Privacy Policy

This Privacy Policy explains how Resumi ("Resumi," "we," "us") collects, uses, shares, and protects personal data when you use our AI-powered resume builder (the "Service"). It also describes the rights you have and how to exercise them.

For the purposes of the EU/UK General Data Protection Regulation ("GDPR"), Resumi is the data controller of the personal data described here. If you do not agree with this policy, please do not use the Service.

We collect the following categories of personal data:

• Information you provide. Account details (name, email address, password) and the content you put into your resumes, which may include your employment history, education, skills, contact details, and anything else you choose to add.
• Jobs you track. The job postings you save to your job tracker — the link, title, company, location, pay details and job description — and the status updates, interview details, contacts and notes you add. A job description can name a recruiter or another company contact.
• Information from sign-in providers. If you sign in with Google, we receive basic profile information (such as your name, email address, and profile identifier) that you consent to share. We request only the minimum scope needed to authenticate you, and we use Google user data solely to sign you in (never to serve advertising and never to train AI models), consistent with the Google API Services User Data Policy, including its Limited Use requirements.
• Payment information. When you subscribe, our Merchant of Record (Polar Software Inc.) collects and processes your payment details. We receive limited billing metadata (such as plan and status) but never your full card number.
• Usage and device data. Technical information such as IP address, browser and device type, pages viewed, and actions taken, collected through logs and cookies to keep the Service secure and working.

We use personal data to:

• provide, maintain, and personalize the Service and your account;
• generate and refine resume content when you use our AI features (see AI processing);
• process payments, manage subscriptions, and prevent fraud;
• secure the Service, debug problems, and enforce our Terms (including the acceptable-use rules);
• communicate with you about your account, security, and service changes, and, with your consent where required, send product updates;
• measure how our ads perform and show our ads to people who have visited our website (see Cookies and similar technologies);
• comply with legal obligations.

We do not sell your personal data. For what is sent to our AI providers, and what we keep, see AI processing.

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract: to provide the Service you sign up for, including saving your resumes and running AI actions you request.
• Legitimate interests: to secure, maintain, and improve the Service and prevent abuse, balanced against your rights.
• Consent: for optional cookies and marketing communications, which you can withdraw at any time.
• Legal obligation: to comply with tax, accounting, and other legal requirements.

Our AI features (for example tailoring a resume to a job description, rewriting or improving a section, and suggesting skills) are provided using third-party AI services. When you use one of these features, the text you submit is sent through Cloudflare's AI Gateway to an AI model provider, which generates the output returned to you.

The provider we use is Anthropic. If we change or add a provider we will update this policy and the "Last updated" date above before doing so.

We send only the content needed for the action you requested: the resume content you chose to work on, and any job description you paste or import. When you import a job from a link or from pasted text, the posting's text may be sent to our AI provider to read out the job's title, company and other details. Because a resume is personal by nature, that text will normally contain personal information about you, and it may contain information about other people where you include it. A pasted job posting, for example, may name a recruiter or a company contact. We do not send your account credentials, your other resumes, or your payment details.

We keep a record of each AI action in our own systems so we can investigate errors, billing questions, and misuse. That record includes a short excerpt (up to 200 characters) of the resume text from immediately before and after the action, along with the provider and model used. That record does not include the job description. Job descriptions are kept only with the jobs in your job tracker (see Information we collect), and are deleted when you delete the job or your account.

When you paste a link to a job posting, our servers request that page on your behalf, identified as Resumi, to read the posting. We only request pages you ask us to, we do not crawl or index job sites, and we keep only the details we show you plus the link. Some sites do not allow this; for those we ask you to paste the description instead.

AI output may be inaccurate, so you should always review it before use, as explained in our Terms.

The AI features assist you in writing your resume; they do not make automated decisions that produce legal or similarly significant effects about you. You remain in control of your resume at all times.

We do not sell your personal data. We share it only in these situations:

• Service providers (subprocessors). Vendors who help us run the Service under contract. They may process data only on our instructions. As of the date above they are:
  • Supabase — database, authentication, and storage of your account and resume content.
  • Cloudflare — application hosting, content delivery, and the AI Gateway that routes AI requests.
  • Polar Software Inc. — payments, as Merchant of Record.
  • Anthropic — the AI model provider behind our AI features (see "AI processing" above).
  • Resend — transactional email, such as sign-in confirmations, password resets, and billing notices.
  • Sentry — error monitoring. Error reports can include user IDs, IP addresses, and the page where an error occurred; they are scrubbed of resume content before they are sent.
  • Simple Analytics — cookieless, aggregated page view counts for our public pages (see "Cookies and similar technologies" below).
  • PostHog — product analytics. On our public pages it records page views and interactions such as which links and buttons are used. Once you sign in, it also records which features you use (for example creating or downloading a resume) against your account identifier, so we can see where the Service is confusing or broken. Interaction recording is switched off entirely on the pages where you edit or manage your documents, and it never receives your resume content, the web addresses of your documents, or the titles you give them.
• Advertising. Our website uses the Google Ads tag. It sends Google your IP address, browser details, the page you are on (with anything that identifies a document removed), and whether you arrived from one of our ads. When you create an account, the tag also sends a one-way hashed (SHA-256) form of your email address with the signup, so Google can match the signup to the ad you clicked; the hash is made in your browser and Google never receives the address itself. Google uses this under its own privacy policy, including to show our ads to people who have visited our website. See how Google uses information from sites that use its services.
• Legal and safety. When required by law, legal process, or to protect the rights, safety, and security of Resumi, our users, or the public.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy.
• With your direction. When you choose to export, download, or share your resume.

We use cookies and similar technologies (such as local storage) for the following purposes:

• Strictly necessary: to sign you in, keep your session secure, and remember your actions during a visit. The Service will not work properly without these, so they cannot be switched off.
• Preferences: to remember choices such as your theme (light or dark).
• Advertising: set by Google Ads to tell us when a visit came from one of our ads and to show our ads to people who have visited our website.
• Attribution: one first-party cookie (rsm_first_touch) remembers how you first found us — the page you landed on, the site that referred you, campaign codes and ad click identifiers (such as Google's gclid) — for 90 days, so we can tell which of our marketing works. It contains nothing you typed; if you create an account, that record is kept with it. When you create an account, the landing page, referring site and campaign codes (not the click identifiers) are also stored as properties of your account in PostHog, and the signup is reported to Google Ads as a conversion, with your email address in hashed form (see Advertising above).

We do not use third-party analytics cookies. To understand how our public pages are found we use Simple Analytics, which counts page views without cookies, without device fingerprinting, and without storing anything that identifies you. It records only our public pages: the addresses of the pages where you edit or manage your documents are never sent to it, because they identify your documents.

We also use PostHog to understand how the Service itself is used. PostHog itself is configured to store nothing on your device — no cookie, no local storage — which is why no consent banner is needed for it either. Web addresses are stripped of anything identifying a document before they are sent, and session recording is switched off entirely on the pages where you edit or manage your documents.

Some cookies are set by providers that help us run the Service, such as Polar during checkout and our authentication provider when you sign in. You can block non-essential cookies, including the Google Ads cookies, in your browser settings, and turn off personalized ads from Google in My Ad Center. Blocking strictly necessary cookies may stop parts of the Service from working.

We keep personal data for as long as your account is active or as needed to provide the Service, and afterwards only as long as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete a resume, a job or your account, we delete or anonymize the associated data within a reasonable period, subject to limited backup retention, except the deletion note described under your rights below, which we keep with the deletion record. You can delete your account yourself at any time in the app under Settings → Plan & usage → Delete account; deletion takes effect immediately.

We use technical and organizational measures intended to protect your data, including encryption in transit, access controls, and database-level Row Level Security designed to isolate each user's data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to notify you and regulators of incidents where the law requires.

We and our service providers may process personal data in countries other than your own, including the United States. Where we transfer data out of the European Economic Area or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may contact us for more information about these safeguards.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with your local data protection authority.

You can delete your account and all of its data yourself at any time in the app under Settings → Plan & usage → Delete account, with one exception: if you tell us why you are leaving, we keep that note (with any email addresses removed, at most 200 characters) in our server-side audit log alongside the record of the deletion, so we can learn from it. The reason you pick from the list is sent to our analytics provider without your identity; the note itself is never sent. You can also access and edit much of your data directly in your account settings. To exercise any other right, or if you cannot access your account, email support@tryresumi.com. We will respond within the timeframe required by law and will not discriminate against you for exercising your rights.

If you are a California resident, the California Consumer Privacy Act, as amended, gives you specific rights. In the past 12 months we have collected the categories of personal information described in Information we collect (identifiers, customer records, commercial/billing information, internet activity, and the professional information in your resumes and job tracker), for the purposes described in this policy.

• Right to know the categories and specific pieces of personal information we collect, use, and disclose.
• Right to delete personal information we hold.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information. The Google Ads cookies on our website (see Cookies and similar technologies) may count as "sharing" for cross-context behavioral advertising under the CCPA/CPRA. You can opt out by blocking those cookies in your browser or turning off personalized ads in My Ad Center. We do not use or disclose sensitive personal information beyond the purposes permitted by law.
• Right to non-discrimination for exercising your rights.

To make a request, email support@tryresumi.com, or exercise the right to delete directly in the app under Settings → Plan & usage → Delete account. We will verify your request as required by law, and you may use an authorized agent.

The Service is not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact support@tryresumi.com and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Please review it periodically.

For any privacy question or request — and for general support — email support@tryresumi.com. We aim to respond within a few business days.