Resumiz.

Privacy Policy

Last updated: June 11, 2026

1. Who we are

Resumiz is an AI-assisted resume tailoring service based in Ontario, Canada. We are responsible for the personal information under our control. Our privacy contact, who is accountable for how we handle personal information, can be reached at support@resumiz.com.

2. What we collect

  • Account info: name, email, hashed password, and the optional source and role you provide at signup.
  • Resume content: the resume text and job description you submit. We store both inputs and the assistance we generate from them (tailored resume, cover letter, match score, honesty report, list of changes, keywords matched and missing, gaps to address, interview prep, and any application status notes you record).
  • Usage data: tailorings per month, plan, timestamps.
  • Billing: processed by Stripe. We store a Stripe customer ID and subscription dates, not card numbers.
  • Referral data: your referral code, who referred you if anyone, and the credits you have earned and been paid.
  • Email engagement: when we send you an email, links in it route through our own redirect so we can record which links were clicked and which campaign they came from. We do not use open-tracking pixels.
  • Website analytics: anonymous, first-party page-view measurement. This includes a per-visit session identifier, a visitor hash that is salted and rotates daily so it cannot identify you across days, the page viewed, the referring page, any utm campaign parameters in the link you arrived from, and an approximate country derived from your IP address. It is aggregate and is not tied to your identity.
  • Abuse-prevention signals: to keep free usage limits fair, we derive one-way cryptographic digests (hashes) from submitted resume content, including a digest of the text itself and of contact details that appear in it, and from technical signals such as your IP address and a browser fingerprint at signup. These digests act as short-lived usage counters that expire automatically. The extracted contact details themselves are not stored, logged, or shared, and the digests cannot be reversed to reveal them.
  • Technical data: IP address for rate limiting and abuse prevention, and server logs, including records of when an abuse-prevention limit was applied.

3. How we use your information

  • To provide and improve the tailoring service.
  • For internal quality review: authorized personnel may view stored inputs and generated outputs to verify output quality and our no-fabrication standard, investigate errors or suspected misuse, and resolve support requests. Access is limited to what each task requires.
  • To enforce plan limits and prevent abuse, including detecting when free usage limits are being circumvented across multiple accounts, using the abuse-prevention signals described in Section 2.
  • To process payments and manage subscriptions.
  • To operate the referral program and calculate credits and payouts.
  • To send transactional emails (verification, receipts, security notices, notices about usage limits or suspected misuse, policy changes).
  • To send occasional product and marketing emails, which you can opt out of at any time.
  • To measure which links, emails, and campaigns are effective, and to attribute signups to their source.
  • To monitor security and debug errors.

We do not sell your data. We do not use your resume content to train AI models. Resume content is sent to the Anthropic Claude API to generate your output only.

4. Third-party services

  • Anthropic Claude API: your resume and job description are sent to generate the tailored output. See anthropic.com/privacy.
  • Stripe: payment processing. See stripe.com/privacy.
  • Vercel: hosting. See vercel.com/legal/privacy-policy.
  • Resend: transactional and marketing email delivery. See resend.com/legal/privacy-policy.
  • Upstash Redis: rate limiting and abuse prevention, keyed by IP address and the hashed abuse-prevention digests described in Section 2. See trust.upstash.com.
  • Database host: your data is stored in a hosted PostgreSQL instance.

Our website and email analytics are first-party. We do not use third-party analytics services or advertising trackers, and we do not share your data with advertisers.

5. Data retention

We retain your account data and tailoring history while your account is active. Deleting your account removes personal data within 30 days, except where retention is required by law. Hashed abuse-prevention counters expire automatically within about 90 days at most. Aggregate, anonymous analytics may be retained to understand long-term trends, but it is not linked to your account.

6. Your rights

You may have rights to access, correct, or delete your data depending on your jurisdiction (PIPEDA and provincial laws in Canada, and laws such as the GDPR or CCPA elsewhere). Email support@resumiz.com to exercise these rights and we will respond within the time the applicable law requires. If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or your provincial privacy regulator where one applies.

7. Cookies and analytics

We keep cookies to a minimum and they are all first-party:

  • Session cookie: keeps you signed in.
  • resumiz_ref: set only if you arrive through a referral link and choose Accept on our cookie banner, so we can credit the referrer if you sign up.
  • rz_attr: a first-party cookie that records the campaign or source you arrived from, so that if you sign up we can attribute it correctly. It expires after 30 days.

Our website analytics are cookieless and anonymous, as described in Section 2. Email link tracking uses a first-party redirect and no open-tracking pixels. We do not use advertising cookies or third-party analytics trackers.

8. Marketing communications

We send two kinds of email. Transactional messages, such as verification, password resets, receipts, security notices, notices about usage limits, and changes to this policy or the Terms, are required to run your account. Marketing messages, such as product updates and tips, are optional. Every marketing message includes an unsubscribe link and our mailing address, in line with Canada's Anti-Spam Legislation (CASL). You can unsubscribe at any time without affecting transactional messages or your account.

9. Security

Passwords are hashed with bcrypt before storage. All data is transmitted over HTTPS. Rate limiting is applied to prevent brute-force attacks. No method of transmission or storage is perfectly secure, but we work to protect your information using reasonable safeguards. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report to the relevant privacy authority, such as the Office of the Privacy Commissioner of Canada or your provincial regulator, as required by law, and we keep records of breaches as the law requires.

10. International data transfers

Resumiz is operated from Ontario, Canada. Our service providers may store and process your information in other countries, including the United States (for example Anthropic, Stripe, Vercel, Resend, and Upstash). Information stored in or processed from another country is subject to the laws of that country, which may differ from those of your own and may permit access by courts, law enforcement, and government authorities there. By using Resumiz, you consent to your information being transferred to and processed in these countries for the purposes described in this policy. We use reputable providers and rely on their contractual commitments to protect your information.

11. Automated decision-making

Resumiz uses AI to generate suggestions, such as tailored resume text, match scores, and keyword analysis, from the content you submit. These are suggestions for you to review and edit, and you stay in control of what you use. Automated abuse-prevention measures may temporarily limit free usage when our systems detect that limits are being circumvented; these measures affect free usage limits only, are logged, and can be reviewed by a human if you contact us. We do not use your information to make decisions about you by automated means alone that produce legal or similarly significant effects on you.

12. Children and minors

Resumiz is intended for adults and is not directed to children. You must be at least the age of majority in your jurisdiction, as set out in our Terms of Service, to create an account or use the service. We do not knowingly collect personal information from anyone under the age of majority. In particular, and consistent with Quebec's Law 25, we do not knowingly collect personal information from anyone under 14, and consistent with the United States Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a minor has provided us with personal information, contact support@resumiz.com and we will delete it. If we learn that we have collected personal information from anyone under the age of majority, we will delete it promptly.

13. Changes

Material changes to this policy will be communicated by email or a dashboard notice at least 14 days before taking effect. Your continued use of the service after the effective date means you accept the updated policy.

14. Contact

For privacy questions, contact support@resumiz.com.