Privacy Policy

• We collect your email, uploaded resumes, and job descriptions you analyze.
• We use this only to provide the service to you. Not for ads. Not for AI training.
• We share data only with providers we use to run the service.
• You can delete your account and all data anytime from Account settings.
• EU users have full GDPR rights. Indian users have full DPDP Act rights.

Account information: Your email address and authentication identifier from our auth provider (Clerk). If you sign in with Google, we receive your name and profile picture from Google.

Content you provide: Resumes (as text extracted from PDFs you upload), job descriptions you paste, and any AI-generated analyses, rewrites, cover letters, ATS scans, and interview prep we produce for you.

Payment information: If you buy credits, Stripe handles card data — we never see or store it. We only receive payment confirmation and the credits-purchased amount.

Usage and technical data: Server logs (IP address, browser type, request paths), audit logs of sensitive actions, and error reports.

Cookies: Essential cookies only — see Cookie Policy.

We use your data exclusively to:

• Provide the ResumeAI service (run AI analyses, generate cover letters, etc.)
• Process payments and grant credits
• Show your history of past analyses
• Send transactional emails (sign-up confirmation, payment receipts, account changes)
• Detect and prevent abuse (rate limiting, security monitoring)
• Improve the service through aggregated, anonymized analytics
• Comply with legal obligations

If you're in the European Economic Area, UK, or Switzerland, we process your personal data under these lawful bases:

• Contract performance: processing necessary to provide the service you signed up for (analyses, payments, etc.)
• Legitimate interests: security monitoring, abuse prevention, audit logs
• Legal obligation: payment records retained for tax compliance
• Consent: for any optional marketing communications (we ask before sending)

We share the minimum data needed with these service providers (sub-processors):

We don't share with advertisers, data brokers, or anyone not listed. We disclose data only if legally required (court order, subpoena) — and notify you unless legally prohibited.

ResumeAI is operated from India, but most of our infrastructure providers are based in the United States. This means your data is transferred internationally.

For EU/UK users: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection for data transferred to the US. Our key processors (Clerk, Supabase, Stripe, Vercel) have published SCCs and are GDPR-compliant.

For Indian users: Under the DPDP Act 2023, cross-border transfers to non-restricted countries are permitted. We monitor government notifications for any restrictions.

Your data is stored in Supabase (PostgreSQL) on AWS infrastructure, primarily in US East (Virginia). Backups are encrypted and retained for 7 days.

Security measures we have in place:

• HTTPS/TLS encryption for all data in transit
• Encryption at rest for database and backups
• Strict content security policies (CSP) and origin restrictions
• Rate limiting on all API endpoints
• Audit logging of sensitive actions
• Regular dependency updates and security patches
• HSTS enforcement (HTTPS-only)

If you discover a security issue, please email security@resumeai.blog. We commit to acknowledging valid reports within 48 hours.

• Active accounts: for as long as your account is active
• Deleted accounts: all personal data deleted within 24 hours; anonymized audit logs retained for 90 days for fraud prevention
• Payment records: retained for 7 years (tax compliance — applies in both India and most jurisdictions)
• Server logs: 30 days, then automatically purged
• Error reports (Sentry): 30 days
• Rate limit data (Upstash): 1 hour rolling window

You have the right to:

• Access your data — export available from Account settings
• Correct inaccurate data — update via Account settings
• Delete your data — self-serve via Account settings
• Restrict processing in specific circumstances
• Object to processing where based on legitimate interests
• Portability — receive your data in a machine-readable format (JSON export)
• Withdraw consent to any communications
• Lodge a complaint with your local data protection authority

To exercise these rights, email privacy@resumeai.blog. We'll respond within 30 days as required by law.

If you're in India, you have specific rights under the Digital Personal Data Protection Act 2023:

• Right to information about personal data processing
• Right to correction and erasure of inaccurate data
• Right to nominate a person to exercise rights in case of death or incapacity
• Right to grievance redressal — contact our designated person (see below)

If unsatisfied with our response, you may contact the Data Protection Board of India once notified by the government.

ResumeAI is not intended for users under 18. We do not knowingly collect personal data from children. If we learn we've collected data from a child under 18, we'll delete it.

In India, under the DPDP Act, individuals under 18 are considered children, and we require verifiable parental consent for processing their data — which we currently do not facilitate. If you're under 18, please do not use ResumeAI.

If you believe we have collected data from a child, contact privacy@resumeai.blog.

When you submit a resume or job description, the text is sent to our AI provider (Groq) for processing. Key facts:

• Groq processes your text transiently — they do not retain it after the API response
• Groq does not use this data to train AI models per their published policy
• We do not modify, save copies of, or share AI inputs with anyone other than Groq
• AI-generated outputs (analyses, cover letters, etc.) are saved to your account so you can review them later
• AI outputs may contain inaccuracies — always review before using in real applications

For full details on Groq's data handling, see Groq's privacy policy.

If we make material changes to this policy, we'll notify you via email (if you have an account) and update the "Last updated" date at the top. Continued use after material changes constitutes acceptance.

For non-material changes (typo fixes, link updates, etc.), we may update without notice.

For privacy questions, complaints, data requests, or anything related to this policy:

We respond to all valid requests within 30 days.