Privacy Policy

This Privacy Policy explains how Resumr (“Resumr,” “we,” “us” or “our”) collects, uses, discloses and protects personal information when you use getresumr.com, the Resumr app and related services (the “Service”), and the rights you have. It is part of our Terms of Use.

Resumr is the business responsible for your personal information (the “controller,” under laws that use that term). If you have questions, reach us through the Contact page.

We use personal information to:

• Provide the Service: create and keep your account, save your work, render previews, and create the files you download.
• Keep the Service and accounts secure: authenticate you, run 2-step verification, detect and prevent fraud, abuse and security incidents, and enforce our Terms.
• Respond to support requests and other messages, and keep a record of them.
• Send messages about your account and the Service, such as security alerts, password resets and notices of changes to our terms. We don’t send marketing emails without your permission.
• Fix problems and improve the Service.
• Comply with the law, respond to lawful requests, and protect the rights, safety and property of our users, the public and Resumr.

We don’t use your personal information for advertising, we don’t sell or rent it, and we don’t use your documents to train AI models. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

If laws such as the GDPR apply to you, we rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent abuse, fix problems and improve it, in ways that don’t override your rights.
• Consent: for anything we ask your permission for, such as optional features. You can withdraw consent at any time.
• Legal obligation: to comply with the law.

When you import an existing resume, Resumr reads the file in your browser and turns its text into editable sections. The original file isn’t uploaded for that step. Only the content you keep is saved to your account.

AI features are optional. If you use one with an AI provider you’ve connected with your own API key, the text you choose to send goes to that provider and is handled under its terms and privacy policy. We don’t use your content to train AI models.

We disclose personal information only in these situations:

• Service providers that process it on our behalf, under contracts that limit their use of it: Supabase (authentication, database and file storage), our website hosting provider, Resend (delivering support emails), and public content delivery networks such as jsDelivr that deliver fonts and code and receive your IP address as any website does.
• At your direction: when you share a document or make a profile public, or connect a sign-in provider or AI provider.
• Legal reasons: when we believe in good faith it’s required by law, subpoena or court order, or necessary to protect the rights, safety or property of our users, the public or Resumr, including to investigate fraud or security issues.
• Business transfers: in connection with a merger, acquisition, financing, reorganization or sale of assets, in which case this policy, or one at least as protective, will continue to apply to your information.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising (targeted ads), as those terms are defined in California and other state laws. We haven’t done so in the past 12 months.

Resumr uses only essential cookies, to keep you signed in and secure, and stores preferences in your browser. There are no advertising or analytics cookies. See our Cookie Policy for the full list, and use Cookie Settings at the bottom of any page.

Because we don’t sell or share personal information for targeted advertising, there is nothing for a Global Privacy Control (GPC) signal to opt you out of, but we honor it as a valid request to opt out if you send one. We don’t respond differently to “Do Not Track” signals, because we don’t track you across sites.

• Account, profile and documents: for as long as your account is open. Items you delete go to Recently Deleted until you restore them or delete them permanently.
• After you delete your account: we delete your account, profile and documents. Copies in routine backups are removed as those backups expire.
• Support requests: for as long as needed to help you and keep a record of the request, and then deleted.
• Records of your agreement to our terms: for as long as needed to show what you agreed to and to meet legal obligations.
• Logs: for the limited periods our providers keep them for security and troubleshooting.

We may keep information longer if the law requires it or to resolve disputes and enforce our agreements.

We protect your information with HTTPS encryption in transit, encryption at rest by our database provider, database rules that limit each account to its own data, encrypted storage of AI keys, and sign-in protections including passkeys and 2-step verification. No method of transmission or storage is completely secure, so we can’t guarantee absolute security. Please use a strong, unique password or a passkey, and turn on 2-step verification. Our Security page has more detail and explains how to report a vulnerability.

If a security breach affects your personal information, we’ll notify you and the authorities as the law requires.

In the past 12 months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act:

• Identifiers, such as name, email address, IP address and account identifiers.
• Customer records, such as contact details you put in your profile.
• Professional or employment-related information, such as work history, skills and the jobs you track.
• Education information you add to your documents.
• Internet or network activity, such as log data about your use of the Service.
• Audio or visual information, such as photos you add and screenshots or videos you attach to support requests.
• Sensitive personal information: account sign-in credentials. We use it only to provide and secure the Service.

We collect these from you, from your device, and from sign-in providers you connect, for the business purposes described in “How we use information,” and we disclose them only to the recipients described in “How we disclose information.” We don’t sell or share them for targeted advertising, and we don’t offer financial incentives for personal information. California’s “Shine the Light” law lets residents ask about disclosures for direct marketing; we make no such disclosures.

Resumr is operated from the United States, and our providers process information in the United States and other countries. If you use the Service from outside the United States, your information will be transferred to, stored and processed in countries whose data protection laws may differ from yours. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses.

The Service isn’t directed to children under 13, and we don’t knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we’ll delete it. We don’t sell or share the personal information of anyone, including users under 16.

We may update this policy from time to time. When we do, we’ll change the “Last updated” date above. If a change is material, we’ll tell you in the app or by email before it takes effect. We won’t use your information in a materially different way from what this policy described when we collected it without your consent.

Questions, requests or complaints about this policy or your information: email privacy@indr.app, or use the Contact page and choose “Privacy.”