Privacy Policy
Last updated September 10, 2026 · Version 2
The short version
You paste a resume and a job description; we use AI to rewrite the resume to match. To do that, your resume content is sent to a third-party AI provider. We remove some personal details before sending, but not all of them - the details below say exactly which.
We do not sell your data. We do not run advertising. We keep what you make so you can come back to it, and we delete it when you tell us to.
Who we are
ResumeRama is operated by TODO: confirm - registered legal entity and address, based in Ontario, Canada. For anything in this policy, including a request about your data, contact our privacy contact at TODO: confirm - privacy@resumerama.com.
privacy@resumerama.app, which does not match our site domain. We are correcting this. Until we do, requests sent through the in-app feedback form reach us reliably.What we collect
Only what the service needs to work:
| What | Why |
|---|---|
| Resume content you paste or upload | It is what the tailoring rewrites |
| Your contact block - name, email, phone, location | Printed onto the resume we generate for you |
| Job descriptions you paste, upload or link | The target the resume is tailored against |
| Your account identifier from our sign-in provider | Keeps your work attached to you and nobody else |
| Your tailoring history and generated documents | So you can re-download and edit past results |
| Payment records - amounts, status, processor reference | Billing, receipts and refunds |
| Your consent choices | Proof of what you agreed to, and when |
We never receive your card details. Payments go directly to our payment processor; we store only the amount, the status and their reference.
A resume is free text, so it can contain sensitive information you did not intend to share - health or disability details, religious or political affiliations, union membership. We do not ask for any of it and do not use it, but it is carried along with the rest of your resume. Consider removing anything you would not want processed.
What reaches an AI provider
This is the section that matters most, so it is written plainly rather than carefully.
Your contact details are never sent. The name, email, phone and location on your resume, and your profile links, are removed before the request is built. The model is asked to rewrite your summary, experience and skills; it is never asked for your contact details and has no way to return them. They stay on our servers and are printed onto your finished document here.
Across everything else we send - your summary, experience, education, projects, the job description and any special instructions - we automatically replace your name, email addresses, phone numbers, street addresses and URLs with placeholders. When the response comes back, our servers put the real values back before saving or showing it to you.
Redaction covers every field of your resume rather than a list of chosen ones, so a field added to the product later is protected the day it is added.
Rehydration - putting your details back into the AI’s response - happens on our servers, not in your browser.
We do not use your resumes, job descriptions or account data to train AI models. Where we use AI services hosted on Microsoft Azure, those terms prohibit the provider from training on our traffic. For providers called directly, TODO: confirm - training terms per provider. If we ever build a programme to improve models using your data it will be strictly opt-in, off by default, explained before you choose, and reversible.
Full detail is in our AI Policy.
Why we process it
| Purpose | Basis |
|---|---|
| Providing tailoring, cover letters and history | Performance of our contract with you |
| Taking payment and issuing refunds | Contract, and legal obligation for financial records |
| Keeping the service secure and enforcing limits | Legitimate interests |
| Non-essential cookies | Your consent, withdrawable at any time |
| Keeping consent records | Legal obligation |
Who we share with
We do not sell your data and we do not share it with advertisers. We use these service providers to run ResumeRama:
| Provider | What they receive | Where |
|---|---|---|
| Clerk | Email, name, sign-in profile, session | United States |
| Microsoft Azure AI (DeepSeek-V4-Pro) | Your resume content and the job description, with contact details removed | United States - Azure East US |
| Microsoft Azure | All application data - hosting and database | Canada (Canada Central) |
| Cloudflare | Request metadata including IP address | Global edge network |
| Stripe, and PayPal where offered | Payment details, which go directly to them | United States / global |
We use no analytics provider, no advertising network, no email marketing platform and no third-party error-tracking service. There is less to disclose here than most products, and that is deliberate.
We may also disclose data where the law requires it, or to protect the rights and safety of our users or the service. See our Third-Party Software Policy.
International transfers
Your data is stored in Canada, and leaves it in exactly two places:
| What | Who | Where |
|---|---|---|
| Sign-in and your account identity | Clerk | United States |
| Rewriting your resume | Microsoft Azure AI (DeepSeek-V4-Pro) | United States - Azure East US |
We name the region because it is the part people actually care about and the part that is easy to leave vague. The model is Microsoft’s Azure-hosted DeepSeek, not the DeepSeek company’s own service, so your resume is not sent to China. It is processed in the United States under Microsoft’s terms, and automatic failover to any other provider is switched off, so this cannot change silently.
Where we transfer personal data out of the EEA, the UK or Australia, we rely on appropriate safeguards for that transfer - TODO: confirm - standard contractual clauses in place per provider. Under Australian Privacy Principle 8 we remain accountable for how our overseas providers handle your data.
How long we keep it
If you use ResumeRama without an account, nothing about your resume is kept after your session ends.
With an account, we keep your profile, tailoring history and generated documents until you delete them or close your account. When you delete your account from your Profile page it is deactivated immediately and you have 15 days to recover it. After that your personal data is permanently deleted by an automated job.
Two things intentionally survive: the record that a deletion happened (so we can show the request was honoured), and financial records we are required to keep - TODO: confirm - retention period. Consent records are also retained as evidence of what you agreed to.
Your rights
Wherever you live, you can reach your data through your account: view and edit it in your profile, and delete everything from the Profile page. For anything else, contact us - we do not charge for requests and we aim to respond within 30 days.
Canada (PIPEDA, and Law 25 in Quebec). Access and correct your information, withdraw consent, and ask how it is handled. Quebec residents also have data-portability rights and the right to be informed about automated decisions. TODO: confirm - named privacy officer, required under Law 25.
EU/EEA and UK (GDPR). Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time without affecting prior processing.
California (CCPA/CPRA). Know, delete and correct what we hold; opt out of sale or sharing; no worse service for exercising any of it. We do not sell or share personal information as those terms are defined, so there is currently nothing to opt out of. If that changes we will publish a “Do Not Sell or Share My Personal Information” link before it does.
India (DPDP). Access, correction, erasure, grievance redressal, and nomination of another person to exercise your rights.
Australia (Privacy Act / APPs). Access and correct your personal information, and complain about how it is handled. We remain accountable for overseas recipients.
Cookies
We set only essential and functional cookies today - the ones that sign you in, remember your consent choices and keep your session secure. Analytics and advertising categories are offered in the consent banner and default to off; nothing currently uses them. Details in our Cookie Policy.
Security
Data is encrypted in transit and at rest by our hosting provider, access to production is restricted, authentication is handled by a specialist provider, and we never hold card details. No service can promise perfect security, and we will not pretend otherwise.
Children
ResumeRama is not intended for children. TODO: confirm - minimum age, 16 recommended. We do not knowingly collect data from children below that age; if you believe a child has given us data, contact us and we will delete it.
Automated decisions
ResumeRama uses AI to rewrite text and to estimate how well a resume matches a job description. These are drafting aids: nothing here decides whether you get a job, and no result is passed to an employer by us. A person - you - reviews and edits everything before it goes anywhere. If you want a human to look at how a result was produced, ask us.
Changes
When this policy changes materially we update the date and version at the top, and ask you to accept the new version the next time you sign in. Your consent record stores which version you agreed to.
Complaints
Come to us first - we would rather fix it. You can also complain to your regulator: the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, your EU or UK supervisory authority, the California Privacy Protection Agency, the Data Protection Board of India, or the Office of the Australian Information Commissioner.