Privacy Policy

a. Information you provide directly

• Account information: Your email address and password when you sign up.
• Resume content: Work history, education, skills, personal summary, and any other information you enter into your resume.
• Uploaded files: Resume files (PDF, DOCX) you upload for parsing.
• Payment information: Handled entirely by Stripe. We receive only limited, non-sensitive billing details (e.g., last four digits of your card, billing country). We never store full card numbers.
• Communications: Messages you send to our support team.

b. Information collected automatically

• Usage data: Pages visited, features used, clicks, session duration, and similar analytics collected via PostHog.
• Device and browser data: IP address, browser type, operating system, and referring URL.
• Cookies and local storage: Used for authentication sessions, preferences, and analytics. See Section 6 for details.

We use the information we collect to:

• Provide, operate, and improve the Service.
• Authenticate your account and keep it secure.
• Process payments and manage your subscription.
• Generate AI-assisted resume suggestions and tailoring on your behalf.
• Send transactional emails (e.g., email confirmation, password reset).
• Respond to your support requests.
• Analyze usage trends to improve the Service.
• Comply with legal obligations.

We do not sell your personal data to third parties, and we do not use your resume content to train AI models without your explicit consent.

We share your information only in the following limited circumstances:

• Service providers: Trusted third parties who help us deliver the Service (see Section 4). They are contractually obligated to handle your data securely and only for the purposes we specify.
• Legal requirements: When required by law, court order, or government authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
• With your consent: For any other purpose with your explicit permission.

Each provider's use of your data is governed by their own privacy policies. We recommend reviewing them directly.

We retain your account data and resume content for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance reasons.

Aggregated, anonymised analytics data may be retained indefinitely as it cannot reasonably be used to identify you.

We use cookies and similar technologies for:

• Authentication: Keeping you logged in securely between sessions.
• Preferences: Remembering your editor settings and UI preferences.
• Analytics: Understanding how users interact with the Service via PostHog (privacy-friendly, data is not sold to advertisers).

For a full list of cookies we set, their purpose, duration, and opt-out instructions, see our Cookie Policy. You can control cookies through your browser settings. Disabling authentication cookies will prevent login and session management from working.

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest via Supabase and AWS, row-level security policies on our database, and access controls limiting who can view your data. However, no system is completely secure and we cannot guarantee absolute security.

Depending on where you live, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate data.
• Deletion: Request deletion of your personal data (right to be forgotten).
• Portability: Receive your data in a structured, machine-readable format.
• Objection / restriction: Object to or restrict certain types of processing.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at hello@resumestart.ai. We will respond within 30 days. You can also delete your account directly from your account settings, which will initiate data deletion.

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We are based in and our data is processed primarily in the United States. If you access the Service from outside the US, your information may be transferred to, stored, and processed in the US or other countries where our service providers operate. By using the Service, you consent to these transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or by email. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests related to this Privacy Policy, please contact us at: