Privacy Policy

ResumeGrok ("ResumeGrok", "we", "us") operates the ResumeGrok website and app and is the controller of the personal data described in this policy. If an organisation such as a college or career coach invites you to its workspace in ResumeGrok, it may act as a separate controller for the data it manages, and its own privacy notice applies to that. Privacy contact: privacy@resumegrok.com

Account data: your name, email address, language, profile picture (if you add one or your sign-in provider supplies one) and the identifier of your sign-in account. If you sign up with an email address and password, the password is stored only by our sign-in service, in hashed form. Content you create or upload: resumes and their versions, cover letters, job applications and notes, contacts you add, files you import (PDF, Word or JSON), interview practice answers and AI chat conversations. Your content may include personal data about you and about other people you mention (such as references) — only include information you're entitled to share. Settings: for example your target role, country, paper size, date format, default template and theme. Usage and technical data: IP address, browser and device information, pages and API requests, timestamps, request identifiers and error logs. For each AI action we record the feature, time, model, request size and whether it succeeded, so we can apply plan limits and fair use. Billing data: if you buy a paid plan, our payment processor collects your payment details. We never receive your full card number. We receive the plan, amount, currency, payment status, receipt number and the processor's customer, order, subscription and payment references. Organisation data: if you join an organisation workspace, your membership and role, and invitations sent to your email address. Analytics data, only if you turn on analytics cookies: Google Analytics records the pages you visit on our website, how you arrived, your device, browser and screen type, and your approximate location (city or country). It also records which features you use, such as creating or downloading a resume, using an AI feature, reaching a plan limit or choosing a plan, together with your plan type and app language. It never receives your name, email address, the content of your documents or what you type. Google Analytics doesn't store IP addresses. Cookies and similar technologies: see our Cookie Policy.

From you, when you create an account, fill in your profile, write or import documents, or contact us. From Google, if you choose "Continue with Google": your name, email address, whether the address is verified and, if available, your profile picture. We don't get your Google password or access to your Gmail, Drive or contacts. From our payment processors: payment and subscription status, receipts and references when you buy, renew or cancel a plan. From our own systems: the usage and technical data created when you use the service.

We use personal data only for these purposes. The legal bases apply where the GDPR or UK GDPR applies. • To provide the service you ask for: create and store your documents, show previews, produce exports (PDF, DOCX, TXT, JSON), run the AI features you trigger, publish the share links you turn on, and keep your account and settings. Basis: performance of our contract with you. • To take payments and manage subscriptions, including renewals, cancellations, receipts and refunds. Basis: contract, and legal obligation for tax and accounting records. • To apply plan limits and fair use, by counting AI actions and documents. Basis: contract. • To keep the service secure and reliable: authentication, rate limiting, preventing abuse and fraud, troubleshooting and backups. Basis: our legitimate interest in running a secure service, and legal obligation where it applies. • To understand and improve the service using aggregated, non-identifying counts (for example how often a feature is used). Basis: legitimate interests. We don't read your documents for this. • Only if you turn on analytics cookies, to measure how our website is used with Google Analytics so we can improve it. Basis: your consent, which you can withdraw at any time in Cookie settings. • To communicate with you about your account, for example answering support requests or telling you about important changes. Basis: contract and legitimate interests. • To comply with the law and enforce our terms. Basis: legal obligation and legitimate interests. • Optional cookies and similar storage. Basis: your consent, which you can withdraw at any time in Cookie settings. Where we rely on legitimate interests, you can object (see Your rights and choices). We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.

ResumeGrok includes AI features such as writing suggestions, resume import, cover letters, keyword match, tailoring, chat about your resume and interview feedback. When you use one, the content needed for that request — for example a resume section, a job description or your practice answer — is processed to produce the result. AI features are processed by our AI infrastructure. If we use an AI model provider, it acts as our processor under a contract that forbids training on your content. We don't use your resumes, documents or AI conversations to train AI models. AI output is a suggestion. Nothing is applied to your documents until you accept it, and you should check every suggestion before you use it. We keep AI chat conversations so you can come back to them; you can delete a conversation at any time. We also keep a record of each AI action (feature, time, model, size and success, not the text) for limits, fair use, security and cost control.

If you turn on a share link for a resume, anyone with the link can view that resume and download it as a PDF without signing in. Share pages ask search engines not to index them, but we can't control what people do with a link you give them. You can turn a link off at any time and it stops working. We count views of shared resumes. To avoid counting the same visitor twice, we keep the viewer's IP address in memory for about 30 minutes; it is never stored with the count.

We don't sell your personal data and we don't share it for advertising. We share it only with: • Hosting and infrastructure providers that run the service for us (servers, databases, storage and off-site backups). • Google, if you choose to sign in with Google. Our sign-in service itself (Keycloak) is operated by us. • Payment processors: Razorpay (mainly for payments in India) and Stripe (for payments elsewhere). They handle your payment details under their own privacy policies and, for some activities such as fraud prevention, as independent controllers. • An AI model provider, if we use one, as our processor under a contract that forbids training on your content. • Google, as our analytics provider, only if you turn on analytics cookies. Google Analytics receives the analytics data described above and processes it for us. We have switched off its advertising features (Google signals and ad personalisation), so it isn't used to show you ads. • Google Fonts: our sign-in pages load a typeface from Google Fonts, so Google receives your IP address and browser information when those pages load. • Your organisation or coach, if you join their workspace: they can see your membership and the resumes you choose to share with them. • Anyone you share a resume with through a share link. • Authorities, advisers or other parties when the law requires it, to protect rights, safety and security, or as part of a merger, acquisition or sale of assets (we'll tell you if your data is transferred). Our service providers may use your data only to provide their services to us and must protect it. You can ask for a current list of our subprocessors at privacy@resumegrok.com.

We and our providers may process personal data in countries other than yours, including India, the United States and countries in the European Economic Area. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum where needed) and check the recipient's protections. Google LLC, which provides Google Analytics, is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for details at privacy@resumegrok.com.

• Account data and content: while your account is open. When you delete a resume it can be restored for 30 days and is then removed for good. • AI chat messages: deleted after 365 days, or earlier when you delete the conversation or your account. • AI usage records: deleted after 400 days (about 13 months). • Audit log of security and account events (for example data exports, organisation changes and terms acceptance): deleted after 2 years. • Server logs: rotated automatically and kept only for a short time, typically no more than 30 days. • Organisation invitations: removed 30 days after they expire or are used. • Billing records (payments, receipts and subscriptions): kept as long as tax and accounting laws require, generally up to 8 years, including after you delete your account; they are then no longer linked to an account. • Google Analytics data: kept by Google for no longer than 14 months, then deleted. The _ga cookies on your device expire after 2 years, or straight away when you withdraw consent. • Backups: kept for up to 35 days, so deleted data leaves our backups within 35 days. If we ever restore a backup, we re-apply the deletions made since. When you delete your account, we delete your profile and content from our live systems straight away, stop any renewing subscription and remove your sign-in account.

We protect your data with encryption in transit (HTTPS), access controls and least-privilege access, audited administrative actions, hashed passwords and brute-force protection in our sign-in service, rate limiting and regular backups. No service can be perfectly secure. If a personal data breach is likely to affect you, we'll notify you and the authorities as the law requires.

Depending on where you live, you have the right to: • access your personal data and get a copy — Settings → Data & privacy → export downloads all your data as JSON files; • correct inaccurate data — you can edit most of it directly in the app; • delete your data — Settings → Data & privacy → delete account removes your account and content; • data portability — the JSON export is structured and machine-readable; • object to processing based on our legitimate interests; • restrict processing in certain cases; • withdraw consent at any time (for example for optional cookies, in Cookie settings) without affecting earlier processing; • not be subject to solely automated decisions with significant effects (we don't make any); • complain to a data protection authority — in the EEA, the authority where you live or work; in the UK, the Information Commissioner's Office (ICO). We'd appreciate the chance to help first. For anything you can't do in the app, email privacy@resumegrok.com from the address on your account. We may need to verify your identity. We reply within one month, or sooner if your local law requires, and free of charge unless a request is clearly unfounded or excessive.

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). Categories of personal information we collected in the last 12 months: identifiers (name, email, account identifiers, IP address); customer records and commercial information (plans bought, payment references and history); internet or other electronic network activity (usage and technical logs, and Google Analytics data if you allowed analytics cookies); professional or employment-related information you put in your documents; and sensitive personal information only as account log-in credentials (held by our sign-in service) and any sensitive details you choose to include in your documents. The sources, purposes, recipients and retention periods are described in this policy. We disclose these categories to service providers for the business purposes described in Who we share data with. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we haven't done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information only for purposes the CCPA allows, such as providing the service you asked for and keeping it secure, and not to infer characteristics about you. We honour Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of sale and sharing and we switch off all optional cookies. Your rights: to know what personal information we collect, use and disclose and to access it; to delete it; to correct it; to opt out of sale and sharing (we don't sell or share); and to limit the use of sensitive personal information (we already limit it). We won't discriminate against you for using these rights. To make a request, use the export and delete tools in Settings or email privacy@resumegrok.com. We verify requests by confirming control of your account email address. You can use an authorised agent; we'll ask for proof of their authority and may ask you to confirm your identity directly with us.

If you are in India, we process your digital personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. We rely on the consent you give when you create an account and accept our terms, and on legitimate uses the Act permits, such as complying with the law. You can withdraw your consent at any time by deleting your account or contacting us. Withdrawal doesn't affect processing that happened before, and features that need the data will stop working. You have the right to get a summary of your personal data and how we process it, to correct, complete, update and erase it, to have your grievances addressed, and to nominate a person to exercise your rights if you die or become incapable. Grievance Officer: you can reach our grievance officer at privacy@resumegrok.com. We'll acknowledge your grievance promptly and respond within the time the law requires. If you're not satisfied with our response, you can complain to the Data Protection Board of India.

ResumeGrok is not meant for children. You must be at least 16 years old, or older if the law where you live requires it to use online services without parental consent; in India you must be at least 18. We don't knowingly collect personal data from anyone below these ages. If you think a child has given us personal data, contact privacy@resumegrok.com and we'll delete it.

We use strictly necessary cookies to sign you in, keep the service secure and remember your language and theme. Only with your consent, we also remember layout choices on your device and use Google Analytics to understand how our website is used. We don't use advertising cookies. Our Cookie Policy lists every cookie we use, and you can change your choice at any time in Cookie settings at the bottom of every page.

ResumeGrok doesn't send marketing emails or newsletters. Our sign-in service sends the account emails you need, such as email address verification and password reset links. We may email you about a material change to these documents, a security issue or your subscription. Our payment processors may send you payment receipts.

We may update this policy. If a change is material, we'll tell you in the app (and by email where appropriate) before it takes effect and, where required, ask you to accept the updated documents. The date at the top shows when this policy was last updated.

Privacy questions and requests: privacy@resumegrok.com General support: support@resumegrok.com ResumeGrok