Privacy Policy
Last updated 15 August 2026
Your résumé is the most sensitive thing this product touches. We never store the file you upload, we never sell anything to anyone, and you can export or delete everything yourself, without asking us.
Who we are
ResumeCraft is operated by Soulaimane Boukrab, Casablanca, Morocco, Morocco. For anything in this policy, including access and deletion requests, contact soulaimane.boukrab@gmail.com. We are the data controller for the information described below.
What we collect
| What | Why |
|---|---|
| Your Google account — name, email address, profile picture | To sign you in and to own your work. Google sign-in is the only way to create an account; we never receive or store a password. |
| Your résumé, as structured data — the roles, dates, bullets and skills we extract from what you upload or paste | This is your master profile. It is what makes every later tailoring take seconds instead of minutes. |
| Job postings you paste or link — the text, and the company and title we detect in it | To tailor against, and to keep a re-opened tailoring meaningful. A tailored résumé without its posting cannot be edited sensibly. |
| Tailored résumés you generate | So you can re-open, edit, re-download, and duplicate them. |
| Your credit ledger and any passes | To meter usage and to show you an accurate purchase history. |
The file you upload is not kept
When you upload a PDF or DOCX we read it in memory, extract the text, and discard it. The original file is never written to disk and never sent to any file-storage service. There is nothing to leak and nothing to request deletion of, because it stopped existing the moment extraction finished.
If you use ResumeCraft without signing in
You can generate a tailored résumé before creating an account. When you do, we create an anonymous record identified by a signed cookie — no email, no name. If you sign in afterwards, that work moves onto your account. If you do not, the record expires and is deleted automatically.
Who we share it with
We do not sell personal data, and we do not share it for advertising. We use these processors to run the product:
| Processor | What it receives |
|---|---|
| OpenAI | Your résumé text and the job posting, in order to extract and tailor. This is the one processor that necessarily sees your résumé content — the product cannot work otherwise. |
| Paddle.com Market Ltd | Payment details, which go to Paddle directly. Card numbers never reach our servers. Paddle is the Merchant of Record and is the seller shown on your statement. |
| Neon (database) and Vercel (hosting) | The data described above, at rest and in transit. |
| Sentry (error monitoring) | Error reports. Request bodies, cookies and headers are stripped before sending, and the user object is reduced to an internal id. Résumé content is never attached. |
| PostHog (product analytics) | Which steps of the flow are reached, as counts and durations against an internal id. Event properties never carry résumé content, job posting text, or your email address. Where session recording is enabled, all inputs and text are masked. |
| Upstash (rate limiting) | Request counters keyed on your internal id. |
| Google (sign-in) | Authentication only. |
How long we keep it
Your master profile, job postings and tailored résumés are kept until you delete them or delete your account — they exist to be reused, and expiring them silently would break the thing you came for. Anonymous pre-signup records expire automatically. Purchase records are kept as long as we are required to keep them for tax and accounting purposes.
Your rights
You can exercise the two that matter most without contacting anyone, on your settings page:
- Export — download everything we hold about you as a single JSON file.
- Deletion — delete your account and everything in it. This is immediate and cannot be undone.
You can correct your data by editing it in the app. If you are in the UK or EEA you also have the right to object to or restrict processing, and to complain to your local supervisory authority. Write to soulaimane.boukrab@gmail.com for anything not covered by the buttons above.
Changes
If we change this policy in a way that materially affects what we collect or who we share it with, we will say so in the product rather than only updating the date at the top.