Privacy Policy

This Privacy Policy explains what information ResumeLove collects, why we collect it, who we share it with, and the choices and rights you have. We have tried to write it in plain English. If anything is unclear, please reach out using our contact form at /contact.

In this Policy, "Company", "we", and "us" mean ResumeLove LLC. "You" and "User" mean the person using the Service. "Service" means the ResumeLove website and app at https://resumelove.com. "Resume Content" means everything you enter or upload — resume text, work and education history, contact details, photos, cover letters, and interview-prep inputs. "AI Features" means the AI scoring, feedback, and generation features. "Public Page" means a User-published public web page of their resume. "Pass" and "Subscription" are our paid offerings. A "Sub-processor" is a third party that processes data on our behalf, and the "Sub-processors page" is our canonical public list of them.

1. Who we are

ResumeLove is a web-based resume builder operated by ResumeLove LLC, a US-based company. We are currently pre-production. We process and store data in the United States. You can reach us using the in-app "Contact us" form (when you are signed in) or our public contact form at /contact. Our postal address is 30 N Gould St Ste N, Sheridan, WY 82801.

For privacy purposes, we are the "controller" of your personal data — meaning we decide why and how it is used. The vendors who help us run the Service (listed on our Sub-processors page) act as our processors.

2. A note about sensitive information in resumes

A resume is one of the densest bundles of personal information a person can create. Its free-text fields can easily contain information that the law treats as "sensitive" or "special category" — for example, health or disability details, race or ethnicity, religion, political opinions, union membership, or sexual orientation — often included by accident.

We take this seriously. We process this information only because you chose to provide it, and only to deliver the Service you asked for. We do not try to guess, infer, or label sensitive categories about you, and we do not use this information to make decisions about you. If you would rather not include sensitive details, you can leave them out — your resume will still work.

3. Information we collect

Account data. Your name, email address, and a hashed (one-way-scrambled) password.

Resume Content. The full content you enter or upload to build your resume — work and education history, contact details, an optional photo, and free-text fields that may contain sensitive information (see Section 2). This also includes your cover letters and interview-prep inputs, which are simply more AI processing of the same kind of personal information.

Billing data. When you buy a Pass or Subscription, payment is handled by Stripe. We do not store your card number. We keep a billing summary (such as your plan, dates, and amounts) so we can manage your account.

Usage and log data. Basic technical information needed to run and secure the Service, such as device and log data.

AI-usage metadata. When you use AI Features, we record metadata about that use — the feature, the model, token (processing-volume) counts, and an estimated cost. We do not store the content of your prompts or the AI's responses (your resume text) in these logs.

Support correspondence. Messages you send us through our contact forms or the help center, and our replies.

Moderation and report records. If content is reported or we take a trust-and-safety action, we keep minimal records of the report and our decision. We collect only what we need to assess a report, and we never reveal a reporter's identity to the person reported.

4. Why we use your information, and our lawful basis

We use your information for the purposes below. Where the law (such as the GDPR) requires a "lawful basis," we have noted it.

You can withdraw any consent at any time. Withdrawing consent does not affect processing we already did, and it may mean a feature (such as AI Features or the Public Page) can no longer work. We log consent with a timestamp and the policy version in effect.

5. Aggregate, de-identified analytics

We analyze aggregate, de-identified information from resumes and job-search inputs — such as commonly listed employers and job titles — to understand usage and improve the product. This analysis is aggregate only, is never used to make decisions about you, and is not used to train AI models. We work only with structured fields (like employer name or job title), never your free-text resume body, and we suppress any value that too few people share, so no entry can identify an individual.

6. AI Features

ResumeLove is AI-assisted. AI Features help you score, improve, and write resume content, cover letters, and interview-prep material.

Advisory, not a decision. Any score or feedback is advisory feedback that you asked for — it is not a decision about you, a gate, or a judgment of you as a person. AI output stays fully editable, and we offer a manual path so you are never forced to use AI. If a score or result seems wrong, you can request a human review through our contact form at /contact.

Where AI runs. AI Features run on our AI providers, OpenAI and Anthropic, used interchangeably depending on the feature; each acts as our Sub-processor for this purpose. Because your Resume Content can contain sensitive information, sending it to our AI providers means they process that information on our behalf — which is why we ask for your explicit consent and rely on the protections below.

No training on your data; minimal retention. Our AI providers (OpenAI and Anthropic) process your content under data-processing agreements, do not train their models on your data (commercial/API tier), and we keep retention to a minimum. We also do not train our own models on your data without first asking for your separate, explicit opt-in consent.

Connecticut LLM-training statement. We do not collect, use, or sell personal data to train large language models.

AI-generated content transparency. In line with the EU AI Act's transparency rules (Article 50), we let you know when you are interacting with AI, and AI-generated content can be identified as machine-generated.## 7. AI in support and the help center

Help-center assistant. Our help center includes an AI assistant that answers your questions using our help articles and your account context. These questions and answers are logged and automatically deleted after 90 days.

AI-drafted support replies. When you contact support, a reply may be drafted by AI. That draft is based on metadata only — such as your plan, dates, counts, and verdicts — and never on your resume, cover-letter, or interview content. A human always reviews and approves a reply before it is sent.

All support and help AI runs on our AI providers, OpenAI and Anthropic, under the same no-training, minimal-retention, and Data Processing Agreement protections described in Section 6.

8. The Public Page

The Public Page lets you publish your resume to the open internet. It is off by default. You turn it on yourself, per resume, after an explicit opt-in and a clear warning about what publishing means.

When a Public Page is live, it is public: anyone with the link can view it, and it may be cached or copied by others. By default we set the page to noindex, which asks well-behaved search engines not to list it — so the page is reachable but not promoted in search results. You control what you expose and can omit fields you would rather keep private.

You can unpublish at any time with one click; we then stop serving the page immediately. Because you decide what to publish, any sensitive information you choose to include on your Public Page is information you have manifestly made public (GDPR Art. 9(2)(e)) — but you remain in control, and you can take it down whenever you like.

9. Sharing and Sub-processors

We do not sell or share your personal data, and we do not run third-party or cross-context targeted advertising.

We do rely on a small set of trusted vendors to run the Service. Each is a Sub-processor that processes data on our behalf under a Data Processing Agreement, and all are US-based:

Our canonical, up-to-date list — with each vendor's role and region — is on our Sub-processors page. We will update it and notify you before adding a new Sub-processor.

We may also disclose information if required by law, to comply with legal process, to enforce our terms, or to protect the rights, safety, and security of our users, the public, or the Company.

10. International data transfers

We process data in the United States. If you are in the EU, EEA, or UK, your information is transferred to the US. For each vendor, we rely on that vendor's EU-US Data Privacy Framework certification where it has one. Where a vendor is not certified, we use Standard Contractual Clauses, together with the UK International Data Transfer Addendum (IDTA), as the fallback.

11. Your rights and how to exercise them

You have rights over your personal data. Depending on where you live, these may include the right to access your data, get a portable copy, correct it, delete it, withdraw consent, object to or restrict certain processing, and opt out of marketing.

Self-serve (instant) for signed-in users. The fastest way to exercise most rights is right inside your account:

• Download my data — get a portable copy of your data (access and portability).
• Delete my account — erase your account (see Section 12 on how deletion works).
• Cancel or switch your plan — manage your Pass or Subscription.

Off-account or non-user requests. If you cannot sign in, or you are not a User, use our public privacy-request form at /privacy-request. We do not publish a privacy or support email address — please use the form.

What "download my data" includes. It includes your own data, in a portable format: your account and profile; your resume, cover-letter, interview-prep, and Public-Page content; your billing summary; your AI-usage metadata; and your finished PDFs. It does not include our templates, designs, prompts, model configurations, or any other user's data.

Our timelines. We acknowledge requests within 10 business days and respond within 30 days.

Verifying who you are. If you are signed in, we verify you with a step-up re-authentication, and your request is handled instantly. For off-account requests, we ask you to match 2–3 details on the account and provide a signed declaration; the response clock pauses until we have verified you. We never collect more identity information than we need, and we do not keep it after the request is handled.

Complaints. If you are in the EU, EEA, or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority. We would appreciate the chance to address your concern first, through our contact form at /contact.

12. How long we keep data, and how deletion works

While your account is active, we keep your data so the Service works for you.

Account deletion is a soft-delete with a roughly 30-day grace period. When you delete your account, we disable it and cancel billing immediately. Your account stays recoverable for about 30 days, in case you change your mind. After that, it is permanently erased — including your resume content, cover letters, interview-prep inputs, AI scores, and any live Public Page — across our systems and at our AI provider, subject to standard backup-rotation windows.

What survives deletion (and why). A few records are kept after deletion where the law requires it or there is a clear legitimate need, with personal identifiers removed or minimized:

• Stripe payment/event history and our admin audit log, for financial and legal reasons — with the link to you nulled.
• AI-usage rows, anonymized — the link to you is nulled and only aggregate cost is kept.

Help-center AI Q&A is automatically purged after 90 days (see Section 7).

Retention summary:

13. Security

We protect your information with encryption in transit (TLS) and at rest. We use access controls and require multi-factor authentication on privileged accounts, follow current password-handling practices, and keep a written incident-response plan so we can act quickly if something goes wrong. No system is perfectly secure, but we describe our practices honestly and do not overstate them.

14. Cookies and tracking

At launch we use only essential cookies needed to run the Service (for example, to keep you signed in). We do not use third-party advertising or cross-context tracking cookies. If we ever add analytics or other non-essential cookies, we will update this Policy and, where required, ask for your consent first.

15. Children

The Service is for users aged 13 and over. If you are under 18, you may use the Service only with a parent or guardian's permission. We do not ask for a date of birth at signup; the minimum age is a representation you make in our Terms.

We do not knowingly collect personal data from children under 13. If we learn that we have, we delete it. (EU/UK consent-age rules of 13–16 will be addressed at EU launch —.)

16. US state privacy rights (including California / CCPA-CPRA)

Depending on your US state, you may have rights to know what personal data we hold, to access and obtain a copy of it, to correct it, and to delete it. You can exercise these using the self-serve tools in your account or the contact form at /privacy-request (see Section 11).

Do not sell or share; no targeted advertising. We do not sell your personal data and we do not share it for cross-context behavioral (targeted) advertising. Because we do not, there is nothing to opt out of, and we do not need to honor "Do Not Sell or Share" or Global Privacy Control signals for that purpose.

Right to limit the use of sensitive personal information. California's CPRA gives consumers a right to limit the use and disclosure of sensitive personal information. This right does not apply to us, because we use any sensitive information solely to provide the Service you requested — we do not use it to infer characteristics about you, profile you, or share it. This mirrors our do-not-sell-or-share position above.We do not discriminate against you for exercising any of these rights.

17. EU and UK privacy rights (GDPR)

If you are in the EU, EEA, or UK, the GDPR (and UK GDPR) gives you rights over your personal data, including the right to access, rectify (correct), erase, restrict, and object to processing; the right to data portability; and the right to withdraw consent at any time. Where we rely on your consent — for AI Features, sensitive resume content, and the Public Page — you can withdraw it at any time, though some features may then stop working.

We have set out our lawful bases in Section 4. You can exercise your rights using your account tools or the contact form at /privacy-request (Section 11), and you have the right to complain to your local supervisory authority.

18. How we notify you of changes

If we make material changes to this Policy, we will let you know — for example with an in-app banner and an email — before the changes take effect, and we will update the "Last updated" date at the top. Your continued use of the Service after a change means you accept the updated Policy.

For any questions about this Policy or your privacy, please use our contact form at /contact.