Privacy policy

This policy applies to Res.Me services that link to it. It does not cover an employer’s careers site or the independent services of Stripe, Calendly, your identity provider, or your email provider. Those services apply their own privacy terms when you choose to use them.

If you use Res.Me for another person, only upload information you are authorized to provide. Please do not upload Social Security or national identification numbers, dates of birth, financial account details, medical records, or other information that is not needed for a job application.

We collect data from you, your sign-in provider, and your use of the service:

Account and contact data

Email address, name, authentication identifiers, account status, and support or coaching messages you choose to send.

Resume and career data

Resume text, contact details contained in a resume, employment and education history, skills, credentials, and the structured profile created from an upload.

Job-search and application data

Job-posting text or links, target role and company, fit scores, tailored documents, editor decisions, workflow stage, private notes, cover letters, and any application materials you save when a feature is available.

Payments and credits

Credit balance, purchases, grants, redemptions, refunds, payment status, and Stripe transaction references. Stripe receives card details directly; Res.Me does not store your full card number.

Device, session, and product-use data

Essential session data, an anonymous session identifier, coarse page paths, allowlisted product events, device class, campaign labels, security signals, and short-lived hashed network identifiers used for rate limiting. Product telemetry does not contain resume text, job text, generated documents, names, email addresses, phone numbers, full URLs, or advertising click identifiers.

We use personal data only for the purposes below:

• Provide the service and perform our contract: authenticate your account, parse and save a base resume, score a role, generate and edit tailored documents, compile downloads, track applications, provide credits, process purchases, and answer support requests.
• Operate and protect the service based on legitimate interests: prevent abuse and fraud, keep the service reliable, measure privacy-safe feature usage, debug failures, and understand cost and performance. We balance these interests against your rights and minimize the data used.
• Use optional measurement with consent: load optional Google, Meta, LinkedIn, Reddit, or Metricool measurement tags only after permission, where configured.
• Meet legal obligations: maintain tax and transaction records, respond to valid legal process, enforce our terms, and establish or defend legal claims.

Where consent is the basis, you can withdraw it at any time without affecting processing that occurred before withdrawal.

When you request parsing, scoring, tailoring, rewriting, or drafting, the resume and job context needed for that task is sent to an AI API provider—currently OpenAI and/or Anthropic, depending on system configuration. We do not use your documents to train a Res.Me model, opt your content into provider training, or submit provider feedback that includes your content.

Commercial API inputs and outputs are not used for provider model training by default. Standard provider abuse-monitoring logs may be retained for up to 30 days. A provider may retain limited data longer when required by law or when its systems flag a suspected policy violation. We store separate internal usage metadata—such as provider, model, status, latency, and token counts—for reliability, fraud prevention, and cost accounting; those logs do not contain prompts, resume text, job text, or model responses.

Human review is optional. Nothing is automatically sent to Michael or another reviewer. If you email or book a human service, you choose what resume and context to provide, and that material is then used to respond to your request.

We disclose data only as needed to operate the service or when the law requires it:

• Infrastructure and authentication: Supabase and our application hosting, email, backup, and monitoring providers process account data under our instructions.
• AI providers: OpenAI and Anthropic process the relevant content for the feature you request, as described above.
• Payments: Stripe processes checkout and payment details and returns payment status and transaction references to us.
• Product analytics: PostHog may receive the sanitized, event-only product telemetry described above without a person profile or resume content.
• Optional services: Calendly processes booking information when you book; Google, Meta, LinkedIn, Reddit, or Metricool receive limited measurement events only after consent and only where those integrations are enabled. For consented Meta ad measurement, we may send the Meta browser and click cookies, request IP address, browser user agent, event URL, timestamp, event type, and a random conversion ID. We do not send Meta your email, phone number, name, résumé content, or job-description content.
• Legal and business events: professional advisers, authorities, or a successor may receive data when reasonably necessary for legal compliance, claims, security, financing, merger, or sale. A successor must honor this policy for transferred personal data.

Res.Me uses essential cookies or browser storage for sign-in, security, saved workflow state, and your privacy choice. We also use narrowly scoped, first-party product analytics to understand whether core features work. We do not enable session replay or send resume content to product analytics.

Optional advertising measurement is off until you choose Allow cookies. If enabled, those tags may receive a conversion category, safe campaign attribution, approximate page path, and purchase value—never resume content, job content, generated documents, or contact details. This optional measurement may be considered “sharing” for cross-context behavioral advertising under some U.S. state laws even though we do not sell personal data.

For Reddit measurement specifically, a consented conversion may include Reddit's click identifier and browser UUID, your IP address and browser user agent, the event page, timestamp, conversion category and conversion identifier, and currency or value for a purchase. We use these limited signals to measure whether an ad led to a completed audit, registration, checkout, or purchase. We do not send Reddit your email, phone number, account identifier, filenames, resume content, job descriptions, or pasted text, and we keep Reddit's automatic advanced matching disabled.

You can change this choice through the Privacy button in the site footer. Res.Me also treats a browser-enabled Global Privacy Control signal as a request to deny optional advertising measurement.

• Resume and application content: kept in your account so you can continue, edit, and download your work, until you delete it or delete the account.
• Original uploads: processed in memory and not placed in permanent file storage. Extracted text, structured resume data, and generated documents are stored in the account.
• Product events: raw account-linked events in our database are deleted after 90 days. Sanitized hosted analytics are retained only while needed to assess product performance, then deleted or aggregated under the provider account’s retention controls.
• Reddit advertising measurement: a consented Reddit click identifier and temporary checkout attribution may be retained for up to seven days so a verified payment can be measured server-side. Sanitized delivery receipts containing only event type, conversion ID, delivery status, attempt count, and timestamps are retained for up to 90 days.
• Operational AI and security metadata: retained as reasonably necessary for cost accounting, reliability, abuse prevention, and legal claims, then deleted or de-identified. It does not contain prompts or document content.
• Payment and credit records: retained for accounting, refunds, disputes, fraud prevention, and legal obligations. Deleting an individual resume or application does not delete its related purchase history. Account deletion removes Res.Me order and credit-ledger rows from the active service; Stripe and records we must keep by law may follow separate retention periods.
• Backups: deleted active-service data may remain temporarily in protected, access-restricted backups until rotation. Current encrypted database backups use a 14-day retention schedule.

Account deletion removes profile, resume, application, generated-document, workflow, feedback, credit, and account-linked telemetry records from the active service. Provider safety logs and backups expire on their own limited schedules. We may preserve a narrowly limited record when law, payment reconciliation, fraud prevention, or a legal claim requires it.

We use TLS in transit, encryption at rest, authenticated sessions, owner-scoped database controls, server-only credentials, restricted administrative access, SSRF-safe job-link fetching, rate limits, and encrypted backups. Card details remain with Stripe.

No system is perfectly secure. Please use a strong sign-in method, keep account access private, and contact us promptly if you believe your account or data is at risk. Our security page describes current controls and their boundaries in more detail.

Fit scores, suggestions, verification labels, and generated drafts are decision-support tools for you. They may be incomplete or wrong and do not make an employment decision, submit an application, or create a legal or similarly significant effect. Review every document for accuracy before using it. You can ignore a score, edit the output, and decide what to send.

Depending on where you live, you may have rights to know or access personal data, receive a portable copy, correct inaccurate data, delete data, restrict or object to processing, withdraw consent, opt out of sale or qualifying sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising a right.

We do not sell personal data. We do not use sensitive personal information to infer characteristics or for purposes unrelated to delivering the service. We honor Global Privacy Control for optional advertising measurement.

Sign in, then use Settings to export a portable copy, correct account data, or delete the account. The in-app export covers user-facing account records; for a broader access request, objection, restriction, authorized-agent request, or other privacy question, email support@resme.cloud. We may need to verify your identity and the agent’s authority. We aim to respond within 30 days and will always respond within the period required by applicable law or explain any permitted extension.

If we deny a request, reply with the subject “Privacy appeal” and explain why you believe the decision should be reconsidered. You may also complain to your local data-protection authority or state regulator. EEA and UK residents can contact the supervisory authority where they live or work.

Res.Me is operated in the United States, and our providers may process data in the United States and other countries. Where required, we rely on contractual safeguards, adequacy decisions, or another lawful transfer mechanism. You may contact us for more information about safeguards relevant to your data.

Res.Me is a job-search service for adults and is not directed to children under 16. We do not knowingly collect personal data from a child under 13. If you believe a child provided personal data, contact us so we can investigate and delete it.

We check primary provider documentation when describing how infrastructure, payments, and AI processing work. These links describe provider defaults and service controls; they do not replace the Res.Me-specific commitments in this policy.

• Supabase row-level security documentation
• Stripe integration security guide
• OpenAI business and API data-use policy
• Anthropic API data-retention policy

We may update this policy as the product, providers, or law changes. We will post the new effective date here and provide additional notice in the service or by email when a change materially affects how we use personal data.

Privacy questions and requests: support@resme.cloud or use the contact page.