Privacy Policy

Last updated October 12, 2026

This policy explains how Verxion (“we”, “us”) handles personal data in the ResumeAI mobile app and on this website (together, the “Service”). Verxion is the data controller. Questions: [email protected].

1. What we collect

Information you give us

• Your profile: name, headline, email address, phone number, location, links, work experience, education, skills, languages, certifications, projects and anything else you add. Depending on the countries you pick, you may also choose to add a photo, date of birth, nationality or visa status. These are optional and only used in resumes for countries where they're expected.
• Your goals: the countries and roles you're applying for, and the resume languages you choose.
• Messages to the agent: what you ask it to change or add, and its replies.
• Imports: a CV you upload (PDF or image), the address of a website you ask us to read, or a description you type. We read uploaded CVs to fill in your profile and don't keep the file. For websites, we visit the public pages at the address you give, plus a resume PDF they link to, and keep only what goes into your profile.

Information we create for you

• Your resumes, every saved version of them, and the PDFs you download.
• Your credit balance and a record of how credits were added and spent.

Account information

• Guest use: when you first open the app we create an anonymous account with a random identifier, so you can start without signing up.
• Signing in: if you sign in with Google or Apple, we receive your email address and an identifier for that account, never your password. With Sign in with Apple you can choose to share a private relay email instead of your real one.

Purchases

Payments are made through Google Play or the App Store, including Apple Pay or any other method they support. We never receive or store your card or bank details. We use RevenueCat to manage purchases and subscriptions. From the stores and RevenueCat we receive the product you bought, the store, transaction and event identifiers, purchase and expiry dates and whether a subscription will renew, linked to your ResumeAI account ID.

Technical information

• Server logs: our servers record requests, including IP address, time, and errors, so we can keep the Service secure and fix problems. Logs are kept for up to 30 days.
• In the app: the RevenueCat SDK sends device and app details (such as app version, OS version and store country) needed to process purchases. The app downloads fonts from Google Fonts, which sees your IP address. The app has no advertising or analytics trackers.
• On this website: we don't use analytics or advertising cookies. The account deletion form uses Google reCAPTCHA to block automated abuse. reCAPTCHA collects hardware and software information and sends it to Google, under Google's Privacy Policy and Terms.

2. How we use it

• To provide the Service: building your profile, writing, laying out and checking your resumes, answering your messages and producing PDFs.
• To run your account, credits and subscriptions, including adding credits after a purchase and refunding credits when a resume fails.
• To keep the Service secure and working: preventing abuse and fraud, and debugging.
• To contact you about your account, such as confirming an account deletion.
• To meet legal obligations, for example tax and accounting records kept by the stores.

We don't sell or rent your personal data, share it for advertising, or use it to profile you for marketing. We don't use your data to train AI models, and we don't let our providers do so.

3. AI processing with OpenAI

ResumeAI uses OpenAI's API to understand imports, write and lay out resumes, and chat with you. To do that we send OpenAI the relevant parts of your profile, your imports, your messages and your current resume. Under OpenAI's API data commitments, data sent through the API is not used to train OpenAI's models. OpenAI may keep it for up to 30 days to detect abuse and then deletes it, unless the law requires otherwise. OpenAI's handling of personal data is described in its Privacy Policy and API data usage documentation.

AI output can be wrong. The agent is designed to use only facts from your profile, but please review every resume before you send it.

4. Who we share it with

We share personal data only with providers that help us run the Service, under contracts that limit how they can use it:

We may also disclose data if the law requires it, to protect people's rights and safety, or as part of a merger or sale of the business. In that case this policy keeps applying to your data.

5. Legal bases (EEA, UK and similar laws)

• Contract: to provide the Service you asked for, including AI processing and purchases.
• Legitimate interests: security, fraud prevention, debugging and improving reliability.
• Consent: for optional details such as a photo, date of birth, nationality or visa status. You can remove them from your profile at any time.
• Legal obligation: where the law requires us to keep or disclose data.

6. International transfers

Our providers, including OpenAI, RevenueCat, Google and Apple, may process data in the United States and other countries. Where data leaves the EEA or UK, we rely on safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

• Your profile, resumes, versions, PDFs and credits: until you delete them or your account.
• Uploaded CV files: not stored. They're read once to fill in your profile.
• Server logs: up to 30 days.
• Deletion requests made on this website: after your data is deleted, we keep the email address and dates of the request for 90 days so we can answer questions about it.
• Store records: Google and Apple keep their own transaction records under their policies, which we don't control.

8. Deleting your account

You can delete your account and all its data at any time:

• In the app: Account → Delete account and data. Deletion is immediate.
• On the web: request it on our account deletion page and confirm from the email we send you. Your account is closed as soon as you confirm, and everything is permanently deleted within 7 days.

Deleting your account deletes your profile, photo, resumes, versions, PDFs, credits and purchase records with us, and your customer record at RevenueCat. Google Play subscriptions are cancelled automatically. Apple doesn't let developers cancel App Store subscriptions, so please cancel those in your Apple ID settings to stop future charges. Remaining credits are lost and can't be refunded.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct it (most of it you can edit directly in the app);
• delete it;
• receive it in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time, without affecting earlier processing;
• complain to your local data protection authority.

To use these rights, email [email protected]. We'll answer within 30 days and may need to confirm the request comes from you. California residents: we don't sell or share personal information as those terms are defined in the CCPA/CPRA, and we won't treat you differently for using your rights.

10. Security

Data is encrypted in transit (HTTPS). Access to our systems is limited to people who need it. Account sessions use signed tokens, and links in deletion emails are single-use and expire after 24 hours. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

11. Children

The Service is not meant for anyone under 16, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.

12. Changes to this policy

If we change this policy, we'll update the date at the top. If the changes are significant, we'll also tell you in the app or by email before they take effect.

13. Contact

Verxion: [email protected] for privacy questions, [email protected] for everything else.