Privacy Policy

Resume Graph works on your resume, the job postings you paste in, and the answers you give it. That is unusually personal material, so this page says plainly what happens to it, how long it is kept, and how to take it back. It describes how the product works today. Everything below applies to everyone who uses Resume Graph, wherever they live.

What we hold

• Your account. The email address and sign-in identity you register with, handled by Firebase Authentication, and the name and language you choose. We never see or store your password.
• Your resumes. The text of a resume you paste or upload. We do not keep the file you upload: its text is read while you wait and the file itself is discarded.
• Job postings you paste in, and the requirements the system derives from them.
• Your answers. What you type when the product asks you about your experience. These are the most personal thing here: they are about your work, and sometimes about the gaps in it.
• What was produced. Your matched resumes, their design, cover letters, your career record, PDFs you download, and the report of what changed and what was not covered.
• Usage and billing. How much of your plan you have used, your credit balance, your plan, and what you bought and when.
• Operational records. Request counts that protect the service from abuse, and records of failed steps so they can be retried. These hold identifiers and codes, never your content.

Please leave out of your resume and answers anything you would not want processed — health, religion, political views, a photo, an identity number. The product does not need it. If you include it, we handle it exactly like the rest of your material, only to produce your documents, and you can delete it at any time.

What we do with it, and why we may

We use it to produce your own matched resumes and cover letters, to show you your own history, and to enforce your plan's allowance. That is the whole list.

We do not sell it. We do not share it with recruiters, employers, or advertisers. It is not used to train any model — not ours and not a provider's. We make no automated decision about you that has legal or similarly significant effects; the product writes a draft, and you decide what to do with it.

• To provide the service you asked for — your account, your documents, your answers, your usage. Without them there is nothing to provide.
• For legitimate interests — keeping the service secure and working: rate limits, failure records and error reports. They hold identifiers, not content.
• Because the law requires it — records of payments, kept for tax and accounting.

Who else receives it

Producing the result means sending parts of your material to the services that run the product. Each one below receives only what it needs to do its job, under a contract that forbids any other use.

• Anthropic — the AI model provider. Your resume text, the job posting, your answers and your career record are sent to Anthropic's API so the rewrite can be produced. This is the most significant disclosure on this page and the reason it is not buried. Anthropic does not train its models on data submitted through its API and deletes it within 30 days.
• Google Cloud / Firebase — the platform the product runs on. It stores your account, your documents and your files, and runs the code that produces them. In the application it also provides reCAPTCHA, which checks that requests come from a real browser rather than an automated script, using signals about your browser and how the page is used; Google's own privacy policy covers that.
• Sentry — error and performance reporting. It is wired so that no resume text, job posting text or interview answer is ever transmitted to it: reports carry step names, timings and numbers, and your account identifier is the only identifier that leaves the runtime. There is no session replay. Reports are kept for up to 90 days.
• Umami — visit counts, on servers in the United States. It sets no cookies and keeps no personal data: it receives the address of the page, the page that linked to it, your browser, device type, language and country, and, in the application, three named steps (creating an account, starting a checkout, completing a purchase). Never your account, your email or anything you write. It counts nothing at all if your browser asks sites not to track you. Data is kept for 6 months.
• PayPal — if and when you buy something. You approve the payment on PayPal's own site. We never receive your card number, your bank details, or your billing address; what comes back to us is confirmation that a payment succeeded, tied to your account identifier. PayPal handles your payment details under its own privacy statement.
• Synapset (Rocketbyte) — writes and grades skills assessments, if you take one. It receives the name of the skill being tested and, when grading, the options you chose. Never your resume, your name or your account. Questions are kept per skill for 30 days and shared by every account; your answers are not kept. Your scores stay with us, and appear on a shared resume only when you switch them on.

Where it is processed

Your data is stored and processed in the United States. When it leaves the European Economic Area, the United Kingdom, Switzerland or another country with transfer rules, it is protected by the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) and, where a provider is certified, the EU–US Data Privacy Framework. It is encrypted in transit and at rest.

How long we keep it

• Your documents, answers, cover letters and career record — until you delete them, or delete your account.
• Uploaded files — not kept at all.
• PDFs you download — deleted automatically after 30 days, and at once when you delete the document they came from.
• A proposed change to your career record — deleted after 24 hours if you do not act on it.
• Failure records — 30 days. Rate-limit counts — a couple of hours.
• Your account, usage and credit balance — for as long as your account exists.
• Records of payments — for as long as your account exists, and then 10 years, because tax and accounting law requires it. They hold what was bought, the amount and the date — never your name, email or payment details — and after your account is deleted nothing links them to you.
• A record that your account was deleted — its identifier and the dates, for 3 years, so we can show the deletion happened.

Deleted data leaves our backups within 7 days. Error reports age out of Sentry within 90 days.

Your rights, and how to use them

Whatever country you live in, you can do all of the following. The first four are buttons in the app; they work immediately.

• See and download everything. Settings → Danger zone → Download your data gives you a complete copy as a JSON file you can keep or take elsewhere.
• Correct it. Edit your name, your documents and your career record directly.
• Delete parts of it. Delete any document, cover letter or your career record on its own.
• Delete your account. Settings → Danger zone → Delete account erases everything above at once, except the payment records and the deletion record the law requires. It is final, and any subscription is cancelled.
• Object, restrict, or ask anything else — write to privacy@resumegraph.io from the address on your account. We answer within 15 days.

You can also complain to the data protection authority where you live. We would rather hear from you first, but you do not need to ask us before you do.

This website

The page you are reading sets no cookies and carries no tracking pixels and no advertising tags. It runs one small script of its own: it reads your browser's language setting to decide whether to show you the Spanish site, and remembers your choice if you use the language switch. That preference is stored in your own browser and is never sent to us. To count visits it loads Umami, a cookieless analytics service that keeps no personal data and does not follow you across sites (see above). That is the only third-party request this site makes — the typeface is served from this domain.

The application is a separate site with its own address, and it uses only what signing in requires: the storage that keeps you signed in, and your theme and language choices. To keep automated abuse out, it uses Google reCAPTCHA (see above). It counts visits with the same cookieless analytics, and nothing there is used for advertising or follows you elsewhere, so there is nothing to consent to.

Children

The product is for people looking for work and is not intended for anyone under 16. We do not knowingly hold data about anyone younger; if you believe we do, write to us and we will delete it.

Changes

If this policy changes in a way that affects what happens to your material, we will change the date at the top and tell account holders before the change takes effect.

Contact

Questions about any of the above, or a request about your data: privacy@resumegraph.io.