Who we are
resume.art is run by ALIDZM, a registered sole trader in Poland (NIP 6793267355, Grzegórzecka 69E/2, 31-559 Kraków, Poland), who is the controller of the personal data described here; where this policy says “we”, that is who it means. You can reach us about anything in it at support@resume.art.
What we collect
- Account data: your email address, name and, if you have one, profile photo, as your Clerk profile holds them (from Google or LinkedIn when you sign in with them).
- Sign-in data, kept by Clerk for us: your email addresses, the providers you connect, the public part of any passkey you add (the private key never leaves your device), and for each signed-in device the browser, operating system, IP address, approximate location and times of sign-in and last activity, shown to you in Account settings → Security.
- Your documents: what you type or upload to build resumes and cover letters, the documents themselves, your chat with the assistant, job postings you paste or save, and the place you choose to search for jobs in.
- A LinkedIn profile you import: the link you give, and what the public profile says that a resume is made of (name, headline, location, about, experience, education, skills, certifications, languages, projects, volunteering, publications, honors and awards, and courses). We never read the profile’s email address, phone number or photo.
- Your photo, if you add one to a resume: we keep only a copy our server makes of it, without the camera, location or other data a photo file can carry. It is printed only by the templates that show a photo, and it is never sent to the AI providers below.
- Payment data: what you bought and your subscription. You pay on Stripe’s checkout page: the version of our terms you buy under is kept by Stripe with the payment, and your card details never reach our servers.
- Technical data: IP address and request details in our security logs, the country derived from your IP address (to decide which consent rules apply and, until you choose a place on the job tab, which country to search for jobs in; looked up on our own server with IP Geolocation by DB-IP, db-ip.com, and not stored), and error reports.
- Advertising data: a Google, Meta or Reddit ad click identifier and, with a Meta one, your browser’s user agent, only as described in our cookie policy.
- Support requests: what you write with Contact support and whether it is about a problem, a question or an idea; the email address we reply to (your account’s, or the one you type in); your account identifier and name, or as a guest your guest session’s identifier; your plan; the page you wrote from, without its query string; your browser (its user agent), window size and language; and the version of the app. They are kept in our own support system, hosted by Railway.
Why we use it
- To provide the service you ask for: writing, editing, tailoring, checking and exporting your documents, and matching job listings to your resume (contract).
- To take payments, keep proof of the terms you bought under and keep the records the law requires (contract, legal obligation).
- To keep the service secure and working: rate limits, abuse prevention, error monitoring (legitimate interests).
- To measure which ads bring customers, with your consent where the law requires it (consent, or legitimate interests where you have not opted out).
- To send the sign-in codes and email verifications you ask for, through Clerk (contract).
- To answer what you write to support, by email (legitimate interests).
We do not sell your personal data, and we never use your documents to train AI models.
Who processes it for us
These providers process data on our behalf, under contracts that limit their use of it to providing their service to us:
- Railway (United States): hosting of the application, database and cache, and of our own support system, which keeps what you send with Contact support.
- Google (Gemini API): generates and edits the text of your documents. We use Google’s paid API terms: your content is not used to train Google’s models, and Google keeps prompts and answers for up to 55 days only to detect abuse of its service, then deletes them.
- OpenAI (United States): generates and edits the text of your documents when Google’s service is unavailable. Under OpenAI’s API terms your content is not used to train its models, and OpenAI keeps prompts and answers for up to 30 days only to detect abuse of its service, then deletes them.
- OpenRouter (United States): when neither Google’s nor OpenAI’s service answers, passes the request to write or edit your document on to another AI model: Google’s Gemini on Google Cloud, OpenAI’s model on Microsoft Azure, or Anthropic’s Claude on Google Cloud or Amazon Bedrock. We let it use only providers that neither keep your content and the answer nor train on them; OpenRouter itself does not keep them. Google may keep a prompt its safety systems flag for up to 90 days, only to detect abuse, and OpenRouter may keep content flagged as child sexual abuse material where the law requires.
- Stripe: the checkout page you pay on, payments, invoices and refunds, the billing portal where you manage Pro, and the emails about them: receipts, invoices, credit notes, reminders of an upcoming renewal and notices of a failed payment.
- Clerk (United States): sign-in and account security: your email addresses, sign-in methods, passkeys and signed-in devices; it sends the sign-in codes.
- Sentry: error reports, our server’s log lines, and timings of a share of page loads and requests: what failed or how long it took and where (the page or request, without its query string), your browser, and the identifier of your account or guest session. Never what you write or upload.
- Plausible Analytics (EU): cookieless visit statistics and counts of sign-ups, checkouts and payments, with nothing that identifies you.
- Google Ads (Data Manager API): conversion reports, as described in our cookie policy.
- Meta (Conversions API): conversion reports for Meta’s ads on Facebook and Instagram, as described in our cookie policy.
- Reddit (Conversions API): conversion reports for Reddit’s ads, as described in our cookie policy.
- Google and LinkedIn: only if you choose to sign in with them.
- Apify (Czech Republic): runs the tools that read LinkedIn and job boards for us: the public LinkedIn profile you ask us to import, so the assistant can write your first draft from it; LinkedIn job searches; and a job whose link you give us when its site does not let our server read it (LinkedIn, Indeed, Glassdoor, work.ua, SEEK, Monster, pracuj.pl, or any other such page, opened in a web browser). The tools are made by others and offered on Apify (HarvestAPI, Fresh Data, curious_coder, misceres, bebity and Black Falcon Data), or by Apify itself (RAG Web Browser). They receive the profile’s or the job’s link, or the job title and location being searched, and nothing else about you, never your resume.
- Fantastic.jobs, reached through RapidAPI: LinkedIn job listings, when Apify cannot answer. We send the job title and location being searched, never your resume.
- Fresh LinkedIn Profile Data, reached through RapidAPI: reads the public LinkedIn profile you ask us to import when Apify cannot. We send the profile’s link, and nothing else about you.
Some of these providers are in the United States. Transfers from the EEA, UK and Switzerland rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses.
How long we keep it
- Your account and documents: as long as your account exists. Deleting a document keeps it recoverable for 30 days, then it is erased; a resume’s photo goes with it.
- A resume’s photo: while the resume uses a template that shows a photo. If you leave the editor with the resume in a template without one, the photo is deleted then, or about a day after your last change if you close the page instead.
- A LinkedIn profile you import: its text is kept with the new resume until the first draft is written, then deleted (the resume keeps only what the draft made of it); a copy is kept for up to an hour, for you alone, so that trying again does not read the profile twice.
- Signed-in devices: until you sign out or the session ends, at most 7 days after you signed in.
- Guest sessions that are never turned into an account: erased after 30 days without use. When a guest signs in, a note tying it to the account is kept for a day.
- Advertising measurement: the Google, Meta or Reddit ad click you arrived from is erased 90 days after the click, and the record of whether a sign-up, checkout or payment was reported to that network 90 days after it happened.
- Payment records: as long as tax law requires, usually up to 10 years.
- Support requests: until we have dealt with them, then for a year.
- Security logs and error reports: up to 90 days.
Your rights
- Access and portability: write to us (support@resume.art, or Contact support in the app) for a copy of your data as a file; your sign-in methods and signed-in devices are listed in Account settings → Security.
- Correction: edit your profile and documents at any time.
- Erasure: ask us to delete your account (support@resume.art, or Contact support in the app); everything linked to it is erased, including your customer record at Stripe (saved cards and billing address). Invoices and payment records, with withdrawals, are kept only as long as tax law requires.
- Objection and withdrawal of consent: change your cookie choice at any time.
- Complaint: you can contact your data protection authority.
Residents of US states with privacy laws (such as California) have the rights to know, delete, correct and opt out of the "sharing" of personal data for advertising. Use the "Do not share my information" link or write to support@resume.art; we honour Global Privacy Control signals.
Children
resume.art is for people aged 18 and over. It is not intended for anyone younger, and we do not knowingly collect their data.
Changes
We will update this page when our practices change and, for significant changes, show a notice on the site and in the app before they take effect.