1. Controller and contact
The controller for ResumeAI at resumeai.cv is Laxmi Narayana Bingi, located at 4223 Windrift dr, 3C, Aurora, IL 60564, United States. Privacy and rights requests may be sent to support@resumeai.cv.
2. Data we collect
- Account and authentication: user ID, email, optional phone, password hash, authentication provider, identity/profile metadata, confirmation and sign-in timestamps, sessions, newsletter choice, age confirmation, and Terms acceptance timestamp.
- Profile: full name, target role, industry, years of experience, and onboarding status.
- Resume and job-search content: contact details, summaries, employment, education, skills, resume text and versions, job descriptions, company/title/URL, application status, notes, and linked resume.
- AI inputs and outputs: text supplied for summaries, cover letters, bullet rewrites, and the generated response. ResumeAI does not intentionally persist these request/response bodies unless you separately save them as product data.
- Shared scores: score, grade, labels, matched and missing keywords, counts, and optional role hint. Raw resume text is not stored in a share record.
- Usage and security: daily AI units, IP address, request method/path/status/duration, request ID, content length, authentication/rate-limit outcome, security signals, device/browser data, and consented analytics or advertising events.
- Browser storage: cookie preferences, theme, and browser-only job tracker entries when cloud storage is unavailable.
Resume text and free-form notes can reveal sensitive information. Do not submit Social Security or government ID numbers, financial credentials, medical or disability details, immigration status or work-authorization documents, or other information that is not needed for the requested task.
3. Purposes and legal bases
- Contract/service delivery: create and secure accounts; save, version, export, and delete product data; analyze resumes; create PDFs; track applications; and provide requested AI output.
- Legitimate interests: prevent abuse, enforce fair-use limits, troubleshoot reliability, maintain bounded security logs, and defend the service, balanced against user privacy.
- Consent: optional analytics, advertising, and newsletter choices. These choices can be withdrawn without affecting account functionality.
- Legal obligations: preserve or disclose limited records when required by valid law, enforce legal claims, or respond to authorities.
4. AI processing
AI features send the submitted text over HTTPS to the ResumeAI backend on Render, then through the Hugging Face inference router to the pinned Together AI provider for the requested generation. The model/provider selection is code-controlled rather than using automatic fastest-provider routing. ResumeAI does not use inputs or outputs to train its own models. Hugging Face and Together AI may process limited operational records under their contracts, settings, and privacy terms. Local keyword, scoring, and compliance tools do not use the generative AI provider.
5. Recipients and processors
- Supabase: authentication, email delivery, PostgreSQL product data, and quota records.
- Vercel: frontend hosting, server actions, deployment, and platform logs.
- Render: backend API hosting and application/platform logs.
- Hugging Face and Together AI: routed AI inference.
- Sentry: content-reduced error diagnostics.
- Cloudflare Turnstile: authentication-form bot and abuse checks.
- Google: OAuth sign-in; and, only after the relevant choice, Analytics and AdSense.
We do not sell personal information. Public-by-link score sharing is an intentional disclosure initiated by the user; anyone who obtains the link can view its score and keyword findings until revocation or expiry.
6. International transfers
These providers may process personal data in the United States and other countries where they or their subprocessors operate. ResumeAI is operated from the United States and its initial launch is US-focused. Safeguards depend on the provider, account plan, service configuration, and applicable law, and may include contractual transfer mechanisms. Contact support@resumeai.cv to request information about the transfer arrangements applicable to your data.
7. Retention
- Account, profile, jobs, saved resumes and versions: until you delete the item or account, subject to backup and legal-retention lag.
- Shared scores: public access ends after 30 days or immediate owner revocation; hourly maintenance removes expired database records.
- AI usage ledger: rolling 31-day retention, or account deletion if earlier.
- Browser-only data: until cleared in browser settings or by the account-deletion flow on that browser.
- Application and platform logs, Sentry, Analytics, AI routing/provider records, and backups: according to the configured vendor retention and any shorter deletion request that the provider supports. Current settings are recorded in ResumeAI's internal processing register.
- Legal/security hold: limited records may be retained longer when reasonably necessary for fraud, security, disputes, or law.
8. Security and error reporting
Controls include HTTPS, Supabase authentication and row-level security, restrictive share payloads, request/body limits, rate and quota controls, security headers, and tested account cascades. Application access logs exclude request bodies. Sentry receives an allowlisted error envelope: exception text, requests, headers, user data, breadcrumbs, contexts, tags, extras, and performance traces are removed or disabled. Source location and generic error type may be retained. No system can guarantee absolute security.
9. Cookies and optional storage
Authentication and security storage is necessary for the service. Google Analytics and Google AdSense are separate optional choices. Their scripts are not loaded until the corresponding choice is granted. Choices are stored in local storage under cookie_consent and can be changed from Cookie Settings in the footer. A browser Global Privacy Control signal disables advertising consent. Withdrawing a choice stops future optional loading after the page reloads; it does not erase data already held by a provider.
10. Export, correction and deletion
The Account page downloads product-held account/authentication metadata, profile, jobs, resumes and versions, shares, AI usage records, and browser-only tracker data. Profile and saved product data can be corrected in the product. Account deletion removes the active Supabase identity and cascades through owned database records, signs out, and clears ResumeAI browser storage on the browser used for deletion. It does not promise immediate erasure from security/legal records, vendor systems, or backups; those follow the schedule and provider capabilities above.
11. Privacy rights
Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, information about recipients, or an appeal of a denied request. You may also have the right to complain to your local data-protection authority. California residents may have rights to know, correct, delete, opt out of sale or sharing, limit certain sensitive-data uses, and receive equal service where the relevant law applies. ResumeAI does not discriminate for exercising privacy rights.
Submit a request from the account email to support@resumeai.cv. We will verify identity, acknowledge the request, search applicable systems and processors, and respond within the legally required period. Authorized agents must provide proof of authority. If we deny or limit a request, we will explain why and provide any available appeal route.
You may also file a complaint with the US Federal Trade Commission at reportfraud.ftc.gov, or with your state's attorney general or data-protection authority.
12. Age eligibility
ResumeAI is not directed to children. You must be at least 16 to create an account. If we learn that an account was created below the configured minimum age, we will disable it and delete the associated product data, subject to legal and security retention.
13. Changes and contact
Material changes will be dated here and, when required, communicated in the product or by email. Questions, complaints, and rights requests should be sent to support@resumeai.cv.