Privacy Policy - Rezumia

This Privacy Policy describes how Rezumia ("we," "us," "our") collects, uses, shares, and safeguards personal information when you visit our website, use our AI resume builder, request done-for-you writing services, or otherwise interact with us. We've tried to write this in plain English. If anything is unclear, please contact us.

1. Information We Collect

1.1 Information you provide

Account details - name, email, password.
Resume & career content - work history, education, skills, summaries, links, and any files you upload (such as an existing resume or cover letter).
Lead capture forms - when you ask us to contact you, we collect the name, email, phone number, the service you're interested in, and any file you attach.
Billing details - handled by our payment processor (Stripe). We store the payment-method token, not your full card number.
Communications - emails, chat messages, survey responses, and support tickets.

1.2 Information collected automatically

Device and browser data (type, OS, screen size).
IP address and approximate location derived from it.
Usage logs (pages viewed, features used, timestamps).
Cookies and similar technologies - see Section 6 below.

1.3 Information from third parties

If you sign in via a third-party identity provider, we receive the basic profile fields you authorize (typically name and email). We may also receive analytics and fraud-prevention signals from service providers.

2. How We Use Your Information

To provide, operate, and improve the Services.
To generate AI suggestions for your resume or cover letter on your behalf.
To match you with the right writer and route your order through our workflow.
To process payments and prevent fraud.
To respond to leads, support requests, and customer messages.
To send transactional emails (order updates, password resets) and, with your consent, marketing emails you can unsubscribe from at any time.
To comply with legal obligations and enforce our Terms.

3. Legal Bases (EEA / UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Contract - to provide the Services you've purchased.
Legitimate interests - to operate our business, prevent fraud, and improve our product.
Consent - for optional marketing and certain cookies; you may withdraw at any time.
Legal obligation - when retention is required by tax, accounting, or law-enforcement rules.

4. Sharing & Disclosure

We do not sell your personal information. We share it only with:

Service providers - cloud hosting, email, payments (Stripe), AI model providers, and customer support tools, all bound by data-processing agreements.
Writers assigned to your order - only the data necessary to complete your brief.
Legal & safety - to comply with valid legal requests or to protect rights, property, and safety.
Business transfers - in connection with a merger, acquisition, or asset sale, with notice to you.

5. AI Processing

When you use AI features, the relevant portions of your content are sent to our AI providers solely to generate output for you. We instruct providers not to use your content to train their foundation models, and we never share your data with them outside the scope of the request you initiated.

6. Cookies & Tracking

We use strictly necessary cookies to keep you signed in and secure, analytics cookies to understand product usage, and (with consent) marketing cookies to measure ad effectiveness. You can manage cookies via your browser settings or our cookie banner.

7. Data Retention

We keep your account and resume content for as long as your account is active and for a reasonable period thereafter so you can resume work. Lead-form submissions are retained for up to 24 months. Billing records are retained for the period required by tax law (typically 7 years). You may request earlier deletion at any time.

8. Your Rights

Depending on where you live, you may have the right to:

Access or download a copy of your personal data.
Correct inaccurate information.
Delete your account and associated data.
Object to or restrict certain processing.
Port your data to another service.
Withdraw consent for marketing or optional features.

California residents have additional rights under the CCPA/CPRA, including the right to know what categories of information we collect and to opt out of "sharing" for cross-context behavioral advertising. To exercise any of these rights, email our team; we respond within 30 days.

9. Security

We protect your data with encryption in transit (TLS) and at rest, role-based access controls, regular security reviews, and secret-management best practices. No system is perfectly secure, so please use a strong, unique password and notify us immediately if you suspect unauthorized access.

10. International Transfers

Rezumia is based in the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S. and in other countries where our service providers operate. We use Standard Contractual Clauses or equivalent safeguards where required.

11. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, for significant changes, notify you by email or through the Services.

13. Contact

If you have questions, complaints, or want to exercise your privacy rights, please reach out via our contact page or call 1-628-214-5638.