This Privacy Policy describes how Resumorah ("we," "us," or "our") collects, uses, and stores information when you use our CV generation service (the "Service"). This document is provided for transparency. [PLACEHOLDER: have qualified legal counsel review and finalize this policy for your jurisdiction and business structure.]
Information we collect
We collect information you provide directly, information generated through your use of the Service, and limited technical data needed to operate the application.
Account information
When you register, we collect details such as your name, email address, and a hashed password (for email/password sign-in). If you use Google OAuth, we receive profile information made available by Google (such as name, email, and profile image) according to your Google account settings.
CV and resume content
Content you enter into the CV builder, including employment history, education, skills, summaries, and related fields, is stored so you can edit, save, and export your CVs. You control what you submit.
Authentication information
We use Auth.js (NextAuth) with JWT-based sessions. Session tokens and related authentication data are used to keep you signed in and to protect access to your account and CVs.
AI processing
When AI features are enabled and you choose to use them, relevant text you submit (such as summaries or experience descriptions) may be sent to a configured AI provider (for example, an OpenAI-compatible API) to generate suggestions. You must accept suggestions before they are applied. Do not submit sensitive personal data you do not want processed by third-party AI services.
PDF generation
PDF export is generated on our servers from your saved CV data and selected template. Export requests require authentication and ownership checks; we do not generate PDFs from arbitrary client-supplied content without those controls.
How we use information
- Provide, maintain, and improve the Service
- Authenticate users and enforce access to CVs
- Save and sync your CV content
- Generate AI suggestions when you request them
- Produce PDF exports when you request them
- Respond to support or legal requests where applicable
Data storage
Account and CV data are stored in MongoDB (or a compatible database) hosted by a provider you configure for deployment (for example, MongoDB Atlas). Data location depends on your database hosting region and provider settings.
Third-party services
The Service may rely on third parties such as:
- Hosting (for example, Vercel)
- Database hosting (for example, MongoDB Atlas)
- Authentication (Google OAuth when enabled)
- AI providers (when API keys are configured)
Each provider processes data according to its own terms and privacy policies. [PLACEHOLDER: list the specific vendors and links you use in production.]
Google OAuth
If you sign in with Google, Google processes your authentication according to Google's policies. We receive limited profile information to create or update your account as described above.
Cookies and session technologies
We use cookies or similar session mechanisms required for sign-in and security, and to remember your language, theme and appearance preferences. These are essential or functional rather than advertising tracking.
Data retention
We retain account and CV data while your account is active and as needed to provide the Service. [PLACEHOLDER: define retention periods, backup retention, and deletion practices with legal advice.]
Security
We use industry-standard measures such as password hashing, server-side access controls, and ownership checks on CV operations. No method of transmission or storage is completely secure.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or export personal data. [PLACEHOLDER: describe how users can exercise rights and any regional requirements after legal review. We do not claim compliance with GDPR, CCPA, or other regimes unless formally established.]
Children's privacy
The Service is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. [PLACEHOLDER: adjust age threshold per applicable law.]
Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. [PLACEHOLDER: describe how you will notify users of material changes.]
Contact
For privacy questions or requests, contact: [PLACEHOLDER: privacy contact email or web form]. [PLACEHOLDER: do not list a legal entity address until confirmed with counsel.]