Privacy notice
Last updated November 9, 2026. Candidate Check is run by LumeGrid. Contact: hello@trylumegrid.com.
The short version
- Resumes and candidate details you enter are processed in your browser. They are not uploaded to our servers and we do not store them.
- Nothing is saved after you close or clear the page unless you tick "Keep this report on this device". Then the findings, which include short quotes from the resume, are saved in your own browser's local storage for 30 days. The resume file, email and phone are not saved. You can delete them anytime.
- We do not use analytics scripts, ad pixels or third-party fonts.
Optional public lookups
If "Run public lookups" is on (default), your browser sends these requests directly:
| What is sent | To whom | Why |
|---|---|---|
The email's domain (for example example.com), never the full address | Cloudflare DNS over HTTPS (cloudflare-dns.com) | Check that the domain exists and can receive mail |
| The email's domain | The domain's official registry RDAP server: rdap.verisign.com (.com, .net), rdap.publicinterestregistry.org (.org), rdap.centralnic.com (.xyz and others), rdap.identitydigital.services (.io, .info, .pro), pubapi.registry.google (.app, .dev). Other endings are not looked up. | Read the public registration date |
| The GitHub username | GitHub's public API (api.github.com) | Check the account exists, its creation date and display name |
| The portfolio website's domain | Cloudflare DNS over HTTPS | Check that the domain exists |
Those services receive your IP address and the website you are on, as with any web request, and handle them under their own privacy policies. A personal domain can identify the candidate by itself. Turn lookups off to keep everything on your device after the page loads. The site's security policy tells your browser to block any other destination.
Waitlist
If you join the waitlist we store your work email, the plan you picked, your team size, the time you joined and your consent to be emailed. We use it only to contact you about launch, and delete it 12 months after launch. Email us to be removed sooner.
Server logs
Our host (Cloudflare) may keep standard request logs such as IP address, URL and time for security. Page requests never include resume content.
Your responsibilities
You are responsible for having a lawful basis to process candidate information, for telling candidates how you verify applications where the law requires it, and for following employment and privacy laws that apply to you.