Your resume is yours.

Who is responsible for your data

ResumeFully is the data controller for the personal data described here. In data-protection terms that means we decide what is collected and why, and we are accountable for it.

For privacy questions, data-subject requests, or anything in this policy, write to privacy@resumefully.com. Requests sent to this address are answered within one month, which is the period the GDPR allows.

Payments and Paddle

Web purchases are processed by Paddle, our merchant of record. Paddle is a separate controller for the payment data it collects at checkout — card details, billing address, and tax information. That processing is governed by Paddle's own privacy policy at paddle.com/legal/privacy, not this one.

We receive billing contact details, transaction and subscription identifiers, and webhook events from Paddle so we can attach the correct entitlement to your account. Paddle is therefore also a processor of that billing metadata, and is listed with the other processors below.

You can reach Paddle about a payment, invoice, or refund through paddle.net or the link on the receipt they email you.

What we collect

If you join the waitlist before launch: your email address, and — so we know roughly where interest is coming from — the country Cloudflare reports for the request and a shortened description of your browser. We do not store your IP address. This is deleted once the waitlist has been mailed.

Account and profile data: your email address, authentication credentials, and the entitlement attached to your account.

The content you create: your resumes, the version snapshots that make editing restart-safe, and the job applications and job-description text you track.

Files you upload for import, and the extraction artifacts produced from them. Both are deleted once the import completes or fails — they are not kept as a second copy of your resume.

Documents we render for you, held briefly behind a short-lived signed link and not retained beyond it.

Records of AI operations you run — identifiers, model, token counts, and cost — so credits can be accounted for. These records never contain your resume or job-description text.

Billing and credit ledger records, and the webhook events from Paddle that keep your entitlement correct.

Technical logs and error reports. These are scrubbed by default: they carry request, job, and user identifiers, never resume content and never contact details.

What we do not do

We do not use your resume or job-description content to train AI models, for advertising, for profiling, to rank users, for resale, or for aggregate publication.

There are no third-party trackers and no advertising pixels on this site or in the product. Not on the marketing pages, not behind the login.

We do not ask for, and do not want, special-category data — health, disability, race, religion, political opinion, sexual orientation, or trade-union membership. There is no photo or personal-details section that invites it by default.

We do not make automated decisions about your employability. Where the product scores a document, it shows the rubric and the evidence; it is scoring a document, not judging you.

Why we are allowed to process it

To perform our contract with you: running your account, storing and processing your documents, and delivering the features you ask for.

For our legitimate interests: keeping the service secure, preventing abuse, debugging faults, and understanding aggregate reliability.

To comply with legal obligations: keeping the transaction records that accounting and tax law require.

Where an AI operation sends your content to a third-party provider, that happens because you initiated the operation as part of the service you asked for.

Who else processes your data

We maintain a versioned sub-processor register naming every processor that reaches user data, what it is for, which categories of data it sees, and the region it processes in. That register is internal launch evidence until a public route is added; the processors used today are listed on this page.

The processors in use for the web product are: Supabase for the database, authentication, storage, and serverless functions; Cloudflare for hosting, DNS, and content delivery; Google Cloud for document processing and rendering; Anthropic (Claude API) for resume writing, tailoring, and scoring; Google (Gemini API) for job-description extraction; Resend for transactional email; and Paddle for billing.

Anthropic and Google are both active AI processors. Anthropic receives the resume and job-description context needed for the writing, tailoring, or scoring operation you start. Google receives job-description text for extraction. Our server limits the context sent to what each operation needs.

Google's Gemini API receives resume and job-description text only for an AI operation you started. On the paid Gemini API, Google does not use those prompts or responses to improve its products; we record that because it is a claim about a third party rather than about us.

We announce a new sub-processor before your data can cross that boundary — not afterwards.

How long we keep things

Account data, resumes, versions, and application records are kept for the life of your account and deleted when you delete it.

Uploaded files and extraction artifacts are deleted when the import finishes or fails. Rendered exports live only as long as their signed link.

Billing and ledger records are the documented exception. We keep them under accounting and tax law even after an account is erased, minimised to the transaction identifiers, amounts, and dates required.

Logs expire on a fixed retention window set at the provider.

Backups are kept as 30 daily and 12 monthly recovery points.

Your rights, and the two you can exercise yourself

You can export all your data in a structured, portable format, and you can delete your account, from inside the product. Neither requires contacting us or waiting for us to act.

You also have the right to access your data, correct it, object to or restrict processing, and complain to your local supervisory authority. Write to privacy@resumefully.com for any of these. We log each request and its outcome.

Erasure is real and prompt in the live system: deleting your account removes your profile, resumes, versions, applications, private files, processing artifacts, and render artifacts.

The honest part about backups

Backups are not selectively edited, and any provider claiming otherwise is describing something they do not do.

When you delete your account, your data is removed from the live system promptly, but it can persist inside encrypted backups until those backups age out. The outer bound is the 12-monthly retention window above.

We keep a deletion log and re-apply it after any restore, so restoring a backup can never quietly bring an erased account back.

Security and breaches

Your documents live in private storage reachable only through your authenticated account. Access rules are enforced in the database itself rather than only in application code.

If we suspect a personal-data breach we contain it, assess the scope and who is affected within 24 hours, notify the supervisory authority within 72 hours where the law requires it, and tell affected users when the risk warrants it. We record the incident and our reasoning even when no notification is required.

International transfers and age

The processors above operate across multiple regions, so your data may be processed outside your own country. Where that happens, transfers rely on the legal mechanisms in each processor's data-processing terms, and the sub-processor register records the processing region for each one.

You must be at least 16 to use ResumeFully, or older where local law sets a higher age for consenting to online services. We do not knowingly collect data from anyone below that age.

Changes to this policy

This policy is versioned. The effective date at the top of this page changes when the policy does.

We notify account holders before a material change takes effect — particularly one that widens what we collect or introduces a new category of data leaving the system.