When you create an account: your name, email address, and password (stored as a salted Argon2id hash — we never see or store your plain-text password), or your Google account ID, name, email, and profile photo if you sign in with Google.
When you build your Career Profile: work experience, education, skills, projects, certifications, and achievements you choose to enter — this is the "source of truth" the rest of the product is built from.
When you use Job Match Analysis or the Resume Optimizer: the job description text you paste, and the resume versions and AI suggestions generated from it.
Automatically: your IP address (used to detect your billing region and for security/rate-limiting), browser/device information, and product usage events needed to operate features like your plan's monthly usage limits.
Billing information: if you upgrade to Pro, payment is processed by Stripe or Razorpay directly — ResumeDesk stores the resulting invoice, amount, currency, and payment status, but never your full card number.
Your Career Profile and job description text are sent to a third-party AI provider (Anthropic's Claude API) to generate Job Match Analyses, resume rewrite suggestions, ATS Intelligence reports, and Application Copilot content. Every AI pipeline call is logged (token counts, latency, and whether it succeeded) so usage can be monitored — this log does not include the full content of what was generated.
We use a single first-party session cookie to keep you signed in — no third-party advertising or tracking cookies. Your session is stored server-side in our database (not just in the cookie), which lets you see and revoke your active sessions from Account Settings → Security.
We do not sell your personal information, and we do not share your Career Profile data with employers, recruiters, or any other third party without your explicit action (e.g., you choosing to download and send your own resume).
We keep your data for as long as your account is active. If you delete your account from Account Settings, your session is destroyed immediately and your account is scheduled for deletion. Some records (like billing invoices and security audit logs) may be retained longer where required for accounting, fraud prevention, or legal obligations, in line with applicable law.
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can update or delete most of your Career Profile data directly in the product at any time. For anything else, contact us at the address below.
We use prepared statements everywhere (no raw SQL), CSRF protection on every form, Argon2id password hashing, rate limiting on authentication endpoints, and an audit log of security-relevant account events. No system is perfectly secure, but we treat your data the way we'd want our own treated.
ResumeDesk is available globally. Depending on your region, your data may be processed in a different country than the one you live in (including by our AI, payment, and email providers). We rely on those providers' own compliance frameworks for cross-border data transfers.
We may update this policy as the product evolves. Material changes will be communicated by email or an in-product notice before they take effect.
Questions about this policy, or requests to access/export/delete your data, can be sent to privacy@resumedesk.harait.com.