Privacy Policy - My Resume Robot

My Resume Robot ("we", "us", "our") operates the website myresumerobot.com and the web application at webapp.myresumerobot.com (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

Prefer plain language? How we handle your data is a short summary of this policy. If the two ever differ, this policy governs.

1. Information We Collect

Account Information: When you create an account, we collect your email address and password (stored as a secure hash). If you sign in with LinkedIn, we receive your name, email address, profile headline, profile picture URL, and LinkedIn user identifier.

Profile Data: You may provide professional information including your name, contact details, work experience, skills, education, certifications, and interests. This data is provided voluntarily and is used to generate resumes and cover letters.

Imported Data: If you upload a resume file or paste profile text, we process that content to extract structured professional data. Uploaded files are read in memory and are not kept after extraction. For older Word, OpenDocument and RTF formats, a temporary copy is written to a private temporary folder so it can be converted, and it is deleted immediately afterwards.

Job Posting Data: When you paste a job posting for resume generation, we store the posting text to generate tailored content and allow you to manage your applications.

AI-Generated Content: We store resumes and cover letters generated by our AI system, along with metadata about AI usage (provider, model, token counts, duration) for service monitoring and cost management.

Technical Data: We automatically collect standard server log data including IP addresses, browser type, and access times for security and performance monitoring. Server logs are rotated daily and kept for about two weeks.

Advertising Data: If we display advertising on the Service, our ad system records limited technical data — such as your IP address and browser user-agent string — associated with each ad impression or click, for the purpose of serving and measuring ads.

2. How We Use Your Information

To create and manage your account
To generate tailored resumes and cover letters using AI
To provide AI-powered suggestions for improving your profile
To import and parse professional data from uploaded documents or pasted text
To authenticate your identity (including via LinkedIn OAuth)
To monitor and improve the Service
To communicate with you about your account or the Service

3. Third-Party Services

AI Providers: We use third-party AI providers to parse resumes, generate content, and provide suggestions. Your professional data (including, where a document needs them, the name and contact details in your profile) and job posting text are sent to the provider for processing. We only use providers whose business terms say they do not use our requests to train their models. The provider processes data according to its own privacy policy and data processing agreements. To find out which provider we currently use, write to privacy@myresumerobot.com.

Payment Processors: Paid subscriptions are processed by Stripe. When you subscribe, you provide your payment details directly to Stripe; we do not store your full card or bank details on our servers. We receive limited billing information from Stripe (such as your plan, subscription status, the last four digits of a card, and transaction identifiers) to manage your subscription. Stripe handles your payment information under its own privacy policy.

Email Delivery: We send transactional emails (such as email verification, password resets, and billing notices) through our mail server and delivery providers. We do not send marketing email without your consent.

Cross-Border Processing: Some of our service providers (including the AI and payment providers above) are located in the United States. By using the Service, you acknowledge that your information may be processed and stored outside Canada, where data-protection laws may differ. We take reasonable steps to ensure your information is handled in accordance with this policy.

LinkedIn: If you choose to sign in with LinkedIn, we use LinkedIn's OpenID Connect protocol. We only receive the basic profile information you authorize (name, email, headline, photo). We do not access your LinkedIn connections, messages, or activity.

Web Scraping: If you provide a URL to import a profile from a job site (Indeed, Glassdoor, etc.), we visit that publicly accessible page to extract text content. We do not log in to any service on your behalf.

4. Data Storage and Security

Your data is stored in a secured PostgreSQL database. Passwords are hashed using bcrypt with a work factor of 12. Authentication uses JWT tokens with short-lived access tokens (15 minutes) and refresh tokens (7 days).

We implement reasonable technical and organizational measures to protect your personal information. However, no method of electronic transmission or storage is 100% secure.

5. Data Retention

We retain your account and profile data for as long as your account is active. You may delete your account at any time, which will remove all associated data including your profile, work experience, skills, education, certifications, interests, job postings, resumes, and cover letters. When you delete your account, your data is removed from our active systems immediately and ages out of our routine nightly backups within 8 days.

We may retain a limited amount of information where required for legal, accounting, or fraud-prevention purposes (for example, records of payments and refunds), for as long as required by applicable law.

Uploaded resume files are not retained after extraction is complete (see section 1 for the temporary copy used to convert older file formats).

6. Your Rights

Access: You can view all your stored data through the Service at any time.
Correction: You can update your profile data at any time through the Service.
Deletion: You can delete individual records or your entire account.
Export: You can download your generated resumes and cover letters as PDF.
Withdraw Consent: You can disconnect your LinkedIn account or stop using the Service at any time.

7. Cookies and Local Storage

To keep you signed in, we use a short-lived access token that is held in your browser (in memory or local storage) and a longer-lived refresh token that is stored in an httpOnly cookie, which JavaScript cannot read. These are strictly necessary to authenticate you and are not used for tracking or advertising purposes. We do not use tracking cookies, advertising cookies, or any third-party analytics service. For basic traffic measurement we run Umami, an open-source analytics tool hosted on our own server — not Google Analytics or any advertising network. It sets no cookies, does not use device fingerprinting, does not follow you across other websites, and records no personal information: it counts page views and referrers only. Your IP address is used transiently to derive an approximate country and is never stored. Analytics also run inside the signed-in app, but only ever record which SCREEN was viewed — never the content of your resumes, cover letters or profile. Record identifiers are stripped from the address before it is recorded (a resume page is logged as “/documents/resume/:id”, never the specific document), and the query string is never recorded at all, so links containing a sign-in or password-reset token are never sent. Pages in the admin area are not tracked.

8. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

10. Contact Us

My Resume Robot is operated by LLnet Research & Development Canada, based in Cochrane, Ontario, Canada. If you have questions about this Privacy Policy, your personal data, or wish to exercise any of your rights (including under Canada's PIPEDA), contact us at:

Email: privacy@myresumerobot.com

If you have a concern about how we handle your personal information and are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca or 1-800-282-1376.

We will respond to privacy requests within a reasonable timeframe and in accordance with applicable law. If you are located in the EU/UK or California, you may have additional rights (such as access, portability, deletion, and the right to object); contact us and we will honour applicable requests.