Privacy policy

Your resume is yours. It is private until you turn on a public link, we do not sell your data, we show no ads and we use no tracking cookies.

• We only store what you write to build your CV and the minimum needed for your account to work.
• Sharing is off by default and you can turn it off whenever you want.
• You can export or delete all your data from Settings.
• The AI features (PDF import and the assistant) are optional: they send to an AI model only the text needed for each request, and we do not use your content to train models.

The controller of your data is Francisco Cea, who operates uResume. For any question or to exercise your rights, write to contact@uresu.me.

Depending on how you use uResume, we process:

• Your CV content: name, email, phone, location, links, experience, education, projects, skills and any other text you write.
• Account data: your email, your name and how you sign in: a password (we only keep an irreversible hash, never the password itself) and/or Google or GitHub (we keep that provider's account identifier and the tokens it issues).
• Public link settings: whether they are active, optional password (also stored as a hash), expiry date, download options and, for each visit or download, only its date and type.
• Preferences: light or dark theme, language and the default format for your new CVs.
• Session data: when you sign in we store the IP address and browser (user agent) of that session, to keep you signed in and protect your account.
• Version history: copies of each CV (the 30 most recent plus up to 5 pinned), created while you edit or when you save them.
• AI usage records: for each AI request, which feature was used, the model, the number of tokens, the cost in credits, the date and which CV it was for; the monthly credit counter; and a note (type and date) of requests that failed or were blocked by a limit.
• Assistant data: the recent conversation with the assistant for each CV (up to the last 20 messages, kept for 30 days) and the job postings you give it, saved as structured data (role, company, location, work mode, requirements with short quotes from the text that support them, skills, salary if published and the analysis), up to 5 per CV. The full text you paste, or the text of a linked page, is not stored: only that data and the link address (without tracking parameters).
• Account status: your plan, your role (user or administrator), whether the account is suspended and the date of your last activity, which we derive from your sessions.
• ATS checks: the latest check of each CV's PDF: its result, the findings and the text extracted from the PDF to analyze it. It is replaced on every check, deleted with its CV or with your account, and never sent to AI models.

We do not ask for sensitive data and you do not need to include it in your CV. You decide what information to publish.

We use your data only for these purposes:

• Providing the service you ask for: saving your CVs, showing the preview, generating the PDF and serving your public links.
• Authenticating you and protecting your account and the service, including preventing abuse and fraud.
• Optional AI features, only when you choose to use them.
• Enforcing usage limits and measuring the cost of the service.
• Improving and maintaining uResume, using aggregated metrics that do not identify you.
• Complying with legal obligations and answering authority requests where applicable.

We rely on performing the service you request, on your consent when you use optional features, on our legitimate interest in keeping the service secure and on legal obligations. We do not sell your data or use it for advertising.

Your account, your CVs, their versions and your preferences are stored on our servers, in a database managed by a cloud infrastructure provider, linked to your account. While signed in, only you can access them; other people only see what you share through a public link.

When you delete a CV it goes to the trash and is permanently deleted after 30 days. We keep the 30 most recent versions of each CV (and up to 5 pinned), assistant conversations for 30 days, and AI usage records while your account exists. When you delete your account, all your data is deleted right away. Our providers may keep technical backups for a limited time.

The servers may be located outside your country, so your data may be processed abroad.

To create the PDF or the .zip with the LaTeX code, the content of your CV is sent to our server, compiled and the result is returned to you. The server does not keep a copy of the PDF: it works with temporary files that are deleted at the end of each request.

The editor preview is computed in your browser and sends nothing.

PDF import: when you import a PDF, the server extracts its text and sends it to an AI model to turn it into CV fields. The PDF file is not stored.

Assistant: to answer you, we send the model the content of the CV you have open (including unsaved changes), your messages and, if you attached one, the job posting you gave it. If you type a link to a posting, our server opens that public page (respecting the site's robots.txt, without signing in) and sends its text to the model; pages that require a login, such as LinkedIn's, are not read: in that case we ask you to paste the text. The assistant only proposes changes: nothing is modified until you review and apply them.

Requests go through an AI model-access platform to the provider of the model we configure for each task (this may change over time), which processes them under its own policies and may do so outside your country. We do not use your content to train models. Do not include in your CV or in your messages data you would not want to be processed this way.

Each account has a monthly allowance of AI credits that depends on its plan (today, the free plan, which may change). Usage records are kept to enforce that limit, protect the service against abuse and measure its cost. You can clear the assistant's conversation at any time; the conversation and the saved postings are deleted with their CV or with your account.

When you turn on a link, anyone who has it can see the version of the CV you decide to share. You can protect it with a password, set an expiry date, hide your contact details, prevent downloads and revoke it at any time; when you do, it stops working immediately.

We count visits and downloads, and the date of the last visit, so we can show them to you. We do not store the IP or identity of the people who visit your link, although our hosting provider's server logs may record technical data such as IP addresses.

We use no advertising, analytics or tracking cookies. We only use these cookies and local storage entries, all of them necessary for the service to work or to remember your choices:

• Session (up to 30 days): keeps you signed in.
• Language (1 year): remembers the language you chose.
• Sign-in with Google or GitHub (a few minutes): only while you sign in with that provider, to complete it securely.
• Preferences in your browser (local storage): light or dark theme and the size of the assistant panel. The state of the guided tour is kept only while the tab is open.

Because they are all strictly necessary or just remember your preferences, they do not require a consent banner. You can delete them from your browser whenever you want (you would be signed out). If we ever add other cookies, we will ask for your consent first.

• Sign in with Google or GitHub: if you choose it, that provider shares your email and profile name with us. Their handling is governed by their own policies.
• Overleaf: if you use "Open in Overleaf", we send the LaTeX code of your CV to that service at your request.
• Hosting and database: the site runs on third-party infrastructure that processes the requests needed to deliver it, and your data lives in a database managed by a cloud provider.
• AI models: if you use PDF import or the assistant, the text of the request is processed by a model-access platform and by the provider of the model we configure for each task (this may change over time), under their own policies.
• Job posting pages: if you share a link with the assistant, our server visits that public page to read it (it identifies itself as uResumeBot, respects the site's robots.txt and doesn't sign in). The site may log that visit as coming from our server, not from your device.
• Email delivery: we use a transactional email provider to send you account verification and password reset messages.

Fonts are served from our own site, with no calls to font providers.

We may change or add providers whenever we need to in order to operate the service, and we will announce relevant changes (see “Changes and contact”). You can ask us for the up-to-date list of providers by writing to contact@uresu.me.

At any time, from Settings, you can:

• Export your CVs as JSON.
• Edit or delete any of your CVs, versions and links.
• Delete your account, which deletes all your data (CVs, versions, links, sign-in methods, sessions, AI usage records, assistant conversations and saved postings) and turns off your links. The only exception is the administrators' audit log described above. This cannot be undone.
• Ask us, by writing to the contact below, for access, rectification, deletion, objection or portability of your data, or to restrict its processing.

If you need something that is not in Settings (for example, a copy of your account data), write to us at the contact below and we will reply as soon as possible, within 30 days at most.

A few people who run uResume have an administrator role. Through an internal panel they can see account data (name, email, plan, sign-in methods, dates, session count), the name, template and public link statistics of each CV, and AI usage, as well as aggregate metrics for the whole service. The panel does not show the content of your CVs or your conversations with the assistant.

Administrators can change a plan, add credits, reset a monthly allowance, or suspend an account, and also configure the AI models and the service's overall spending budget. Each of these actions is recorded in an audit log with the administrator's email and, where it applies, the affected account's, the action and the date. Because it exists for security and accountability, that log may be kept after an account is deleted.

We apply reasonable measures to protect your information, such as encrypted connections and hashed passwords (your account's and your links'). No system is infallible, so we recommend not including in your CV data you wouldn't want someone to see if you share the link.

If a security breach affects your data in a relevant way, we will notify you in the form and within the time the law requires.

uResume is not aimed at children under 14 and we do not knowingly collect their data. If you believe a minor registered, write to us and we will delete the account.

If we change this policy in a relevant way, we will say so on the site or by email and update the date above.

For questions or requests about your data, write to contact@uresu.me.