1. What we process
We process the data you actively provide to build your documents: resume content (name, contact details, work history, education, skills, projects, certifications, photo if you add one), files you import for extraction, and minimal account data (email, hashed password).
Processing is conducted in compliance with the Digital Personal Data Protection Act, 2023, in particular Section 4 (lawful grounds), Section 6 (consent), Section 7 (certain legitimate uses), and Section 8 (obligations of Data Fiduciaries).
2. How we process it
Resume content is stored in our database so you can edit it across sessions, and rendered server side to produce your PDF and DOCX exports.
Imported files (PDF, DOCX, TXT, RTF) are parsed to extract text into the editor and are not retained as files after extraction.
AI features run only when you trigger them: the relevant resume text is sent to the configured AI provider to generate output, and the request is logged for operation and security.
3. Data retention
- Resumes and account data: retained while your account exists, deleted immediately and permanently when you delete your account from Settings.
- Imported files: processed in memory for extraction, not retained as files.
- AI request logs: retained for operation and security, deleted with your account.
- Security logs: kept only as long as needed for security and legal compliance.
- Guest sessions: tied to your browser session cookie (7 days), with the same self-serve deletion rights.
4. Subprocessors
We use the minimum set of subprocessors needed to run the service:
- Hosting and database infrastructure, to run the application and store data encrypted in transit.
- AI provider (OpenRouter), only for AI features you actively trigger.
- Google Analytics, only if you accept analytics cookies, with IP anonymization enabled.
- We do not sell personal data and we do not share it with advertisers or data brokers.
5. Your responsibilities as a user
If your documents contain personal data of other people (for example referee names and contact details), you are the Data Fiduciary for that data and we act as your Processor. You are responsible for:
- Having consent or another lawful basis to include that data.
- Complying with the privacy laws that apply in your jurisdiction.
- Not using the service for unlawful discrimination, harassment, or surveillance.
6. Contact
Questions about this agreement or our processing: contact our Grievance Officer at privacy@resumeux.com.