RUXResumeUX
Start free

Privacy Policy

This policy explains how ResumeUX handles your personal data. It is written to be consistent with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and widely accepted global privacy principles.

Last updated: June 10, 2026

1. Who we are (Data Fiduciary)

ResumeUX ("we", "us") operates resumeux.com and acts as the Data Fiduciary in respect of personal data processed through the service. For any privacy question or to exercise your rights, contact our Grievance Officer at privacy@resumeux.com.

2. Personal data we process

  • Resume content you enter or import, name, contact details, work history, education, skills, projects, and any other information you choose to include.
  • Uploaded files (PDF/DOCX/TXT/RTF) you import, used only to extract text into the editor.
  • Limited technical data, a session identifier (cookie), and basic logs needed to operate and secure the service.
  • If you contact us, the message and email address you provide.

3. Purposes and legal basis

We process your data to provide the resume builder, analyze ATS compatibility, generate documents you request, and operate and secure the service. Where you actively enter data or upload a file, you provide your consent for that processing; we also rely on legitimate, lawful purposes such as operating and securing the service.

You can use the core builder and export your resume without creating an account.

4. AI processing

Optional AI features (resume writing, ATS suggestions, cover letters, LinkedIn copy, interview prep) send the relevant parts of your resume text to a third-party AI provider to generate output. We do not use your resume content to train our own models, and AI features are off unless you trigger them. If you do not wish to use AI processing, simply do not use those features.

When you use an AI feature we keep a log of the request (the text sent, the output, token counts, and timing) to operate, debug, and secure the feature. These logs are deleted along with everything else when you delete your account.

5. Your rights as a Data Principal

Under the DPDP Act you have the right to:

  • Access, request a summary of the personal data we process about you. Self serve: Settings > Privacy & data > Download my data gives you a complete JSON copy instantly.
  • Correction & completion, ask us to correct or complete inaccurate data. You can edit every field of your resume and account directly in the app.
  • Erasure, delete your personal data at any time. Self serve: Settings > Privacy & data > Delete account permanently erases your account, resumes, reports, and history.
  • Grievance redressal, raise a complaint and have it addressed within statutory timelines.
  • Nomination, nominate another individual to exercise your rights in the event of death or incapacity.
  • Withdraw consent, withdraw consent for processing at any time, with effect for future processing. Analytics consent can be withdrawn from Settings > Privacy & data > Cookie preferences.

6. Data retention

Resumes you create as a guest are tied to your browser session and are retained only as long as needed to provide the service; you may delete a resume at any time. Uploaded files are processed to extract text and are not retained as files after extraction. We retain minimal logs for security and legal compliance.

7. Data security

We apply reasonable technical and organizational safeguards, including access controls and encryption in transit, to protect your data against unauthorized access, alteration, or loss. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Children's data

The service is intended for individuals aged 18 and over. Consistent with the DPDP Act, we do not knowingly process the personal data of children without verifiable parental consent, and we do not undertake tracking or targeted advertising directed at children.

9. Cross-border transfer

Some processing (including AI features and hosting) may occur on servers located outside India. Where we transfer personal data internationally, we do so in accordance with the DPDP Act and applicable restrictions, and we require appropriate safeguards from our processors.

10. Cookies and analytics

Strictly necessary cookies: a session identifier that lets the builder remember your work. These are always on because the service cannot function without them.

Optional analytics: we use Google Analytics to understand aggregate site usage, but ONLY if you accept the consent banner. If you decline, no analytics scripts load and no analytics cookies are set. You can change or withdraw this choice at any time from Settings > Privacy & data > Cookie preferences; withdrawing removes the analytics cookies. IP anonymization is enabled. We do not use advertising cookies.

11. How to exercise your rights

  • Access your data: Settings, Privacy & data, Download my data (instant JSON export, no request needed).
  • Delete your data: Settings, Privacy & data, Delete account (immediate and permanent).
  • Withdraw analytics consent: Settings, Privacy & data, Cookie preferences, or the Cookie preferences link in the footer.
  • Anything else (correction requests, nomination, complaints): email privacy@resumeux.com. We respond within the timelines set by the DPDP Act.

12. Third-party processors

We share data only with the processors needed to run the service, and only for the purposes below:

  • Hosting and infrastructure provider, to run the application and store data.
  • AI provider (OpenRouter), to generate output for AI features you actively trigger. Only the relevant resume text is sent.
  • Google Analytics, only if you have accepted analytics cookies, to measure aggregate site usage with IP anonymization enabled.
  • We do not sell personal data, and we do not share it with advertisers or data brokers.

13. Security event logging

We keep minimal security logs (such as authentication events and abuse signals) to detect and prevent unauthorized access, rate-limit abuse, and investigate incidents. These logs are kept only as long as needed for security and legal compliance.

14. Data breach notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act, without undue delay, including the nature of the breach, the data involved, and the measures taken.

15. Grievance Officer & contact

If you have a complaint about how your personal data is handled, contact our Grievance Officer at privacy@resumeux.com. We will acknowledge and address grievances within the timelines required by the DPDP Act. You also have the right to complain to the Data Protection Board of India.

16. Changes to this policy

We may update this policy as the service or the law evolves. Material changes will be reflected by updating the date at the top of this page.