Privacy Policy
Last updated: 24 August 2026
The short version
Your CV contains sensitive information about you. We store it to run the service, and we send parts of it to OpenAI when you use an AI feature. We do not sell it, and it is not used to train AI models. You can export or delete everything at any time.
1. Who controls your data
ResuMakeAi is operated by SKK Digital, based in Hanoi, Vietnam. For the purposes of the UK GDPR and EU GDPR, SKK Digital is the data controller.
Contact for any privacy matter: privacy@resumakeai.com
2. What we collect
Account data
- Email address, and name if you provide one
- Password (stored hashed by our authentication provider — we never see it)
- If you sign in with Google: your Google email, name and profile picture URL
CV and career data — this is the sensitive part
- Everything you type or upload into a resume: name, phone, address, email, employment history, education, skills, projects, certificates, languages, references
- Uploaded CV files (PDF, DOCX, TXT) and the text extracted from them
- Cover letters and interview preparation you generate
- Job descriptions you paste in for matching
Depending on what you include, this may contain data considered sensitive in your country — for example a photograph, date of birth, nationality, or details that reveal health or trade-union membership. Only include what you are comfortable sharing, and remember different countries expect different things on a CV.
Usage data
- Which AI features you use and when (to enforce plan limits)
- Views of any public resume link you enable, including approximate country and device type
- Basic server logs
Newsletter signup
- If you subscribe from the footer: your email address, and which page you signed up from
This is entirely separate from your account — you can subscribe without ever creating one. Unsubscribe any time using the link shown when you sign up, no login required.
Payment data
We do not see or store your card details. Payments are processed by PayPal. PayPal is our payment processor, not a merchant of record acting on our behalf, so we receive your subscription status, plan, billing period, and the PayPal transaction and subscription identifiers needed to keep your account in sync.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service you signed up for | Performance of a contract |
| Sending CV text to AI providers when you use an AI feature | Performance of a contract |
| Enforcing plan limits and preventing abuse | Legitimate interests |
| Billing and tax records | Legal obligation |
| Service emails about your account | Performance of a contract |
| Newsletter emails, if you subscribe | Consent — withdraw any time via the unsubscribe link |
4. Who we share it with
We use the following sub-processors. Each receives only what it needs.
| Provider | What it receives | Where |
|---|---|---|
| Supabase | All account and CV data (hosting and database) | EU / US |
| OpenAI | CV text and job descriptions, when you use an AI feature | US |
| PayPal | Email and payment details | US / global |
| Adzuna and other job boards | Search keywords only — never your CV | UK / EU / US |
| Vercel | Application hosting and request logs | US / global |
On AI training: we use OpenAI's API. Under OpenAI's current API terms, data submitted through the API is not used to train their models. We do not use your content to train any model of our own.
We do not sell your personal data, and we do not share it with advertisers.
5. International transfers
We operate from Vietnam and our providers are located in the EU, UK and US. Where data leaves the UK or EEA, transfers rely on Standard Contractual Clauses or equivalent safeguards operated by those providers.
6. How long we keep it
- Account and CV data — for as long as your account is open.
- Deleted resumes — removed from your account immediately and permanently purged within 30 days.
- Closed accounts — personal data deleted within 30 days.
- Billing records — retained as long as tax law requires, typically up to 7 years. These are held by us and by PayPal as our payment processor.
- Server logs — up to 90 days.
- Newsletter subscriptions — until you unsubscribe.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, export or restrict processing of your data, to object to processing based on legitimate interests, and to withdraw consent.
In practice:
- Access and export — download any resume as PDF or DOCX at any time. For a full export of everything we hold, email us.
- Correction — edit anything directly in the app.
- Deletion — Settings → Delete account, or email us.
We respond to requests within 30 days. If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority.
8. Public resume links
If you turn on a share link, that resume becomes readable by anyone with the URL — including search engines, if the link is posted publicly. We record views (timestamp, approximate country, device type) so you can see engagement. Turn sharing off at any time and the link stops working immediately.
9. Cookies
We use strictly necessary cookies to keep you signed in and to remember a referral code if you arrive via a referral link. We do not use advertising or third-party tracking cookies.
10. Security
Data is encrypted in transit and at rest by our hosting provider. Database access is restricted per user by row-level security policies. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as required by law.
11. Children
The Service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes
We will post any changes here and update the date above. For material changes we will notify you by email or in the app.