Privacy Policy

Introduction

Welcome to resum8 ("we," "our," or "us"). We are committed to protecting your privacy and handling your personal information with care and transparency. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our AI-powered CV tailoring service.

By using resum8, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our service.

1. Information We Collect

1.1 Account Information

When you create an account with resum8, we collect:

• Email address (used for authentication and communication)
• Name (optional, for personalizing your CVs)
• Password (encrypted and securely stored)
• Account preferences and settings

1.2 CV and Career Information

To provide our CV tailoring service, we collect and process:

• Work experience and employment history
• Educational background and qualifications
• Skills and competencies
• Personal achievements and certifications
• Professional summary and objective statements
• Contact information you choose to include in your CV

1.3 Job Application Data

When you use our job scanning and CV tailoring features, we collect:

• Job posting URLs and descriptions you submit for analysis
• Job titles and company names from scanned positions
• Tailored CV versions generated for specific applications
• Interview preparation questions and responses
• Application tracking information and timestamps

1.4 Usage Data

We automatically collect information about how you interact with our service:

• Feature usage patterns (scans, generations, exports)
• Login timestamps and session duration
• CV creation and editing activity
• Browser type, version, and operating system
• IP address and general location (country/region level)
• Device information (type, screen resolution)
• Pages visited and time spent on each page

1.5 Payment Information

When you purchase a subscription:

• Payment method details are collected and processed by Stripe (our payment processor)
• We do NOT store your credit card numbers, CVV codes, or full payment details
• We receive and store: transaction IDs, subscription status, billing history, and invoice records

1.6 Communication Data

When you contact our support team:

• Support ticket content and correspondence
• Feedback and feature requests you submit
• Email communications with our team

2. How We Use Your Information

2.1 Service Provision

We use your information to:

• Create, store, and manage your account
• Generate AI-tailored CVs based on job postings you submit
• Analyze job descriptions to optimize your CV content
• Provide interview preparation questions and guidance
• Export your CVs in DOCX format
• Track your job application history and materials
• Enable regeneration and editing of your CVs (paid tiers)

2.2 Payment Processing and Account Management

We use your information to:

• Process subscription payments via Stripe
• Manage your subscription tier and feature access
• Enforce usage limits (24-hour cooldowns for free tier)
• Send payment confirmations and receipts
• Handle refund requests and billing inquiries

2.3 Communication

We use your contact information to:

• Send transactional emails (account verification, password resets, payment confirmations)
• Notify you of important service updates or changes
• Respond to support requests and inquiries
• Send marketing communications (only with your consent, opt-out available)

2.4 Product Improvement and Analytics

We use aggregated and anonymized data to:

• Analyze usage patterns and feature popularity
• Improve our AI models and CV generation quality
• Optimize user experience and interface design
• Develop new features and enhancements
• Conduct security and fraud prevention analysis

2.5 Legal Compliance and Security

We may use your information to:

• Comply with legal obligations and regulatory requirements
• Enforce our Terms of Service and detect violations
• Prevent fraud, abuse, and unauthorized access
• Protect the rights, property, and safety of resum8, our users, and others

3. Legal Basis for Processing (UK GDPR)

For users in the United Kingdom, European Economic Area (EEA), and Switzerland, we process your personal data under the following legal bases:

3.1 Contractual Necessity

Processing is necessary to perform our contract with you, including:

• Providing CV tailoring and job scanning services
• Managing your account and subscription
• Delivering customer support

3.2 Consent

We process certain data based on your explicit consent:

• Marketing communications (you can withdraw consent anytime)
• Optional profile enhancements and preferences
• Cookie usage beyond essential cookies

3.3 Legitimate Interests

We process data for legitimate business interests that don't override your rights:

• Analytics and product improvement
• Security and fraud prevention
• Network and information security
• Internal research and development

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We only share your data in the following circumstances:

4.1 Third-Party Service Providers

We share data with trusted service providers who help us operate our business:

4.2 Business Transfers

If resum8 is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website before your personal information is transferred and becomes subject to a different privacy policy.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, legal requests)
• Requests from government authorities
• Situations involving potential violations of our Terms of Service
• Circumstances necessary to protect rights, property, or safety

4.4 Aggregated and Anonymized Data

We may share aggregated, anonymized data that cannot identify you individually:

• Industry research and benchmarking
• Public reporting on service usage trends
• Marketing and promotional materials

5. International Data Transfers

5.1 Data Storage Location

Your data is primarily stored on servers located in the United States through our hosting provider, Supabase. This means your information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate.

5.2 EU-US Data Transfers

For users in the United Kingdom, European Economic Area (EEA), and Switzerland, we ensure that any transfer of your personal data to the United States or other countries complies with applicable data protection laws:

• Standard Contractual Clauses (SCCs): We have Data Processing Agreements in place with all our service providers (Supabase, OpenAI, Stripe, Resend) that incorporate Standard Contractual Clauses approved by the European Commission
• Adequacy Decisions: Where possible, we transfer data to countries recognized as providing adequate protection under UK GDPR
• Additional Safeguards: We implement technical and organizational measures to ensure your data remains protected

5.3 Your Rights Regarding International Transfers

You have the right to:

• Request information about the safeguards we use for international data transfers
• Object to the transfer of your data to certain countries
• Request a copy of the Standard Contractual Clauses we use

Contact us at [email protected] for more information about international data transfers.

6. Data Retention

6.1 Active Accounts

We retain your personal information and CV content for as long as your account is active or as needed to provide you with our services.

6.2 Deleted Accounts

When you delete your account:

• We retain your data for 30 days (grace period to allow for account reactivation)
• After 30 days, your personal information and CV content are permanently deleted from our active systems
• Backups may retain data for up to 90 days after deletion before being purged
• Payment records are retained for 7 years as required by law for tax and accounting purposes

6.3 Specific Retention Periods

• Application logs: 12 months, then automatically deleted
• Payment records: 7 years (required by law for tax and accounting purposes)
• Job postings: 6 months of active storage, then archived (accessible but not actively shown)
• CVs: Stored permanently while your account is active
• Support tickets: 3 years for quality assurance and legal compliance

6.4 Legal Obligations

We may retain certain information longer if required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements, complying with audits).

6A. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website. Cookies are small text files stored on your device that help us provide essential functionality and improve our services.

Types of Cookies We Use

• Strictly Necessary Cookies: Essential for website operation, including authentication and security. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our website (requires your consent, currently not implemented).
• Marketing Cookies: Used for targeted advertising (requires your consent, currently not implemented).

Managing Your Cookie Preferences

You have full control over which cookies we set (except strictly necessary ones). You can manage your preferences at any time:

• Via our Cookie Settings page
• Through the cookie banner that appears on your first visit
• Directly in your browser settings

Detailed Information

For comprehensive information about the specific cookies we use, their purposes, and retention periods, please see our detailed Cookie Policy.

7. Your Rights and Choices

7.1 Access and Portability (Right to Access)

You have the right to access your personal data. You can:

• View all your profile information in your Account Settings
• Download all your data via Account Settings → "Download My Data" (exports to JSON format)
• Request a copy of all information we hold about you

7.2 Rectification (Right to Correct)

You have the right to correct inaccurate or incomplete data. You can:

• Edit your CV content, work history, skills, and education directly in the app
• Update your account information in Account Settings
• Contact support for assistance with corrections

7.3 Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data. You can:

• Delete your account via Account Settings → "Delete Account"
• Request complete removal of your data by contacting [email protected]
• Note: Some information may be retained as legally required (e.g., payment records for 7 years)

7.4 Data Portability

You have the right to receive your data in a structured, commonly used format. You can:

• Export all your data in JSON format via Account Settings
• Request alternative formats (CSV) by contacting support

7.5 Withdraw Consent

For processing based on consent, you have the right to withdraw consent at any time:

• Marketing emails: Unsubscribe via link in any marketing email or in Account Settings → Email Preferences
• Optional features: Disable in Account Settings

7.6 Object to Processing

You have the right to object to certain types of processing:

• Object to marketing communications (opt-out anytime)
• Object to processing based on legitimate interests
• Request restriction of processing in certain circumstances

7.7 Lodge a Complaint

If you're in the UK, EEA, or Switzerland, you have the right to lodge a complaint with your local data protection authority:

• UK: Information Commissioner's Office (ICO) - https://ico.org.uk - Telephone: 0303 123 1113
• EEA: Contact your national Data Protection Authority
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)

7.8 Exercising Your Rights

To exercise any of these rights, contact us at:

• Email: [email protected]
• Response time: Within 30 days of your request
• Verification: We may ask for verification of your identity to protect your privacy

8. Data Security

We implement industry-standard security measures to protect your information:

8.1 Technical Safeguards

• Encryption in transit: All data transmitted between your browser and our servers uses TLS/SSL encryption (HTTPS)
• Encryption at rest: Database encryption for stored data via Supabase
• Secure authentication: Password hashing using industry-standard algorithms
• API security: Secure API key management and access controls

8.2 Administrative Safeguards

• Row-Level Security (RLS): Database policies ensure users can only access their own data
• Access controls: Limited employee access to personal data on a need-to-know basis
• Regular audits: Periodic security reviews and vulnerability assessments
• Incident response: Procedures in place for security breach notification

8.3 Your Responsibilities

• Use a strong, unique password for your account
• Do not share your account credentials
• Log out when using shared devices
• Report any suspicious activity immediately

8.4 Security Limitations

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to maintain and improve our security practices.

10. Children's Privacy

10.1 Age Requirement

resum8 is not intended for children under the age of 18. We do not knowingly collect personal information from anyone under 18 years old.

10.2 Parental Notice

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected], and we will delete such information promptly.

10.3 Verification

We may request verification of age during account creation. Accounts found to belong to users under 18 will be terminated and data deleted.

11. Third-Party Links

Our service may contain links to third-party websites, job boards, or company career pages. We are not responsible for the privacy practices or content of these external sites. We encourage you to read the privacy policies of any third-party sites you visit.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

12.1 Right to Know

You have the right to request information about the categories and specific pieces of personal information we have collected, as well as the categories of sources, purposes, and third parties we share it with.

12.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

12.3 Right to Opt-Out of Sale

We do NOT sell your personal information. We have never sold personal information and do not plan to do so in the future.

12.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

12.5 Exercising CCPA Rights

To exercise your CCPA rights, contact us at [email protected] or use the data download and account deletion features in your Account Settings.

13. Changes to This Privacy Policy

13.1 Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

13.2 Notification of Changes

• Material changes: We will notify you via email at least 30 days before the changes take effect
• Minor changes: We will update the "Last Updated" date at the top of this policy
• Continued use: Your continued use of resum8 after changes become effective constitutes acceptance of the updated policy

13.3 Review Recommendation

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: