Privacy Policy

1. Introduction

Resimay is an AI-powered job application tracker and resume tailoring platform operated by Resimay Labs Inc. (“Resimay,” “we,” “us,” or “our”), a corporation incorporated in the Province of Ontario, Canada. By using Resimay, you agree to the collection and use of information as described in this policy.

Our service helps you track job applications, tailor your resume to specific job descriptions, and understand why you may be getting rejected, so you can improve your chances before your next application. This policy covers the Resimay website (resimay.ai), the Resimay Chrome extension and the Resimay mobile app.

2. Information We Collect

We collect the following categories of information:

• Account information: email address and name provided at registration.
• Onboarding profile: target job title, experience level, career motivation, search timeline, primary goal, attribution source, and any hobbies/activities/interests you choose to share to make resumes more authentic.
• Resume content: the text of your resume(s) that you upload or paste into the platform.
• Uploaded documents: when you upload a resume, cover letter, transcript, portfolio, or other supporting document via the file-upload surface in your profile, the binary file is stored in a private storage bucket accessible only via authenticated backend requests scoped to your user account. Files are served back to you through authenticated routes on our domain; raw bucket URLs are never exposed publicly.
• Voice mock interview audio: when you start a voice mock interview session, your microphone audio is streamed to our backend, which relays it to our voice AI provider for real-time transcription and response generation. We do not retain the raw audio after the session ends; the session transcript (text only) is saved to your account so you can review the conversation and prep notes later.
• Job applications: job titles, company names, job descriptions, application status, and notes you enter about your applications. Includes job postings you save via the Resimay Chrome extension from third-party job boards (LinkedIn, Indeed, Glassdoor, and similar).
• Custom answer library: when you save a free-text answer to an application question (such as “Why are you interested in this role?”) through the Resimay Chrome extension, that question/answer pair is stored on your account so the extension can offer it on similar future questions. These saved answers are not shown in your profile. You can ask us to delete them (see Section 9), and deleting your account removes them.
• Chrome extension data: if you use the Resimay Chrome extension, the postings you save with it, the status updates it makes for you (such as marking a saved posting as applied), and the answers you choose to save to your profile. Some extension data stays only on your device. See Browser Extension below.
• Mobile app data: if you use the Resimay mobile app, a random identifier for the app installation, a device secret used to check email sign-in links, the links and text you share into the app, and, if notifications are allowed, your phone’s push token, its type (Android or iPhone) and its time zone. See Resimay mobile app below.
• AI-generated content tied to your account: tailored resumes, cover letter drafts, follow-up email drafts, rejection analyses, interview practice transcripts, Resume Coach conversations, and voice mock interview transcripts you generate using the Service.
• Technical data: IP address, browser type, device type, and session data collected automatically when you use the service.
• Usage data: which features you use, how often, and your in-app activity patterns (e.g., resume tailor count, streak data).

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Resimay service.
• Process your resume and job descriptions through AI to generate tailored content, keyword analysis, rejection insights, and follow-up drafts.
• Manage your account, billing (for Pro subscribers), and customer support.
• Improve and develop the product based on aggregated, anonymized usage patterns.
• Send you transactional emails (e.g., password reset, account notifications). We do not send marketing emails without your explicit consent.

4. AI Processing

Resimay uses three third-party AI providers to generate text and voice for its AI features, and one embeddings provider for job matching and search. Each text or voice feature has a main provider, listed below. If that provider is unavailable, the same request can be sent to one of the other two instead:

• Our primary AI provider: resume tailoring, cover letter drafts, rejection analysis, resume checks and rewrites, feedback on voice mock interviews, and other long-form generation features inside the Resimay web app. It is also a backup for other features, including the Resimay Chrome extension’s suggested answers and email drafts.
• Our voice and research AI provider: company research briefs, voice mock interview sessions, Interview Practice questions and reports, the Resume Coach, reading your resume and job descriptions, quick tasks such as suggested fixes to your resume, email drafts in the Resimay Chrome extension, and the Resimay Chrome extension’s autofill assistance (open-ended question drafts and structured select/radio answer suggestions when the deterministic field matcher can’t confidently fill a field on its own).
• Our third AI provider: follow-up email drafts in the web app and in our free follow-up email tool. It is also a backup for most of the text features above when their main provider is unavailable, such as resume tailoring, cover letters, reading your resume, the Resume Coach and email drafts in the Resimay Chrome extension. It is never used for the extension’s suggested answers or for the live audio of voice mock interviews.
• Our embeddings provider: turns text into numerical representations that we use to match jobs to you and to power job search. It receives the text of your master resume each time you save it, the text of your job searches, and the target job titles you give during onboarding, but not your account details. It does not write text.

When you use an AI feature, the relevant portion of your input is transmitted to the applicable provider's API for processing. Transmission is encrypted in transit. For web-app features, that input is typically your resume text and/or the job description. For the Chrome extension’s autofill assistance, the transmitted input is a narrow slice of your profile (name, headline, bio, top experience entries, skills, education) plus the specific question being asked and the job description scraped from the page you’re on. Sensitive profile fields (full address, phone, salary expectations, work authorization, visa sponsorship, and your custom Q&A library) are NOT sent to any AI provider for autofill suggestions.

We do NOT use your content to train AI models. Our three text and voice AI providers' paid API terms prohibit using API inputs to train their models without explicit consent, and we send them your data only to generate the specific output you requested.

4.1 Resimay Chrome Extension

The optional Resimay Chrome extension fills job application forms on supported ATS platforms (Greenhouse, Workday, Lever, Ashby, LinkedIn Easy Apply, and others) with the data already stored on your Resimay profile. The extension is opt-in. Autofill runs only when you start it from the extension’s popup, and then continues through the later steps of that application. The Save button, the Apply prompt and the status update on confirmation pages work without that click (see Browser Extension below).

How it works

When you trigger autofill on an application page:

• The extension requests the autofill payload for your account from our backend. That payload is a slice of your profile (basic info, links, experience, education, certifications, autofill defaults, custom Q&A library) plus a link to your tailored or master resume if one exists.
• The extension matches the page’s form fields to your profile deterministically (label vectors, ARIA hints, ATS-specific selectors). When a match is confident, the field is filled silently. When the match is uncertain, a small confidence indicator (yellow ring) appears so you can review before submitting.
• For unmatched open-ended or multiple-choice questions, the extension can optionally request an AI suggestion (see Section 4.2 below). AI suggestions are shown to you for review and edit; nothing is sent to the form until you confirm.
• On non-Tier-1 sites (anything outside the known ATS list), the extension uses Chrome’s built-in per-site permission prompt the first time you try to autofill. We never run on a page without your explicit permission for that origin.
• The extension caches its autofill payload in browser-session memory for a short window (typically under 60 seconds) so a single autofill pass doesn’t re-fetch the data unnecessarily. The cache is wiped when you sign out or close the browser.

Capture prompt

If you manually fill a standard profile field that the extension could not fill (such as your phone number, address or notice period), after you submit the form the extension may surface a small prompt asking whether to save that value to your Resimay profile. Answers to open-ended questions are saved only when you choose to save them in the extension. Nothing is stored without your explicit click. If you decline, the extension does not ask about that kind of field again.

What the extension does NOT do

Resimay never auto-submits an application on your behalf. Every submission requires you to click the site’s submit button. The extension sends page content to our server only when you save a posting (its title, company, description and link) or ask for a suggested answer (the question, its options and the job description). It does not send keystrokes to a third party. It runs on the job sites and hiring platforms named in the Browser Extension section, which you approve when you install it, and on any other site only after you grant Chrome’s per-site permission.

4.2 Chrome Extension AI Assistance

The Resimay Chrome extension can suggest answers to open-ended ATS application questions (such as “Why are you interested in this role?”) and to select/radio multiple-choice questions that our deterministic matcher can’t confidently fill on its own. Two important protections apply:

• User-review gate. AI-suggested drafts and picks render inside a side panel for you to review and edit. Nothing reaches the actual application form until you explicitly click “Use this answer.” AI-touched fields are marked with a yellow indicator so you can review them at a glance before submitting. Resimay never auto-submits an application on your behalf.
• Demographic blocklist. Resimay’s autofill assistance will never generate or pick answers for voluntary self-identification questions about gender, race, ethnicity, Hispanic/Latino origin, veteran status, disability status, or age. Those answers are yours to give and yours alone. The blocklist is enforced both in the extension and on our backend so an AI answer cannot reach those fields even if a question phrasing slips past one layer.

For structured select/radio questions, the AI is constrained to pick exactly one option from the list the page provides. Our backend rejects any AI response that invents an option not in that list, so a hallucinated answer cannot reach you for review.

Browser Extension

The Resimay Chrome extension is an optional add-on that works only when you are signed in to a Resimay account. Everything it does is for your own job search: it saves job postings to your tracker, fills in application forms from your profile, and keeps your applications up to date. Resimay Labs Inc. is the data controller for the personal information it handles.

What it does

• Saving postings. On job posting pages on LinkedIn, Indeed and Glassdoor, the extension shows a Save button. When you click it, or click Save in the extension’s toolbar popup, it reads the posting’s title, company, description and link and adds the posting to your Resimay tracker. It does not read your feed, messages or profile on those sites.
• Autofill. On supported hiring platforms (LinkedIn Easy Apply, Workday, Greenhouse, Lever, Ashby and iCIMS), when you click Autofill the extension loads your profile from our server and enters details such as your name, contact details, address, links, work history, education, work eligibility and job preferences into the form. It can also attach your resume or another document from your profile. Fields it is unsure about are highlighted for you to check, and it never submits an application for you. On any other career site, autofill runs only after you ask for it and allow that site in Chrome’s own permission prompt. You can withdraw that permission at any time in Chrome’s extension settings.
• Suggested answers. For a question it cannot fill from your profile, you can ask for a suggested answer. The extension sends the question, any answer options and the job description to our server, which uses AI to draft an answer from them and the parts of your profile listed in Section 4. You can edit the draft, and nothing goes into the form unless you choose to use it. Questions about gender, race, ethnicity, disability, veteran status, age, pronouns and other voluntary self-identification topics are never answered by the extension.
• Remembering new answers. When you type an answer the extension could not fill, it may offer to save it to your profile for next time. It is saved only if you agree. If you decline, it stops asking about that kind of field.
• Status updates. When you click Apply on a LinkedIn, Indeed or Glassdoor posting, a small prompt asks whether to mark the posting as applied in your tracker. Nothing changes unless you click Yes. When a confirmation page appears on a supported hiring platform after you apply, the extension marks the matching saved posting as applied and shows a notice with an Undo button. Only postings you saved can be updated, and the update sends our server only the posting’s tracker ID and its new status.
• Tailoring and emails. From the popup you can ask our server to tailor your resume for a posting in your tracker (paid plans) or to draft an email about an application, such as a follow-up. For an email, the extension sends the email type, the role, the company, your name and any context you add. You can copy the draft, or click “Open in Gmail” to open it in a new Gmail tab in your browser. That click passes the draft’s subject and text to Google, which runs Gmail.

Where your data goes

Apart from “Open in Gmail,” the extension sends your data only to Resimay’s own server (api.resimay.ai), over an encrypted connection, and only to run the features above. Our server handles it as described in the rest of this policy, including the AI processing in Section 4. Details and documents the extension enters into an application form become part of that website’s form, and that website handles them under its own privacy policy, as if you had entered them yourself.

What it keeps on your device

• Local extension storage: your sign-in tokens and basic account details (account ID, email, name and plan), a list linking the postings you saved to your tracker, where you placed the Save button, which save prompts you dismissed, which filled fields you corrected (the field and the site, never what you typed), a running estimate of the time the extension has saved you, and short-lived records of applications in progress.
• Session storage, which Chrome clears when you close the browser: a short-lived copy of your profile and of the documents used for autofill, so a multi-step form does not download them again, and a short log of which fields were filled (never their values).

This storage belongs to the extension, and websites cannot read it. Signing out removes your sign-in tokens, account details, saved-posting list, corrected-field notes, time-saved estimate and in-progress records, and clears session storage. Your Save button position and dismissed prompts stay until you uninstall the extension, which removes everything it stored. After you uninstall, Chrome opens a short feedback form (a Google Forms page). Filling it in is optional, and nothing that identifies you is added to it.

What it never does

The extension shows no ads and contains no third-party analytics or tracking code. It does not record your browsing history, and it does not track your clicks, scrolling or typing beyond the features described above. We never sell the data it handles. For questions about the extension, contact us at [email protected] (see Section 14).

Resimay mobile app

The Resimay mobile app is an optional app for your phone. It uses the same Resimay account as the website, so the jobs, notes, interview details and documents you see or change in the app are the account data described in the rest of this policy, stored and handled the same way. That includes the AI processing in Section 4 when the app reads a job posting for you or tailors your resume. As with the website, our server receives technical details such as your IP address when the app connects. Resimay Labs Inc. is the data controller for the personal information the app handles. This section covers what the app adds.

What it keeps on your phone

The app keeps the following on your phone. Apart from these, it does not store your account data there: it loads your jobs and other details from your account while you use it. On an Android phone, uninstalling the app removes everything it stored.

• Your sign-in. The app keeps your sign-in tokens in the phone’s secure storage and deletes them when you sign out.
• An install identifier and a device secret. The first time it opens, the app creates a random identifier for that installation and a random secret, and keeps both in the phone’s secure storage. Neither comes from your phone’s hardware or from an advertising identifier. They belong to the installation rather than to your account, so signing out does not remove them. The app uses them to tie an email sign-in link to the phone that asked for it (see below), and it sends the identifier when you sign up in the app so we can limit how many sign-ups come from one phone in an hour.
• Documents you open. When you open a tailored resume or cover letter, the app downloads it into its own cache on the phone so you can read, share or save it. Signing out deletes these files, and deleting your account in the app signs you out. A copy you share or save to another app or folder is yours, and it stays there.

Email sign-in links

In the app you can sign in with a link we email you instead of a password. When you ask for one, the app sends our server your email address, the install identifier and a scrambled, one-way form of the device secret (a hash). We send the email only if that address has a Resimay account. The link works once, for 10 minutes, and only in the app on the phone that asked for it: when you open it, the app sends the secret itself so our server can check that it matches. We keep a scrambled copy of each link’s code with the install identifier and the scrambled secret, and a daily cleanup deletes them within about a day after the link expires. Link requests and sign-ins appear in your sign-in history like any other sign-in.

Notifications

If notifications are allowed for the app on your phone, the app registers your phone’s push token with our server, together with the phone’s type (Android or iPhone) and its time zone name, for example America/Toronto. A push token is the address our push notification provider uses to reach the app on your phone. The app reads the time zone from your phone’s date and time settings and never reads your location. We use the time zone only to send reminders at your reminder time in your own day (you can change that time in Settings on the website).

• What we send. We use the token only for notifications about your own job search: a follow-up that is due, an interview tomorrow, a saved job still waiting for a tailored resume, or new matches for a saved job search. Their text never names the company or the role; you see the details when you open the app. Each notification goes from our server to our push notification provider and then through the notification service built into your phone’s operating system. You can turn notifications off in the app (Profile, then Notifications) or in your phone’s settings.
• Signing out. The app asks our server to stop sending notifications to that phone, and we mark its token as signed out and stop using it.
• Deleting your account. Notifications stop straight away, and the push tokens and time zones on your account are deleted with the rest of your account data within 30 days (see Section 7).

What you share into the app

You can send a job link or posting to Resimay from another app with your phone’s Share button. The app reads only what you share, at that moment, and only links and text; images, files and other media are ignored. What you shared waits in the app’s memory on the Add a job screen, and nothing goes to our server until you tap Read the posting. Nothing is saved to your account until you tap Save to pipeline. If you give only a link, our server opens the posting at that link to read it, and skips sites whose rules do not allow that.

Trying the app before you sign in

Without an account, you can try a demo that scores and tailors your resume for a job. The resume text and job description you paste go to our server, which uses AI to produce the result (see Section 4), the same way as the free demo on our website. Our server does not save them, and the app keeps the result only in memory, so it is gone once the app closes.

What it never does

The app shows no ads and does not use your phone’s advertising identifier (on Android, the permission to read it is removed from the app). It does not ask for access to your location, contacts, photos, files, microphone or calendar, and it contains no third-party analytics, advertising or crash-reporting code. We never sell the data it handles. To delete your account from the app, go to Profile, then Delete account. Every way to delete it is on Delete your Resimay account.

5. Third-Party Services

Resimay relies on the following trusted third-party sub-processors to operate:

• Primary AI provider: powers web-app AI features (resume tailoring, cover letters, rejection analysis, resume checks, voice interview feedback) and is a backup for many features of the other two text and voice AI providers (see Section 4). Your resume text and job descriptions are sent to this provider’s API for generation. This provider contractually does not use API inputs to train its models.
• Voice and research AI provider: powers company research briefs, the voice mock interview, Interview Practice, the Resume Coach, resume and job description reading, email drafts in the Chrome extension, and the Chrome extension’s autofill assistance (open-ended drafts + structured select picks; demographic-blocklisted per Section 4.2). Your resume text, job descriptions and, for autofill assistance, a narrow slice of your profile plus the specific question are sent to this provider’s API for generation. This provider’s paid API terms prohibit using API inputs to train their models.
• Third AI provider: powers follow-up email drafts and is a backup for most text features when their main provider is unavailable (never for the Chrome extension’s suggested answers). Your resume text and job descriptions can be sent to this provider’s API for generation. This provider’s API terms do not allow API inputs to be used to train its models without explicit consent.
• Embeddings provider: powers job matching and job search by turning text into numerical representations. Your master resume text, the text of your job searches and the target job titles you give during onboarding are sent to this provider’s API; your account details are not.
• Managed PostgreSQL database provider: your account data, job applications, resumes, and AI outputs are stored in an encrypted PostgreSQL instance hosted by our database provider. Files you upload are kept in a private storage bucket with the same provider.
• Application hosting provider: runs the Resimay backend API and scheduled jobs (data purge, job-board refresh).
• Frontend hosting and edge provider: hosts the Resimay web application and serves static assets. It also measures page performance without cookies or visitor identity and, if you accept analytics cookies, counts page views (cookieless and aggregate, with no personal details).
• Network and security provider: provides the DNS for our domain and routes visits to our website through its network, which protects the site against attacks. It processes technical details of each website request, such as your IP address and browser type.
• Payments provider: processes subscription and one-time payments. It collects your card or other payment details directly, so we never see or store your full card number, and it receives your email address, your name and your Resimay account ID.
• Transactional email provider: delivers the emails we send you, such as email verification, password resets, billing notices, and the alerts, reminders and digests you choose to receive. It receives your email address, your name where an email uses it, and the content of each email.
• Review invitation platform: when you buy a plan, and about a week after you start using Resimay, a copy of that one email (your name, email address and the message text) also goes to the platform that runs our customer reviews, so it can invite you to leave a verified review. No reward is offered for a review, and the platform receives nothing else about your account.
• Product analytics provider: records how the website and app are used, such as pages viewed, features used and device and browser details. Events are tied to a random identifier. If you accept analytics cookies, they are also linked to your Resimay account ID, email address and name. Session recording is turned off. See our Cookies Policy.
• Website analytics providers: measure visits to our website, such as pages viewed, the site you came from and your device type. They do not receive your account details. One of them sets a cookie with a random identifier, depending on your region and your cookie choices (see our Cookies Policy).
• Support chat provider: runs the chat window on our site. When you are signed in, it receives your name, email address and Resimay account ID so we know who we are talking to, along with anything you write in the chat.
• Error tracking provider: receives a technical report when something fails in our service, such as the error message, the page or API route involved and, when you are signed in, your account ID. It is set up not to collect request contents, cookies or what you type.
• Metrics dashboard provider: charts how the service is running from aggregated figures in our database, such as sign-up counts, usage totals and costs. It does not receive your resume, your job applications or other content.
• Team chat provider: carries our internal alerts. The notice we get for each new sign-up includes your name and email address, and an alert about unusually high AI usage on an account includes that account’s email address and usage cost.
• Bot protection provider: checks that sign-ups come from people rather than bots. Its script runs on the sign-up page, and our server shares your IP address with it when we check the result.
• Push notification provider: delivers the Resimay mobile app’s notifications, handing each one to the notification service built into your phone’s operating system. It receives your phone’s push token and each notification’s title and text, which never name a company or a role, plus an internal reference the app uses to open the right screen.

Each sub-processor has its own privacy policy. We select providers with strong data protection commitments and review that list periodically.

Sub-processor changes

If we add a new sub-processor that will process your personal data, we will notify you at least 30 days in advance via email or an in-app announcement so you have an opportunity to object before the change takes effect.

6. International Data Transfers

Resimay Labs Inc. is incorporated in Ontario, Canada, but some of the sub-processors listed above are headquartered in the United States and may store or process your data on servers outside of Canada and the European Economic Area. Specifically:

• Primary AI provider: AI inference happens on United States infrastructure.
• Voice and research AI provider: AI inference happens on globally distributed infrastructure (primarily United States).
• Third AI provider: AI inference happens on the provider’s infrastructure, which may be outside Canada.
• Embeddings provider: your data may be transferred to and processed in the United States.
• Database hosting: your database project is hosted in a region we select at provisioning time (currently United States); the operator can migrate between regions as infrastructure requirements change.
• Frontend hosting and edge: frontend edge and analytics infrastructure is distributed globally, including the United States.
• Network, payments, email, review invitation, analytics, support chat, error tracking, metrics, team chat and bot protection providers: your data may be processed in the United States and in other countries where these providers operate.
• Push notification provider and your phone’s notification service: notifications for the mobile app may be processed in the United States and in other countries where these services operate.

All transfers are encrypted in transit (TLS 1.2 or higher). Where GDPR applies, we rely on each provider's published Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms. By using Resimay you consent to your data being transferred to, stored in, and processed in these jurisdictions. If this is a concern for you, please do not upload sensitive content and contact us at [email protected] to discuss alternatives.

7. Data Retention

Your account data is retained for as long as your account is active. When you delete your account (in-app or by written request):

• Straight away: you are signed out on every device, any active subscription is cancelled, and your sign-in history is deleted (the record of sign-ins, sign-outs and failed sign-in attempts on your account, including failed attempts that used your email address). The email address on your account is also removed from our product-updates list and our community waitlist. We also ask our product analytics, support chat and payments providers to delete what they hold about you: your analytics profile and its events, your support chat contact, and your customer record with the payments provider.
• Within 30 days: all other personal data in your account (your profile and saved answers, master resume, uploaded files, job applications, tailored resumes, cover letters, rejection analyses, interview sessions and Resume Coach conversations) is permanently purged from our database and file storage by an automated cleanup job, which also repeats the requests to those providers.
• In the Resimay mobile app: notifications to your phones stop straight away, and the push tokens and time zones on your account are deleted with the rest of your data within 30 days. Deleting your account in the app also signs you out on that phone and deletes the documents the app downloaded there.
• How to delete your account: step-by-step instructions for the mobile app and the website, and how to ask us by email if you cannot sign in, are on Delete your Resimay account.

Some records outlast the deletion. Our payments provider keeps its record of your past payments. We keep de-identified records of what each AI request cost, with the link to your account removed, for cost tracking. Other providers keep limited operational records on their own retention schedules, such as delivery logs for emails we sent you, error reports that may include your account ID, and our internal alert messages. Sign-in records are deleted after 180 days, or straight away when the account they belong to is deleted.

Anonymized, aggregated usage statistics (e.g., keyword match rates for a given job title) may be retained indefinitely as they cannot be used to identify you, and only when you explicitly opted in (see Section 11, Global Insights). Encrypted backups held by our database provider for disaster recovery retain deleted rows for up to 7 days before rotating out automatically; those backups are not queryable by the Resimay application and cannot be used to restore individual records on request.

8. Data Security

We take reasonable technical and organizational measures to protect your personal data:

• Encryption in transit. All data flowing between you, Resimay, and our sub-processors is protected by TLS 1.2 or higher. Our site tells browsers to use HTTPS only, for the site and its subdomains, for one year (HSTS with includeSubDomains).
• Encryption at rest. Your data is encrypted at rest in our database using AES-256 (provided by our managed database provider).
• Password storage. Passwords are never stored in plaintext. We hash them with argon2id (the current OWASP-recommended password key derivation function) using OWASP-recommended cost parameters. We do not see or retain your plaintext password at any point: not in logs, not in backups, not in memory beyond the milliseconds it takes to verify and discard.
• Token handling. Web-app authentication tokens (access and refresh JWTs) are issued as httpOnly cookies, which the browser refuses to expose to JavaScript. This blocks the most common token-theft path (cross-site scripting). Access tokens are short-lived (typically 15 minutes); long-lived refresh tokens can be revoked instantly when you sign out or change your password.
• Access controls. Database access is restricted to a minimal set of authenticated service roles, with row-level security policies enforcing per-user data isolation so one account cannot read another account's data.
• Backups. Encrypted backups are retained by our database provider for up to 7 days for disaster recovery and rotate out automatically.

Data breach notification

If we discover a security incident affecting your personal data, we will notify you within 72 hours of confirming the breach via email and an in-app notice. The notification will describe what happened, what data was involved, and what steps we are taking in response.

What we cannot defend against

No web service can protect against a compromised device. If malware or spyware is running on your computer with administrator privileges, it can read browser data and tokens regardless of any application-layer protection. The same exposure applies to your bank, your email, and your password manager. We strongly recommend keeping your operating system and browser up to date, avoiding browser extensions you don't fully trust, and treating account-recovery emails as sensitive (so an attacker who briefly accesses your email cannot trivially take over your Resimay account).

No security system is perfect. While we use industry-standard practices, we cannot guarantee absolute security of any data transmitted online.

9. Your Rights

You have the right to:

• Access & portability: download a machine-readable JSON copy of the data your account holds at any time from the account settings menu (“Export my data”), or request one by email. It includes your account details, profile fields and saved answers, onboarding answers, master resume, tracked jobs and notes, tailored resumes, cover letters, rejection analyses, interview practice sessions, Resume Coach conversations, email drafts and reminders, subscription and purchase records, sign-in history, any entry for your email address on our product-updates list or community waitlist, and the files you uploaded. Files are included in the download itself up to 5 MB each and 15 MB in total; any others are listed with a link you can open after signing in. If you use the mobile app, the download also lists the phones registered for notifications (each one’s type, time zone, and when it was added, last checked in and signed out) and a log of the job reminders sent to them by push (which job, what kind and when). The push tokens themselves are left out, because each one works as a key to a phone’s notifications, and so are sign-in link records, which hold only scrambled codes and expire after 10 minutes.
• Correction: update your profile, master resume, and application records in-app at any time, or request correction of data you cannot change yourself.
• Deletion (erasure): delete your account in-app from the settings menu. Your data is purged within 30 days as described in Section 7. In the mobile app, go to Profile, then Delete account. Every way to delete your account, including by email, is on Delete your Resimay account.
• Objection & restriction: ask us to stop processing your data for a specific purpose (e.g., opt out of Global Insights).
• Complaint: lodge a complaint with your local data-protection authority. In Canada that is the Office of the Privacy Commissioner (priv.gc.ca); in the EU/EEA, your national supervisory authority.

To exercise any right that isn't self-serve, contact us at [email protected]. We will respond within 30 days.

10. California Residents (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), in addition to the rights listed in Section 9:

• Right to Know the categories of personal information we collect, the sources, the business purpose, and the categories of third parties with whom we share it (each disclosed in Sections 2, 3, 5, and 6).
• Right to Delete personal information we have collected (already covered globally; see Section 9, Deletion).
• Right to Correct inaccurate personal information.
• Right to Opt Out of Sale or Sharing: California residents have the right to opt out of the sale or sharing of personal information. Resimay does not sell or share personal information as those terms are defined under CCPA/CPRA. There is nothing to opt out of, but if this ever changes you will be notified and given an opt-out mechanism before the change takes effect.
• Right to Limit Use of Sensitive Personal Information: Resimay does not collect “sensitive personal information” as defined by CPRA (e.g., precise geolocation, biometric data, racial or ethnic origin, religious beliefs, union membership, health information, sexual orientation).
• Right to Non-Discrimination: we will not deny service, charge a different price, or provide a lower quality of service because you exercised any of these rights.

To exercise any California privacy right, email us at [email protected]. We will verify your identity and respond within 45 days as required by CCPA.

11. Global Insights (opt-in)

Resimay may surface aggregated market insights (e.g., trending job titles, in-demand skills) derived from anonymized application data across the platform.

Your data is only included in Global Insights if you have explicitly opted in (insights_consent = true in your account settings). No personally identifiable information (PII), including your name, email, resume text, or specific job applications, is ever included in insights data.

When consent is given, we retain de-identified metadata (normalized job title, experience level, matched keywords, outcome) at month-level granularity (never an exact timestamp), so it cannot be correlated back to you. When you delete your account, all your personal data is removed; these anonymized insight rows are retained because they contain no personal identifiers and continue to power insights for other job seekers.

What we never do

Some commitments worth calling out separately:

• We never sell your data: to anyone, for any reason.
• We never run ads: there are no advertising trackers on Resimay.
• We never share your resume text with third parties, other than the AI providers needed to produce the output you asked for and the embeddings provider that powers job matching and search (see Section 4).
• We never share your interview transcripts or AI coaching feedback. Those stay private to your account.

12. Children's Privacy

Resimay is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or via an in-app notice, and update the “Last updated” date at the top of this page. Continued use of Resimay after changes take effect constitutes your acceptance of the updated policy.

14. Contact

For any privacy-related questions or requests, contact us at:

[email protected]