlocked analysis again does not spend another credit.

Search tools see the public resources

Product pages, resume guides, pricing, and the scoring methodology are public. Account, checkout, API, and business-dashboard routes are excluded from the sitemap and marked for exclusion from search. Search directives help crawlers; server authorization protects the private information.