ResumeBanao

Privacy Policy

ResumeBanao ("we", "us", "our") is built for India + global users. We comply with the India Digital Personal Data Protection Act, 2023 (DPDP) and the EU General Data Protection Regulation (GDPR). This policy explains what we collect, why we collect it, who we share it with, and the controls you have.

1. Information we collect

  • Account information — email, name, and avatar (if you sign in via Google/LinkedIn OAuth).
  • Resume content — the text, files, and metadata you upload or type into the editor.
  • Job descriptions — JDs you paste or that we scrape on your behalf from URLs you provide (Naukri, Internshala, LinkedIn, etc.).
  • Billing information — handled by Razorpay; we receive a payment status, order ID, and the last 4 digits of the card / UPI handle. We never see full card numbers, CVVs, or banking credentials.
  • Usage events — feature events, error logs, and performance traces used for billing and observability. Anonymised after 90 days.
  • Device + technical data — IP, browser, OS, referrer, page URL, and cookie identifiers (see §6 below).

2. How we use your information

  • Deliver the core product (tailoring, ATS scoring, PDF generation, dashboards).
  • Process payments and issue invoices via Razorpay.
  • Send transactional email (account, billing, security) via Resend.
  • Measure product performance and debug issues (privacy-preserving analytics).
  • Serve and measure advertising on editorial pages (see §6).
  • Meet legal and regulatory obligations (DPDP, GDPR, tax records, anti-fraud).

3. Data sharing — who we send data to, and why

We share only what each provider needs to perform its function:

  • Razorpay — billing, refunds, and payment verification (PCI-DSS scope).
  • Resend — transactional email delivery (email address + message content).
  • Supabase — managed Postgres, authentication, and file storage in the EU/US region.
  • Google Analytics 4 + Google AdSense — usage measurement and advertising (subject to the consent you give in §6).
  • AI inference providers — Anthropic Claude, NVIDIA NIM, Groq, Cerebras, OpenRouter, and Google Gemini are used to run the resume rewriting and scoring models. Prompts are sent transiently and are not used to train shared models — we use commercial endpoints with no-retention or "zero-data-retention" agreements where available.

What we do NOT do: we do not sell your resume content, contact details, or browsing data to recruiters, data brokers, or any third party. We do not share resume content with advertisers. Advertising on this site is contextual / interest-based but never tied to the contents of your resume.

4. Resume content — extra reassurance

Your resume is the most sensitive thing you give us. Specifically for resume content:

  • Never shared with advertisers, recruiters, or any third party for marketing.
  • Never used to train shared AI models.
  • Encrypted in transit (TLS) and at rest in Supabase storage.
  • Deleted within 24 hours when you delete your account.

5. Data retention

  • Usage events — anonymised after 90 days (user IDs replaced with irreversible hashes).
  • Account + resume content — kept while your account is active. Purged within 24 hours of an account-deletion request.
  • Billing records — retained for 7 years as required by Indian tax law (Section 44AA of the Income Tax Act).
  • Auto-delete option — configure a TTL in Settings and we wipe your data automatically.

6. Cookies and advertising

We and our partners use cookies, web beacons, and similar technologies for three purposes: making the product work (essential), measuring performance (analytics), and serving advertising. You control analytics and advertising cookies through the consent banner shown on your first visit (and re-openable from the footer).

Third-party vendors, including Google

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site and other sites on the internet. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the internet.

  • We participate in Google AdSense. Google uses the DoubleClick / Google advertising cookie to deliver ads.
  • You may opt out of personalised advertising by Google at google.com/settings/ads.
  • You may opt out of personalised advertising by participating third-party vendors at aboutads.info/choices (DAA) or youronlinechoices.eu (EDAA, for EU users).

Google Consent Mode v2

For users in the EU/UK/EEA — and by default for all visitors — we run Google Consent Mode v2 with all advertising and analytics signals set to denied until you grant consent through the banner. If you reject, Google receives only cookieless, non-identifying pings (used for aggregate, model-based measurement). If you accept, personalised advertising and analytics cookies become active.

Advertising placement

Ads appear only on editorial pages (guides, blog posts, city/role pages). We do not show ads on the resume editor, dashboard, billing pages, login, signup, account settings, or any policy/contact page.

7. Your rights

Under DPDP (India) and GDPR (EU), you have the right to:

  • Access — export everything we have on you (Settings → Export my data, or email privacy@resumebanao.app).
  • Erasure — delete your account in one click; we purge data within 24 hours.
  • Correction — edit or correct any personal data from your account settings.
  • Withdraw consent — re-open the cookie banner from the footer or change preferences at any time. Withdrawal does not affect processing already performed.
  • Portability — the export bundle is a machine-readable JSON archive.
  • Grievance — write to privacy@resumebanao.app; we respond within 7 working days. EU users may also lodge a complaint with their local supervisory authority.

8. Children

ResumeBanao is not directed at and may not be used by anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, write to privacy@resumebanao.app and we will delete the account.

9. International data transfers

We process data in India, the EU, and the US depending on the service (Supabase, our AI providers, Google, Razorpay). For EU/UK users, transfers outside the EEA rely on Standard Contractual Clauses (SCCs) and supplementary measures where applicable. For Indian users, transfers are made only to countries permitted under the DPDP Act.

10. Security

TLS in transit, encryption at rest, Postgres row-level security, scoped service roles, and HMAC-verified webhooks. No system is perfectly secure; we operate a coordinated disclosure policy at security@resumebanao.app.

11. Changes to this policy

We may update this policy as the product evolves. Material changes are announced via email and on the site at least 14 days before they take effect. The "Last updated" date below always reflects the current version.

12. Contact

Privacy / DPA inquiries: privacy@resumebanao.app
Security disclosures: security@resumebanao.app

Last updated: 2026-05-22

Privacy Policy | ResumeBanao