Data Privacy & GDPR
Last updated: 11 September 2026
This page explains how ResmiAI handles personal data under the EU/UK General Data Protection Regulation (GDPR) and comparable privacy laws. It complements our Privacy Policy, which describes what we collect in the first place.
1. Who is responsible for your data
ResmiAI is the data controller for the personal data processed through the service. We decide why and how that data is processed, and we are accountable for doing so lawfully. You can reach our privacy team at [email protected].
2. Our data-protection principles
- Lawfulness, fairness and transparency — we say what we do and we do what we say.
- Purpose limitation — data is used only for the service you asked for.
- Data minimisation — we never request sensitive or special-category data.
- Accuracy — your career profile is yours to correct at any time.
- Storage limitation — we keep data only as long as needed, then delete it.
- Integrity and confidentiality — encryption, access control and audit logging by default.
- Accountability — we can demonstrate the controls above for every plan, including free.
3. Lawful bases for processing
We rely on the following lawful bases under Article 6 GDPR:
- Performance of a contract — creating your account, storing your career profile, generating documents and administering your subscription.
- Legitimate interests — keeping the service secure, preventing abuse, enforcing quotas and improving reliability. We balance these against your rights and never use them to override them.
- Consent for optional measurement — Google Analytics 4 cookies that count visits and show which pages and features are used. They are the only non-essential storage we use, they are never used for advertising, retargeting or profiling, and you can refuse or remove them at any time as described in the Cookie Policy.
- Legal obligation — retaining billing records and responding to lawful requests.
- Consent — where we ask for it, including accepting our policies and any optional communication. You can withdraw consent at any time.
We do not process special-category data (Article 9) and we do not use your data for automated decision-making that produces legal or similarly significant effects.
4. Your rights under the GDPR
You can exercise most of these rights yourself, instantly, from your profile and Settings page. For anything else, contact us and we will respond within one month, as required by law.
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Correct inaccurate or incomplete data directly in your profile, or ask us to correct it.
- Right to erasure: Delete your account and all associated data at any time from Settings — no support ticket required.
- Right to restrict processing: Ask us to limit how your data is used while a request is being resolved.
- Right to data portability: Receive your data in a structured, commonly used, machine-readable format.
- Right to object: Object to processing based on legitimate interests at any time.
- Right to withdraw consent: Withdraw consent where processing is based on consent; this does not affect prior lawful processing.
- Right to lodge a complaint: Complain to your national data-protection authority. We would appreciate the chance to resolve it first.
5. How long we keep data
| Data category | Retention period |
|---|---|
| Account and career profile | While your account is active; deleted immediately when you delete your account. |
| Applications and generated documents | While your account is active, or until you delete the individual item. |
| Uploaded files (standalone ATS check) | Never stored — the CV is parsed in memory and only a one-way hash is retained so the score can be reused. |
| AI usage records (credits, tokens) | Kept while your account is active for billing and quota integrity; removed on deletion. |
| Billing and invoice records | Retained as required by tax and accounting law, even after account deletion. |
| Security and audit logs | Kept for a limited period to detect and investigate abuse, then purged. |
| Analytics measurements (Google Analytics 4) | Held for the retention period configured on our analytics property (14 months maximum); pseudonymous usage statistics only, and not linked to your career data. Deleted from our GA4 property on request. |
6. Recipients and sub-processors
We share the minimum data necessary with the following categories of processors. Each is bound by a data-processing agreement and may use your data only to provide the service we describe.
| Processor | Purpose | Data shared |
|---|---|---|
| AI model provider (secured API) | Generating and tailoring documents; analysing job descriptions. | Relevant profile fields, job description text and the requested output type. |
| Sign-in only (OAuth). | Basic profile: name, email address and profile picture URL. | |
| Google Analytics (Google Ireland / Google LLC) | Aggregate usage and traffic-source measurement (measurement ID G-JM3XX8T3B9). Never used for advertising, retargeting or profiling. | Page paths, referring site or campaign parameters, coarse device/browser/region information and product milestone categories. When signed in, the account’s opaque internal ID — never your email, name, CV, cover letter or job description content. |
| Sign-in only (OAuth). | Basic profile: name, email address and profile picture URL. | |
| Stripe | Subscription billing and the secure payment portal. | Email address and billing details. Card data goes directly to Stripe — we never store full card numbers. |
| Cloud hosting and database provider | Running the service and storing encrypted data. | All service data, encrypted in transit and at rest. |
| Transactional email provider | Account and service notifications. | Email address and message metadata. |
We never sell your data, and we never share it with advertisers or data brokers.
7. International transfers
- We use Standard Contractual Clauses (SCCs) approved by the European Commission for transfers of personal data outside the EEA/UK.
- We complete transfer-impact assessments where required and adopt additional technical measures — encryption in transit and at rest, and minimised data sets.
- Data is processed only by vetted processors bound by data-processing agreements, and only for the purposes listed above.
- We never transfer your data to advertisers or data brokers, because we do not work with them.
8. Security
Encryption in transit and at rest, ownership checks on every protected resource, least-privilege access and audit logging apply to every account — free and paid alike. See our Security page for details.
9. Cookies and browser storage
We use the minimum browser storage needed to keep you signed in, plus optional Google Analytics 4 measurement cookies that count visits and show which pages and features are used. We use no advertising, retargeting or cross-site tracking cookies. See the Cookie Policy for the exact list, what the measurement records, what is excluded, and how to refuse it.
10. Children
ResmiAI is not intended for children. You must be at least 16 years old to use the service, and we do not knowingly collect data from anyone under that age. If you believe a minor has created an account, contact us and we will remove it.
11. Changes and contact
We will notify you of material changes through the service. Requests, objections and complaints can be sent to [email protected]; you also have the right to complain to your national supervisory authority.