Privacy Policy

a. Information you provide directly

• Account information: Your email address and password when you sign up.
• Resume content: Work history, education, skills, personal summary, and any other information you enter into your resume.
• Uploaded files: Resume files (PDF, DOCX) you upload for parsing.
• Payment information: Handled entirely by Stripe. We receive only limited, non-sensitive billing details (e.g., last four digits of your card, billing country). We never store full card numbers.
• Communications: Messages you send to our support team.
• Interview Sprint coaching data: If you purchase our Interview Sprint coaching service, we collect your target role, target company, interview date, notes for your coach, which resume you'd like reviewed, and any messages you exchange with your assigned coach.

b. Information collected automatically

• Usage data: Pages visited, features used, clicks, session duration, and similar analytics collected via PostHog.
• Device and browser data: IP address, browser type, operating system, and referring URL.
• Cookies and local storage: Used for authentication sessions, preferences, and analytics. See Section 7 for details.

We use the information we collect to:

• Provide, operate, and improve the Service.
• Authenticate your account and keep it secure.
• Process payments and manage your subscription.
• Generate AI-assisted resume suggestions and tailoring on your behalf.
• Send transactional emails (e.g., email confirmation, password reset).
• Respond to your support requests.
• Match you with a coach and deliver the Interview Sprint coaching service, including scheduling and sharing your file with your assigned coach.
• Analyze usage trends to improve the Service.
• Comply with legal obligations.

We do not sell your personal data to third parties, and we do not use your resume content to train AI models without your explicit consent.

We share your information only in the following limited circumstances:

• Service providers: Trusted third parties who help us deliver the Service (see Section 4). They are contractually obligated to handle your data securely and only for the purposes we specify.
• Assigned coaches: If you purchase our Interview Sprint service, your resume, brief, and messages are shared with the coach assigned to work with you, solely so they can deliver the service.
• Legal requirements: When required by law, court order, or government authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
• With your consent: For any other purpose with your explicit permission.

Each provider's use of your data is governed by their own privacy policies. We recommend reviewing them directly.

If you purchase our Interview Sprint coaching service, live sessions take place over a third-party video conferencing tool chosen by your coach (for example Zoom or Google Meet) and may be recorded for your own review. We do not permanently host these recordings ourselves; any links are shared with you directly by your coach.

Our optional Chrome extension fills job application forms using the resume data already in your account. Installing it is your choice, and everything else works without it.

• Where it runs: only on ResumeStart and on the job application sites it supports (for example Greenhouse, Lever, Ashby, Workday, iCIMS, Taleo, SmartRecruiters, Workable and similar applicant tracking systems). It does not run on other websites and does not read your browsing history.
• What it reads: when you click to fill a form, it reads that page's form fields — their labels and types — so it can match them to your resume data. It does not scan pages you have not asked it to fill.
• What it sends us: the field labels it could not match directly, along with the resume content needed to answer them, so our AI providers can suggest values. It also records that an autofill happened, so we can apply your plan's usage limit.
• What it stores on your device: only your account access token and the API address, in the browser's extension storage. No resume data or usage counts are kept locally.
• Revoking access: generate a new extension token from your account settings at any time — this immediately invalidates the previous one. Uninstalling the extension removes its local storage.

We retain your account data and resume content for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance reasons.

Aggregated, anonymised analytics data may be retained indefinitely as it cannot reasonably be used to identify you.

Interview Sprint booking details, coaching notes, and coach messages are retained for as long as needed to deliver the service and for standard business and financial record-keeping, and are deleted or anonymised on the same basis as other account data described above.

We use cookies and similar technologies for:

• Authentication: Keeping you logged in securely between sessions.
• Preferences: Remembering your editor settings and UI preferences.
• Analytics: Understanding how users interact with the Service via PostHog (privacy-friendly, data is not sold to advertisers).

For a full list of cookies we set, their purpose, duration, and opt-out instructions, see our Cookie Policy. You can control cookies through your browser settings. Disabling authentication cookies will prevent login and session management from working.

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest via Supabase and AWS, row-level security policies on our database, and access controls limiting who can view your data. However, no system is completely secure and we cannot guarantee absolute security.

Depending on where you live, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate data.
• Deletion: Request deletion of your personal data (right to be forgotten).
• Portability: Receive your data in a structured, machine-readable format.
• Objection / restriction: Object to or restrict certain types of processing.
• Withdraw consent: Where processing is based on consent, withdraw it at any time. For analytics and the advertising pixel you can do this yourself, in one click, using the control in our Cookie Policy— no need to email us.

To exercise any of these rights, email us at hello@resumestart.ai. We will respond within 30 days. You can also delete your account directly from your account settings, which will initiate data deletion.

California residents. We do not sell your personal information for money. We do run the Meta (Facebook) Pixel to measure our advertising, which sends page views and your IP address to Meta — under the CCPA that may count as “sharing” for cross-context behavioural advertising, so we are telling you plainly rather than claiming otherwise. To opt out, decline analytics on the consent prompt, which stops the pixel loading; you can also block third-party scripts in your browser. You may exercise the access, deletion, and correction rights above at any time, and we will not discriminate against you for doing so.

If you are in the UK or the European Economic Area, we rely on the following legal bases under the GDPR. Where we rely on consent, you can withdraw it at any time.

The Service is intended for people aged 16 and over and is not directed to children. We do not knowingly collect personal information from anyone under 16. We set the threshold at 16 rather than 13 because several EU member states set the age of digital consent at 16 under the GDPR, and a single higher minimum means we do not need to collect dates of birth from everyone in order to apply a lower one.

If you believe someone under 16 has provided us with personal data, contact us at hello@resumestart.ai and we will close the account and delete the data promptly.

We are based in and our data is processed primarily in the United States. If you access the Service from outside the US, your information may be transferred to, stored, and processed in the US or other countries where our service providers operate. By using the Service, you consent to these transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or by email. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests related to this Privacy Policy, please contact us at: