Privacy Policy
Version 2.0 · Effective Date: October 2026
1Introduction & Scope
ResumeSquadᴬᴵ (“we,” “our,” or “us”) operates an autonomous career optimization platform. We hold ourselves to strict privacy, confidentiality, and data minimization standards. This Privacy Policy details how we collect, process, protect, and retain your personal data across our web application, free tools, and backend AI pipelines.
We operate under a simple principle: your career data belongs to you. We do not sell your personal data, we do not use your resumes to train publicly available AI models, and we provide transparent self-service controls to export or permanently erase your data at any time.
2Information We Collect & Data Classification
Identity & Account Credentials
Name, email address, password hash (via bcrypt with salted rounds), or Google OAuth profile tokens. Used strictly for authentication, authorization, and transactional communications.
Career & Document Data
Resume text, uploaded PDF/DOCX files, job application history, target job descriptions, weekly career wins, work history, skills, and verified career facts. Used solely to analyze ATS fit and draft tailored resumes and cover letters.
Payment & Transaction Ledgers
Order IDs, package grant balances, billing country, and currency. Credit card details are processed directly by our Merchant of Record (Lemon Squeezy) and are never stored on our servers.
Telemetry & Security Logs
IP addresses for rate limiting (Upstash Redis), cloud HTTP logs (Vercel/Render), client error stack traces (Sentry, with PII scrubbed), and aggregated web analytics (Google Analytics 4, activated only upon consent in the EU/UK).
3Lawful Bases for Processing (GDPR Article 6)
Under the EU General Data Protection Regulation (GDPR) and UK GDPR, we process personal data under the following legal grounds:
- Performance of Contract: Processing resumes, generating tailored documents, and maintaining your account at your explicit request.
- Legitimate Interests: Operating anti-abuse rate limiting, detecting bot traffic, monitoring system stability, and securing our infrastructure against malicious attacks.
- Legal Obligation: Maintaining financial transaction records and tax compliance for up to 7 years as required by applicable commercial and tax law.
- Consent: Optional analytical cookies and newsletter communications, which you may grant or revoke at any time.
4Authorized Sub-processors
To deliver our multi-agent pipeline and high-availability web service, we engage vetted third-party service providers. Each sub-processor is subject to strict data protection agreements ensuring zero model training on customer data and compliance with GDPR/CCPA standards.
| Sub-processor | Purpose | Region | Retention | Lawful Basis |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, serverless edge compute, global CDN, and DNS management | United States / Global Edge Network | Ephemeral session runtime; access logs retained for up to 30 days | Legitimate interest (system availability and DDoS mitigation) |
| Supabase, Inc. (AWS us-east-1) | Primary PostgreSQL relational database, authentication store, and application state | United States (N. Virginia) | Account lifetime or until user-requested deletion; free inactive accounts purged after 90 days | Performance of contract (providing saved resume services) |
| Render Services, Inc. | Compute infrastructure hosting the multi-agent AI pipeline and document processing backend | United States (Oregon) | Ephemeral pipeline execution only; compute logs retained for up to 30 days | Performance of contract (executing requested resume optimization) |
| Upstash, Inc. (AWS us-east-1) | Distributed Redis caching, rate-limiting counters, and ephemeral research state | United States (N. Virginia) | Sliding window rate-limit keys expire in 1–60 seconds; research cache expires in 24 hours | Legitimate interest (abuse prevention and resource availability) |
| Pinecone Systems, Inc. (AWS us-east-1) | Vector database for semantic embeddings, RAG retrieval, and occupational taxonomy matching | United States (N. Virginia) | Account lifetime; deleted immediately upon account deletion or profile update | Performance of contract (targeted semantic matching) |
| OpenRouter, LLC | Secure AI inference gateway routing prompts to foundational model endpoints | United States | Zero-retention pass-through; requests are neither stored nor used for model training | Performance of contract (AI content generation) |
| Google LLC / Google Cloud Vertex AI | Foundational LLM inference (Gemini models) for resume drafting, keyword extraction, and embeddings | United States | Zero customer data retention; inputs and outputs are never used to train foundational models | Performance of contract (content generation and scoring) |
| Anthropic, PBC | Adversarial Red Team audit LLM inference for factual claim verification | United States | Zero data retention under commercial API terms; inputs are never used to train models | Performance of contract (anti-hallucination verification) |
| DeepSeek / OpenRouter | Reasoning and deterministic structural extraction model inference | United States / Routed via OpenRouter | Zero data retention via API terms; ephemeral stateless inference | Performance of contract (resume parsing and alignment) |
| Groq, Inc. | Ultra-low-latency LPU inference for the free ATS checker semantic keyword analysis and bullet rewrites | United States | Zero data retention; inputs are discarded immediately after inference and never retained | Legitimate interest / Performance of requested ATS analysis |
| Lemon Squeezy, LLC | Merchant of Record, credit pack billing, payment card processing, and global tax compliance | United States | Up to 7 years to satisfy statutory accounting, tax reporting, and audit requirements | Legal obligation (tax and fraud compliance) and Performance of contract |
| Google LLC (Google Analytics 4) | Aggregated site usage telemetry, traffic analytics, and conversion attribution | United States / Global | 14 months (subject to user consent in the EU/UK) | Consent (via analytics consent mode banner) |
| Functional Software, Inc. (Sentry) | Real-time error tracking, exception logging, and application performance monitoring | United States | 30 days rolling retention | Legitimate interest (application stability and security diagnostics) |
| Resend, Inc. (AWS us-east-1) | Transactional email delivery for account confirmation, password resets, and security notifications | United States (N. Virginia) | 30 days delivery logs and message status telemetry | Performance of contract (delivering essential account notices) |
5Data Retention & Automated Pruning
We do not retain personal information longer than necessary. Our automated retention policy executes daily:
- Active Accounts: Resume drafts, weekly wins, and profile facts remain accessible for your career management until you choose to delete them.
- Free Inactive Accounts (90 Days): For free accounts with no login or pipeline activity for more than 90 days and no paid package entitlements, resume text and generated deliverable artifacts are automatically deleted or anonymized.
- Agent Execution Logs (30 Days): Detailed per-step execution payloads and transient agent error traces older than 30 days are automatically pruned; only non-identifying aggregate cost and latency metrics are retained.
- Statutory Financial Records: Order records and ledger entries are retained for up to 7 years to comply with statutory accounting and tax regulations.
6Your Privacy Rights (GDPR & CCPA)
Regardless of where you reside, you possess comprehensive rights over your personal data:
- Right to Access & Portability: You can download a complete machine-readable copy of your profile, career facts, and generated documents.
- Right to Rectification: You can edit or correct any profile information or generated draft at any time from your dashboard.
- Right to Erasure (Right to be Forgotten): You can permanently delete your account and all associated documents directly in account settings.
- Right to Restrict or Object to Processing: You may object to non-essential processing or withdraw consent for analytics.
7Security Commitments
We enforce defense-in-depth technical safeguards to protect your personal information:
- All data in transit is encrypted using modern TLS 1.3 encryption.
- Databases and vector storage are encrypted at rest using industry-standard AES-256 encryption.
- Strict authentication with signed assertions and role-isolated backend API keys.
- Automated file validation, encrypted PDF rejection, and buffer sanitization prior to document parsing.
8Contact Us & Data Protection Officer
For privacy inquiries, GDPR/CCPA requests, or security disclosures, contact our privacy team at privacy@resumesquadai.com or reach our support desk at support@resumesquadai.com.