Legal
Privacy Policy
Last updated 19 August 2026Victoria, Australia
This policy explains what Resumae collects, why we collect it, and the controls you have over your data.
Who we are
Resumae (https://resumae.xyz) operates this service. We are based in Victoria, Australia. For privacy questions, contact support@resumae.xyz.
What we collect
- Account information: name, email, and login identifier.
- Resume data: work history, education, skills, and other content you enter or upload.
- Job descriptions and chat: text you paste for analysis and messages with our AI assistant.
- Usage data: feature usage and error logs (no resume content in logs).
- Payment data: handled by Stripe. We do not store full card numbers.
- Analytics: page views and interactions on this marketing site and inside the Resumae app, using Google Analytics and Microsoft Clarity, and only if you accept analytics. This marketing site loads its analytics tags through Google Tag Manager. When analytics is enabled we also send Google Analytics an identifier for your account and your plan tier, so we can tell repeat sessions apart. This marketing site also measures its advertising through the Meta Pixel, TikTok Pixel, and OpenAI Ads Pixel, also only if you accept analytics; the app never loads them.
How we use it
- To provide and improve the resume tailoring service.
- To process payments and manage subscriptions.
- To communicate about your account or service updates.
- To understand usage and improve the product.
- To comply with legal obligations and enforce our terms.
AI processing
Resumae is an AI product, and the features you use are run by a third-party AI model provider rather than by software we host ourselves.
When you tailor a resume, analyse a job description, generate a cover letter, chat with the assistant, or run interview prep, the content needed for that feature is sent to our AI provider. That content includes your resume - employment history, education, contact details, and anything else you have put in it - along with the job description and any messages you write.
Requests go to OpenRouter, which passes them to the model provider we have selected - currently Google (Gemini). Requests are sent with data collection disabled, which restricts them to providers that do not retain your content or use it to train their models. Your resume and job-search content is not used to train AI models, ours or anyone else's.
AI output can be wrong or incomplete, so review anything you send to an employer. As our Terms note, avoid entering highly sensitive information - government identifiers, medical records, or financial account details - unless it is genuinely needed for the role.
Third parties & storage
We do not sell your personal information. We do rely on the providers below to run the service, and each one receives only what its job requires:
| Provider | Purpose | What it receives |
|---|---|---|
| OpenRouter, and the model provider it routes to (currently Google) | AI processing | Resume content, job descriptions, chat messages, cover letters, and interview-prep transcripts |
| Firebase (Google) | Sign-in and account identity | Email address and authentication tokens |
| Stripe | Payments and subscriptions | Name, email, payment details, subscription status |
| Amazon Web Services (S3), in Sydney, Australia | File storage | Resume files you upload (PDF, DOCX) |
| Neon, in Sydney, Australia | Application database | Your account record and everything you save in the app |
| Resend | Transactional email | Email address and display name |
| Fly.io, in Sydney, Australia, and a managed cache provider | API hosting and caching | Request traffic, plus short-lived technical data such as download links and usage counters |
| Cloudflare | DNS, content delivery, bot protection, cookieless traffic analytics | Request metadata such as IP address and browser details. Cloudflare Web Analytics also collects cookieless traffic metrics on the marketing site; it sets no cookies and is not gated by the consent banner. See our Cookie Policy. |
| Our monitoring provider | Error and performance monitoring | API traces, metrics, and logs. Resume content is excluded. |
| Google Analytics | Product analytics, in the app and on the marketing site | Page views, interactions, account identifier, plan tier - only if you accept analytics |
| Microsoft Clarity | Session recordings and heatmaps, on the marketing site | Page interactions - only if you accept analytics |
| Google Tag Manager | Loads the marketing-site analytics tags | Tag configuration - only if you accept analytics |
| Meta Pixel (Meta Platforms) | Advertising measurement, on the marketing site | Page views and interactions - only if you accept analytics |
| TikTok Pixel (ByteDance) | Advertising measurement, on the marketing site | Page views and interactions - only if you accept analytics |
| OpenAI Ads Pixel | ChatGPT-ads conversion measurement, on the marketing site | Page views, conversions, page origin, and an ad-click identifier; depending on the tag settings, SHA-256-hashed contact information - only if you accept analytics |
Some features fetch information from other sites on your behalf: when you paste a job posting URL, our server retrieves that page, and compensation insights are looked up from public salary data. Those requests are made by our server and do not identify you.
Your data is stored in encrypted databases and file storage.
Where your data is stored
Everything you save is stored in Sydney, Australia: our application servers, our application database, and the file storage holding the resumes you upload all run there. Uploaded files are not publicly readable - they are reachable only through short-lived links the app issues to you.
Storage is not the whole picture, so to be clear about the rest: several of the providers above are based overseas, mostly in the United States. When a feature calls one of them - AI processing, sign-in, payments, or email - the data that feature needs is sent to that provider and processed outside Australia.
Your rights
You can:
- Access and correct your data.
- Export or delete your account via Settings.
- Withdraw consent for analytics at any time.
Users in the EEA and UK may have additional rights under GDPR and UK GDPR. Australian users have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including access, correction, and complaint rights with the Office of the Australian Information Commissioner (OAIC). New Zealand users may have rights under the Privacy Act 2020 (NZ). Contact us at support@resumae.xyz to exercise any right.
Retention & security
We keep your data while your account is active. If you delete your account, the deletion runs immediately rather than on a delayed schedule: your account record and the resumes, job descriptions, chat sessions, and cover letters attached to it are erased, and your sign-in identity is removed from our authentication provider. We keep a limited set of records where tax or legal obligations require it - billing records held by Stripe, and security audit entries recording that an account was cancelled or deleted. One known gap: a resume file you delete from Resumae before deleting your account can remain in our file storage (Amazon S3, Sydney) with no database record pointing to it, until it is removed by scheduled maintenance. We are fixing this.
We use HTTPS, encrypted storage, and least-privilege access. Resume content is not included in application logs.