This policy explains what information ResumAI collects, how we use it, who we share it with, and the choices you have.
01
ResumAI ("ResumAI," "we," "us," or "our") operates an AI-powered resume optimization platform accessible via our website and related services (collectively, the "Service"). This Privacy Policy is intended to inform you — whether you are a visitor, registered user, or paying customer — of the nature, scope, and purpose of the personal data we collect and process in connection with your use of the Service. It is intended to comply with applicable privacy laws including, but not limited to, the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable state and federal data protection legislation.
By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please discontinue use of the Service immediately. This Privacy Policy applies to all users of ResumAI regardless of how they access the Service — including via desktop browser, mobile browser, or any other interface through which the Service may be made available.
This Privacy Policy should be read in conjunction with our Terms of Service, which is incorporated by reference. Capitalized terms not defined herein shall have the meanings ascribed to them in the Terms of Service. We may update this Privacy Policy from time to time. We will notify users of any material changes via email or prominent notice within the Service prior to the change taking effect. Your continued use of the Service following any update constitutes your acceptance of the revised policy.
We are committed to handling personal information with integrity, transparency, and care. We collect only what is necessary to deliver and improve the Service, and we do not sell your personal data to third-party advertisers or data brokers. Any sharing of data that does occur is limited, purposeful, and disclosed in this policy.
02
We collect information in several ways: directly from you when you provide it, automatically when you use the Service, and from third-party services that we integrate with. The categories of information we collect are described below.
2.1 Account and Registration Information
When you create an account with ResumAI, we collect the email address you use to register and any display name or profile information you choose to provide. We use Supabase, a third-party authentication and database platform, to manage user accounts. Your credentials are stored and managed by Supabase in accordance with their own privacy and security practices. We do not store your password in plaintext. Authentication tokens and session data are managed securely through Supabase's infrastructure.
2.2 Resume and Career Content
The core function of our Service involves collecting and processing your resume and related career content. This includes: (a) the original document files you upload, which may be in PDF, Microsoft Word (.docx or .doc), plain text (.txt), rich text format (.rtf), or image format (PNG, JPG/JPEG, WEBP, GIF, BMP, TIFF, HEIC, or HEIF); (b) the text content extracted from those files by our document processing systems; (c) structured resume data parsed from that text content, including your work history, job titles, employer names, employment dates, job responsibilities, educational background, degrees earned, certifications, skills, and contact information such as your name, email address, phone number, and location; (d) AI-generated and AI-tailored versions of your resume produced by the Service; and (e) all completed and saved resume versions stored in your account history.
2.3 Job Targeting and Application Information
When you use the Service to tailor your resume to a specific job opportunity, we collect the job description you provide, the target job title, the name of the employer you are applying to, and any additional context about the role that you choose to include. This information is used exclusively to generate a tailored resume for that specific application. It is not used for advertising, profiling, or sold to third parties.
2.4 Payment and Transaction Information
All payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 compliant payment processor. We do not collect, store, or transmit your payment card number, card verification value (CVV), bank account details, or any other sensitive financial information. Upon completion of a transaction, Stripe provides us with a confirmation of the transaction including the amount charged, the date of the transaction, a description of the service purchased, and a customer and charge identifier used for support and reconciliation purposes. We retain this transaction metadata as part of your account record.
2.5 Technical and Usage Data
When you access and use the Service, our servers automatically collect certain technical information. This includes your IP address, which we use for security purposes and approximate geographic location; your browser type and version; the type of device you are using to access the Service; the operating system you are running; the pages or features of the Service you access and in what sequence; the timestamps of your visits and interactions; session identifiers used to maintain your authenticated session; error logs and diagnostic information generated in the event of a malfunction or failure; and referral URLs if you arrived at the Service from a link on another website. This data is used for security, fraud prevention, technical troubleshooting, and understanding aggregate usage patterns.
03
We process personal data only for specific, legitimate purposes that are disclosed in this policy. We use the information we collect in the following ways: to create, authenticate, and manage your account and maintain your session across visits; to receive and process uploaded resume files, extract their textual content using document processing tools, and convert that content into structured resume data; to transmit your resume content and job targeting information to AI services for the purposes of parsing, improving, and tailoring your resume to the job description you provide; to generate a professionally formatted Microsoft Word document containing your tailored resume and make it available for download; to store your completed resumes in your account so you can access, review, and re-download them in the future; to process payments made for our paid services and maintain records of completed transactions; to send you transactional emails relating to your account, including account creation confirmations, password reset instructions, and purchase confirmations; to detect, investigate, and prevent fraudulent activity, unauthorized access, and other harmful conduct; to respond to your support inquiries and resolve disputes; to maintain the security, integrity, and availability of the Service; to analyze aggregate, de-identified usage patterns in order to understand how the Service is used and to improve its features and performance; and to comply with our legal obligations.
We do not use your resume content or job application information for the purpose of targeted advertising. We do not sell your personal data to data brokers, advertisers, or any third party for their own marketing purposes. Where we share data with third-party service providers, it is solely to enable them to perform services on our behalf and subject to data processing agreements that restrict their use of your data.
The legal bases on which we rely to process your personal data (where applicable under the GDPR) are: performance of a contract with you (processing necessary to provide the Service you have signed up for); legitimate interests (security, fraud prevention, service improvement, and aggregate analytics); compliance with legal obligations; and, where applicable, your explicit consent (such as for the optional candidate matching feature described in Section 5).
04
The core functionality of ResumAI is powered by large language models and AI vision systems provided by OpenAI and Anthropic. Your resume content — including the full text of your uploaded document, structured data extracted from that document, and the job description you provide — is transmitted to the APIs of these third-party AI providers in order to perform the following operations: (a) resume parsing, which involves extracting structured data from your uploaded document and organizing it into fields including employment history, education, skills, contact information, certifications, and other resume sections; (b) content improvement, which involves rephrasing, strengthening, and professionalizing the bullet points and descriptions in your resume while preserving their factual accuracy; and (c) job-targeted tailoring, which involves rewriting and optimizing your resume content to align with the specific role, language, and requirements described in the job description you provide.
Our AI systems are designed and prompted with explicit instructions to preserve the factual accuracy of your resume. The AI may improve the phrasing, specificity, and impact of your existing content, but it is instructed not to fabricate credentials, invent job titles, create employers that do not appear in your resume, or claim experience or qualifications you have not disclosed. Despite these design constraints, AI systems are probabilistic in nature and can produce unexpected, inaccurate, or misleading outputs. We cannot guarantee that AI-generated content will be factually accurate, grammatically perfect, or appropriate for every employer or context.
You bear full responsibility for reviewing all AI-generated resume content before submitting it to any employer or posting it to any job application platform. You should carefully verify that every statement in your AI-generated resume is truthful, accurate, and consistent with your actual background. Submitting a resume containing inaccurate information — whether or not that inaccuracy was introduced by an AI system — is your responsibility. ResumAI disclaims all liability for consequences arising from inaccurate, misleading, or inappropriate content in AI-generated resumes that you choose to submit.
OpenAI and Anthropic may retain data submitted to their APIs in accordance with their own data use and retention policies. We encourage you to review OpenAI's Privacy Policy and Anthropic's Privacy Policy to understand how those companies handle data submitted through their APIs. We do not control and are not responsible for how OpenAI and Anthropic use or store data transmitted to their services.
05
ResumAI offers an optional candidate matching feature that allows users who affirmatively opt in to have their resume profile made available to vetted third-party recruiters and hiring organizations who are actively searching for candidates matching specific professional profiles. This feature is designed to help qualified candidates discover relevant job opportunities that they may not have found on their own and to help recruiters efficiently identify candidates who match their open roles.
This feature is strictly opt-in. We will never share your resume or profile with recruiters unless you explicitly enable this feature through your account settings. This feature is not enabled by default. When you enable candidate matching, you are granting ResumAI a limited, revocable license to make your anonymized or identified profile — which may include your professional summary, work history, job titles, education, skills, certifications, and target role preferences — available to recruiters who have registered with ResumAI's recruiter platform and agreed to our recruiter terms of service, which impose restrictions on how they may use candidate information.
Recruiters who access your profile through the candidate matching service are permitted to view your professional background for the purpose of evaluating whether your profile is a fit for a specific open role. They may contact you through the ResumAI messaging interface or, if you have chosen to make your contact information visible, through the contact details you provide. Recruiters agree, as a condition of accessing the recruiter platform, that they are prohibited from using your resume data for any purpose other than candidate evaluation, from selling or transferring your data to additional third parties, and from retaining your data beyond the period permitted under their agreement with ResumAI.
ResumAI may charge recruiters a fee for access to the candidate matching platform or for each successful connection made between a recruiter and a candidate. This commercial arrangement does not change the nature of the data sharing — it remains a consented, purposeful matching service, not a sale of personal data in the sense contemplated by the CCPA or GDPR.
You may disable the candidate matching feature at any time by accessing your account settings. Upon disabling the feature, your profile will be removed from the recruiter-facing platform within a commercially reasonable time period. Disabling this feature does not automatically cause recruiters who have already viewed your profile or initiated contact with you to delete your information from their own systems — you should contact them directly if you wish to request deletion of data they have already received.
06
We engage a limited number of third-party service providers to help us operate and deliver the Service. Each provider receives only the minimum data necessary to perform their specific function. We have data processing agreements or equivalent contractual protections in place with each provider. The third-party providers we currently use are as follows.
Supabase
Supabase is our authentication and database provider. Your account credentials, session tokens, account metadata, and saved resume data are stored in Supabase's infrastructure. Supabase is hosted on AWS and implements encryption at rest and in transit. Their privacy policy is available at supabase.com/privacy.
Stripe, Inc.
Stripe is our payment processor. All payment card data is collected, transmitted, and stored exclusively by Stripe. We receive only non-sensitive transaction metadata from Stripe. Stripe is PCI-DSS Level 1 certified. Their privacy policy is available at stripe.com/privacy.
OpenAI, LLC
OpenAI provides the large language model APIs we use for resume parsing, content improvement, and job-targeted tailoring. Resume text and job descriptions are transmitted to OpenAI's API endpoints for processing. OpenAI's privacy policy and API data use policy are available at openai.com/policies.
Anthropic, PBC
Anthropic provides the Claude AI models we use for vision-based document understanding, particularly for processing uploaded resume images and PDFs. Resume files may be transmitted to Anthropic's API for visual processing. Anthropic's privacy policy is available at anthropic.com/privacy.
Cloud Infrastructure Providers
ResumAI's application is hosted on cloud infrastructure. Infrastructure providers process data incidentally as part of serving the application to users. All data in transit is encrypted via HTTPS/TLS. Infrastructure providers are bound by their own privacy policies and security certifications.
07
We do not sell your personal data to third parties. We do not share your personal data with advertisers. We share personal data only in the following limited circumstances: (a) with third-party service providers who process data on our behalf as described in Section 6, subject to data processing agreements that restrict their use of your data to performing services for us; (b) with recruiters through the candidate matching service described in Section 5, but only if you have explicitly opted in to that feature; (c) with law enforcement agencies, courts, regulators, or other government authorities if we are legally required to do so by applicable law or in response to a valid legal process such as a subpoena, court order, or search warrant; (d) to protect the rights, property, or safety of ResumAI, our users, or the public, including for the prevention of fraud or other harmful conduct; (e) in connection with a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, in which case your personal data may be transferred to the successor entity, subject to the same protections described in this policy; or (f) with your explicit consent for any purpose not described in this policy.
We may share aggregated or anonymized data that cannot reasonably be used to identify you with third parties for research, analytics, or product improvement purposes. Such aggregated data is not personal data and is not subject to the restrictions in this policy.
09
We retain your personal data for as long as your account is active or as necessary to provide the Service to you. Your account data, saved resumes, and associated records remain in our systems until you delete them or request account deletion. You may delete individual saved resumes from your account dashboard at any time. Deleting a resume removes it from your visible account history and from active storage, though residual copies may persist in backup systems for a limited period following deletion before being overwritten in the ordinary course of our backup rotation.
If you wish to have your entire account and all associated personal data permanently deleted, you may submit a deletion request by emailing us at support@resumai.com. We will process verified deletion requests within a commercially reasonable time, not to exceed 30 days. Following deletion, we may retain certain minimal records — such as transaction records required for tax or accounting compliance, or records of prior agreements — for the periods required by applicable law, even if your account is otherwise deleted.
We may retain de-identified or aggregated data derived from your account for product improvement, AI quality analysis, and research purposes. Such retained data will not be attributable to you individually and will not be used in a manner that could reasonably identify you.
10
We implement reasonable and industry-appropriate technical and organizational measures designed to protect the personal data we process from unauthorized access, disclosure, alteration, destruction, and loss. These measures include: encryption of all data in transit using HTTPS/TLS protocols; authentication and session management handled by Supabase's secure infrastructure; payment data handled entirely within Stripe's PCI-DSS Level 1 certified environment; access to production systems and databases restricted to authorized personnel with a legitimate operational need; and monitoring for unauthorized access attempts and anomalous activity.
Despite these measures, no system or method of transmission over the internet can be guaranteed to be completely secure. We cannot guarantee the absolute security of your data. In the event of a security breach that we determine is reasonably likely to result in a risk to your rights or freedoms, we will notify affected users and, where required by applicable law, the relevant supervisory authorities, in accordance with our legal obligations and within the required timeframes.
If you believe that your account has been compromised, that you have identified a security vulnerability in the Service, or that your personal data has been accessed or disclosed without authorization, please contact us immediately at support@resumai.com.
11
ResumAI is operated from the United States. If you are accessing the Service from outside the United States — including from the European Economic Area, the United Kingdom, or other jurisdictions with data protection laws that may differ from those of the United States — please be aware that your personal data will be transferred to, stored, and processed in the United States and potentially in other countries where our third-party service providers operate.
By using the Service, you consent to the transfer of your personal data to the United States and other jurisdictions as described in this policy. Where required by applicable law, we implement appropriate safeguards for such transfers, including standard contractual clauses approved by the relevant supervisory authority. You may contact us to request information about the specific safeguards we have in place for international data transfers.
12
Depending on where you are located and the applicable data protection laws of your jurisdiction, you may have certain rights with respect to the personal data we hold about you. These rights may include: the right to access the personal data we hold about you and to receive a copy of that data in a structured, machine-readable format; the right to rectify or correct personal data that is inaccurate or incomplete; the right to erasure ("right to be forgotten") of your personal data, subject to certain legal exceptions; the right to restriction of processing of your personal data in certain circumstances; the right to data portability, allowing you to receive your data in a portable format and transmit it to another controller; the right to object to certain processing activities, including processing based on legitimate interests; and the right to withdraw consent at any time where processing is based on your consent, without affecting the lawfulness of processing that occurred prior to withdrawal.
To exercise any of these rights, please submit a request by email to support@resumai.com. We will respond to your request within a reasonable timeframe and in any event within the period required by applicable law. We may ask you to verify your identity before fulfilling your request. We will not discriminate against you for exercising your privacy rights.
If you believe we have not handled your personal data in compliance with applicable law, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.
13
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) may grant you additional rights. Under the CCPA/CPRA, California residents have the right to know what personal information we collect, use, disclose, and sell; the right to delete personal information we have collected, subject to certain exceptions; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right to non-discrimination for exercising these rights.
We do not sell personal information as defined under the CCPA/CPRA to third-party advertisers or data brokers. The candidate matching feature described in Section 5 — through which we may share your resume profile with recruiters — is not a "sale" under the CCPA/CPRA because it is performed with your explicit consent, for your direct benefit, and subject to contractual restrictions on the recruiter's use of your data. You may, however, opt out of this feature at any time through your account settings.
To submit a request to know, delete, or correct your personal information, or to opt out of any data sharing, please contact us at support@resumai.com. You may authorize an agent to submit requests on your behalf, provided you furnish appropriate written authorization and we are able to verify your identity.
14
ResumAI is not directed to and is not intended for use by individuals under the age of 13. We do not knowingly collect, use, or disclose personal information from children under the age of 13. If we become aware that we have inadvertently collected personal information from a child under the age of 13, we will take prompt steps to delete that information from our systems. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at support@resumai.com and we will take appropriate action.
15
We reserve the right to update or modify this Privacy Policy at any time and at our sole discretion. We will notify you of any material changes by sending an email to the address associated with your account and/or by posting a prominent notice within the Service prior to the change becoming effective. The "Effective date" at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically to stay informed about how we are protecting your information.
Your continued use of the Service following the posting of any changes to this Privacy Policy constitutes your acceptance of those changes. If you do not agree to the revised policy, you must discontinue use of the Service and may request deletion of your account and associated data as described in Section 9.
16
If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise any of your rights described in this policy, please contact us by email. We will make reasonable efforts to address your inquiry promptly and in accordance with applicable law.
Privacy inquiries
support@resumai.com