Privacy Policy

1. Who we are

This service ("Resume Builder", "we", "us") is provided by [CONTROLLER NAME], based in Norway. We are the "data controller" responsible for the personal data described in this policy.

For any privacy question or to exercise your rights, contact us at support@resumeonce.app.

2. What data we collect

• Account data — your email address and a password (which we never store in readable form; it is securely hashed), plus the date you signed up.
• Resume content you enter — everything you type or upload into your CV: your name, job title, contact details (phone, email, city), a photo if you add one, your work history, education, skills, and any custom sections.
• Resumes you import — if you use the "Import Resume" feature, the PDF or Word document you upload is sent for automated reading so its content can be filled into the editor.
• Payment data — when you buy access, your payment is handled by Stripe. We receive a record that a payment was made and your access expiry date; we do not receive or store your card number.
• Technical data — like any website, our hosting and content providers automatically receive your IP address and basic browser information when you load a page.

3. Why we use it, and our legal basis

Under the GDPR we must have a "legal basis" for each use of your data. Here is what we do and why we are allowed to:

What we do	Legal basis
Create and run your account; save, display and export your resume	Performance of a contract — we need this data to provide the service you signed up for.
Read an uploaded resume to pre-fill the editor (AI import)	Performance of a contract — carried out only when you choose to import a file.
Take payment and grant timed access	Performance of a contract; keeping payment records is also a legal obligation (accounting law).
Keep the service secure and prevent abuse	Legitimate interests — to protect you and us.

4. Who we share it with

We don't sell your data. We share it only with the providers we rely on to run the service ("processors"), and only as far as needed:

• Supabase — secure hosting of your account and resume data (database and login).
• Anthropic — when you use AI import, the document you upload is processed by Anthropic's Claude model to extract its content. This processing takes place in the United States.
• Stripe — to process payments securely. Stripe handles your card details directly.
• Vercel — hosts the website and provides privacy-friendly, cookieless visitor analytics (anonymous, aggregated page-view counts). Vercel receives your IP address as a normal part of serving the site; it is used only to count visits and is not used to identify or track you across sites.
• Google Fonts / content delivery networks — to load fonts and scripts your browser needs to display the site; these receive your IP address as a normal part of serving a web page.

5. Where your data is stored, and international transfers

Your account and resume data are stored with our hosting provider, Supabase, in Ireland (within the European Economic Area). Some processing takes place outside the European Economic Area (EEA) — in particular, the AI import feature sends your uploaded document to Anthropic in the United States. Where data leaves the EEA, we rely on Standard Contractual Clauses and equivalent safeguards approved under the GDPR to protect it.

6. How long we keep it

• Account and resume data — for as long as you keep your account. When you delete your account, your resume data is deleted with it.
• Imported documents — the file you upload is used only to extract its content and is not stored by us afterwards; only the resulting resume text is saved, and only if you keep it.
• Payment records — kept for as long as accounting and tax law require (typically several years), then deleted.

7. How we protect your data

• All data is encrypted in transit (HTTPS/TLS) between your browser and our providers.
• Data is encrypted at rest by our hosting provider.
• Passwords are stored only as secure one-way hashes — never in readable form.
• Access controls ensure each account can only read and write its own data.

8. Cookies and local storage

We use only the storage strictly necessary to keep you logged in (a secure session token). For visitor statistics we use Vercel Web Analytics, which is cookieless — it sets no cookies and counts page views in aggregate only, without building a profile of you or tracking you across other sites. Because we use no advertising or third-party tracking cookies, no cookie consent banner is required.

9. Your rights

Under the GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Portability — receive your data in a machine-readable format (you can already export your resume as JSON and PDF from the editor).
• Rectification — correct anything inaccurate (you can edit your resume directly).
• Erasure — delete your account and the data associated with it.
• Restriction and objection — limit or object to certain processing.

To exercise any of these, email support@resumeonce.app. We will respond within one month, free of charge.

10. Children

Resume Builder is intended for job seekers and is not directed at children under 16. We do not knowingly collect data from children.

11. Changes to this policy

If we change how we handle your data, we will update this page and the "last updated" date above. Significant changes will be communicated where appropriate.

12. Complaints

If you have a concern we haven't resolved, you have the right to lodge a complaint with your local data protection authority. In Norway this is Datatilsynet (datatilsynet.no).

← Back to home