Privacy Policy

1. Data We Collect

We collect the following categories of data:

• Account information: Email address and display name, collected when you sign up or sign in via email or OAuth.
• Resume content: All text you enter into the resume builder, including job history, skills, certifications, and contact details. This data is stored to power saving and AI features.
• AI usage logs: We log when AI features are used (e.g., bullet generation, resume tailoring) to enforce daily usage limits. We do not store the full AI output.
• Device and browser information: Device type, operating system, and browser are collected when you sign in to improve security and analytics. We do not use fingerprinting or persistent tracking.
• Payment information: We do not store full credit card numbers. Payment details are handled by Stripe and are subject to their privacy policy.
• Support messages: Messages you send via the support form.

2. How We Use Your Data

• To provide and improve the ResuBlue resume building service.
• To generate AI-powered resume suggestions via Groq AI. Your resume content may be sent to Groq's API to fulfill your requests. Groq processes data according to their privacy policy.
• To enforce daily usage limits and subscription tiers.
• To send transactional emails (account confirmations, billing receipts, support replies). We do not send marketing emails without your consent.
• To detect and prevent security threats and abuse.

3. Third-Party Services

We share data with the following third parties only to the extent necessary to operate the service:

• Groq AI — LLM inference for AI resume features. Resume text is sent to Groq when you use AI features.
• Stripe — Payment processing. We share your email and name to create a billing account.
• Resend — Transactional email delivery. Your email address is shared to send account and billing notifications.
• Neon (PostgreSQL) — Database hosting. All your data is stored on Neon-hosted infrastructure in the US.
• Vercel — Hosting and serverless functions. Your requests are processed on Vercel infrastructure.
• Google, GitHub, LinkedIn, Microsoft, Salesforce — OAuth sign-in providers. When you sign in with one of these providers, they share your name and email with us. We do not store OAuth access tokens beyond what is needed for the session.

We do not sell your personal data to any third party.

4. Data Retention

• Account data (email, name, tier) is retained for as long as your account is active.
• Resume data is retained until you delete the resume or close your account.
• On account deletion, all resumes, sessions, and personal data are permanently deleted within 30 days.
• Email logs and audit logs may be retained for up to 12 months for security purposes.

5. Your Rights

Under GDPR (Article 17) and CCPA, you have the following rights:

• Access: You can view all your stored resume data from the builder.
• Correction: You can edit or update your data at any time via the builder or account settings.
• Deletion (Right to be Forgotten): You can delete your account from the account settings page. This permanently removes all your data.
• Portability: You can export your resume as PDF or DOCX at any time.

To exercise any of these rights, you can use the account settings page or contact us at privacy@resublue.com.

6. Cookies

ResuBlue uses a single session cookie to keep you signed in. This cookie is:

• HttpOnly — not accessible by JavaScript
• Secure — transmitted only over HTTPS
• SameSite=Lax — CSRF-protected

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We use localStorage only to store your cookie consent preference and UI state.

7. Contact

For privacy-related questions or requests, contact us at: privacy@resublue.com