Last updated: July 31, 2026
This policy describes how Resume Master handles the personal data contained in résumés and candidate profiles processed through Resume Master, including when we act as a processor for organization customers.
For individual users, we act as a data controller of account data and a processor of the résumé content you submit. For organization customers, the organization is the controller of its candidates’ data and we act as its processor under a Data Processing Agreement (available on request at team@resumemaster.online).
Identity and contact details, employment and education history, skills, and any other information included in a résumé or provided during a résumé-understanding call. We ask that you do not submit special-category data (e.g. health, religion) unless strictly necessary.
Résumé and job-description content submitted for AI assistance is transmitted to Anthropic (the Claude models) to generate drafting, tailoring, audit, scoring, cover-letter, LinkedIn, and interview-prep output, under Anthropic’s commercial terms with a data-processing addendum. Web-search features used during research may transmit non-candidate query terms (company/role/field) to a search provider. We also use Stripe for payment processing (card details are entered directly with Stripe and are not stored on our servers), Sentry for error monitoring (configured to scrub personal data), and Resend for transactional email.
Each customer’s data is isolated at the database layer (row-level security keyed to the account), so one customer can never read another’s records. Staff access is limited to what is required to deliver a request; privileged operations are logged. Optional two-factor authentication protects administrator accounts.
We retain candidate data for the duration of the engagement and delete or return it within 30 days of account closure or on documented request, subject to legal retention requirements.
We operate from India and serve customers in the United States and elsewhere, so data may be processed across borders (including India ↔ United States) in the regions operated by our hosting provider (Supabase) and other sub-processors. Where required, transfers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.
In the event of a personal-data breach affecting your data, we will notify the affected controller/customer without undue delay and within 72 hours of becoming aware, with the information needed to meet applicable reporting obligations.
Handling data honestly extends to how we bill. As a public commitment: automatic renewals are disclosed in advance and never hidden; we bill on honest calendar periods, not shortened cycles; you can cancel in one click without a retention maze; and any discount we show is genuine. See our Terms of Service for full billing terms.
Organizations may request our Data Processing Agreement and current sub-processor list at team@resumemaster.online. A Data Protection Impact Assessment should be completed before onboarding EU-based organization data.