Privacy policy

1.1 Account information. When you sign in with Google, we receive and store your email address and, where provided, your Google display name. When you sign in with a code emailed to you, we store only your email address. Either way we never receive or store a password — there is no Resumap password to store, and we never see your Google one.

1.2 Resume content. Any content you enter into the editor — including but not limited to your name, work history, education, skills, projects, and profile photo — is stored in our database to enable the core functionality of the service. This content is not shared with any third party except as necessary to operate the service (see Section 4).

1.3 Analytics data. If you consent via the cookie banner, we collect page-level usage data including pageviews, feature interactions, and CTA clicks. Events from signed-in users are linked to their account, including the email address and first name. If you decline, our analytics are not loaded and no usage data about you is collected or transmitted. We do not collect keystroke-level data or record the content you type inside the editor, regardless of your consent choice.

Separately from the above, our content delivery network measures how fast pages load for visitors outside the European Union. This measurement uses no cookies, does not identify you and is not linked to your account, and it runs regardless of the cookie banner. It is switched off for visitors in the European Union.

1.4 Operational logs. We maintain an internal audit log recording account events such as sign-in, resume creation and deletion, and credit transactions. These logs contain your user ID and event metadata only — never resume content. These logs are used for debugging, abuse prevention, and responding to deletion requests.

2.1 Strictly necessary cookies. Authentication and session cookies are required for the service to function. These cannot be disabled via the cookie banner — declining analytics consent does not affect auth cookies.

2.2 Analytics cookies. If you accept the cookie banner, first-party analytics cookies are set under our domain to measure unique visitors and session continuity. Accepting also loads measurement tags from our analytics and advertising providers, which tell us whether an ad led to a sign-up and may set their own cookies. If you decline, none of these tags load and no analytics cookies are written.

2.3 Referral cookie. If you accept the cookie banner, we also store a first-party cookie recording how you reached the site — the referring website, any campaign tags in the link you followed, and the page you landed on. It is set under our domain, is not shared with anyone, and is deleted the moment you create an account, at which point that information is copied to your account so we can tell which channels bring people to Resumap. If you never create an account it expires by itself within 30 days. If you decline the banner, it is never written.

2.4 Changing your preferences. You may withdraw or change your consent at any time by clearing the site data (cookies and local storage) for resumap.io in your browser — the consent banner will reappear on the next page load. A one-click preference reset may be added to account settings in a future update.

2.5 Editor draft backup. The resume editor writes an automatic safety-net copy of your in-progress section content to localStorage on your own device, in keys prefixed resumap_draft_v1_. This is the same pattern Gmail and Notion use for unsaved drafts. The copy is cleared after a successful save to our servers and is never transmitted independently. If you share a device, sign out and clear browser data — the draft survives browser restart but not localStorage clears.

2.6 Menu preference cookie. If you collapse or expand the side menu of the app, a first-party cookie named resumap_sidebar remembers that choice, so the menu looks the same on your next visit. It holds only the word “collapsed” or “expanded”, is written only when you use that button, is not used for analytics, and expires after one year. Like the cookies in 2.1 it is not controlled by the cookie banner: it does nothing except keep the setting you chose.

We use the information we collect to:

• Provide, maintain, and improve the service
• Authenticate you and manage your account
• Process credit purchases and maintain transaction records
• Respond to support requests and deletion requests
• Detect, investigate, and prevent fraud or abuse
• Send transactional emails (welcome email, product updates) — your email is never added to any third-party marketing list

We do not sell your personal data. We do not use resume content to train machine learning models.

We do not sell or rent your personal data. We share data only with carefully selected third-party service providers (“processors”) engaged to operate the service, including providers of database and file storage, hosting and content delivery, analytics and advertising measurement (consent-gated), error monitoring, abuse prevention (rate limiting), transactional email, and payment processing. When you use an AI feature (resume import, ATS check, tailoring, cover letter, follow-up email, interview prep), the resume content and the job description you provide are sent to our AI model provider to produce the result. The job listings feed is supplied by a job-search provider, which receives your search terms and location but not your resume. Each processor is bound by a data processing agreement and is permitted to use your data only as necessary to perform services on our behalf. A list of our current processors is available upon request at [email protected].

We do not share resume content with any processor beyond what is technically necessary to deliver the service.

We retain your data for as long as your account is active. Operational logs are retained for a limited period for debugging and compliance purposes.

Upon account deletion, we permanently delete:

• Your authentication record (cascades to all associated data)
• All resumes, sections, and editor content tied to your account
• All credit and payment records we hold, including the raw payment notifications received from our payment processor, and your audit log entries. One entry recording that an account with your internal ID was deleted is kept, without your email address. The payment processor keeps its own records of your payments as the law requires of it.
• All photos and files uploaded under your account in storage
• Your profile and events are deleted at our analytics processor, and any email still scheduled to be sent to you is cancelled

Note on CDN caching. Edge caches may retain cached versions of uploaded photos for up to 12 months following deletion. File paths are unguessable and inaccessible without the original URL; this does not constitute an accessible privacy exposure. If you require hard cache expiration, contact us at [email protected].

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you (you can download a copy directly via /account, under “Your data”)
• Receive that data in a structured, machine-readable format and take it to another service (data portability): the download is a single JSON file
• Request correction of inaccurate data
• Request deletion of your data (you can do this directly via /account)
• Object to or restrict certain processing
• Withdraw consent for analytics at any time (see Section 2.4)
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or disclosure. These include encrypted connections (TLS), access controls, and EU-region data storage. However, no system is entirely secure. We cannot guarantee absolute security and are not liable for unauthorized access resulting from circumstances beyond our reasonable control.

The service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it promptly.

We may update this Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated via in-app notice or email at our discretion. Continued use of the service after a change constitutes acceptance of the revised Policy.

For privacy questions, data requests, or manual deletion requests: [email protected]