Privacy Policy

1. Who is responsible

The controller of your personal data is the operator of ResumeTailor named in the “Who runs ResumeTailor” box on this page (name, tax ID, address and e-mail). For anything about your data, write to us through the contact form (topic “My data”) or to the e-mail in that box.

2. What we collect

• Account: e-mail, name (optional), password (stored only as a salted scrypt hash), preferred language, and the date you accepted these terms.
• What you give us to build a kit: résumé text, job postings, the answers you type or say (as text), your target role and profile details.
• What the service produces for you: tailored résumés, cover letters, e-mails, LinkedIn texts, interview questions, your answers, scores and summaries, and the public web résumé if you publish one.
• Voice: speech is turned into text by your browser's own speech recognition (in Chrome, for example, that is a Google service). We receive only the text, never your audio.
• Payments: the pack, amount, currency, status and the payment provider's reference. Card, Pix and bank details are handled by Stripe or Mercado Pago and never reach us.
• Application tracker: the companies, roles, links, notes and dates you enter.
• Saved profile: the base résumé and the facts you gave us (spoken details, the numbers you answered), kept so the next kit starts from them. You can change or remove it at any time in your library.
• Technical data: IP address (for security, abuse prevention and rate limits — never stored with the statistics below), cookies and browser storage (see the Cookie Notice), and events from your first sessions (for example “made a kit”, “started the tour”).
• Our own visit statistics: pages opened, the campaign tags (UTM) and referring site of your first visit, language, phone or computer, and steps such as “made a preview”, “created an account” or “bought credits”, linked to a random visitor ID and, once you sign up, to your account. No third-party analytics.
• Contact messages: what you write to us and the e-mail you give.

Files you import (PDF, Word) are read inside your browser and are not uploaded. The free ATS check also runs entirely in your browser. The “Am I a fit?” check keeps only the verdict and a fingerprint of the texts, not the texts themselves.

3. Why we use it, and on what legal basis

• To provide the service you asked for — generating and storing your kits, interviews and tracker (performance of a contract, LGPD art. 7, V).
• To process payments, prevent fraud and keep accounting records (legal obligation and contract, art. 7, II and V).
• To keep the service secure and affordable — rate limits, abuse and spam prevention, cost control (legitimate interest, art. 7, IX).
• To answer you when you contact us (contract and legitimate interest).
• To understand how the product is used, which pages and campaigns work, and to improve it, using first-session events and our own visit statistics (legitimate interest). Browsers that send Global Privacy Control or Do Not Track are left out of the statistics. We do not sell data, show ads or build advertising profiles.
• To publish your web résumé, only when you switch it on (your choice, which you can undo at any time).

4. Who helps us (processors)

We share data only with the providers needed to run the service, each for its own task:

• Anthropic (United States) — the AI that writes your kits and scores your interview answers. Under Anthropic's commercial terms, content sent through its API is not used to train its models.
• Mercado Pago and Stripe — payment processing. They act under their own privacy policies for the payment data you give them.
• ElevenLabs or OpenAI (United States) — the AI voice that reads the app's questions aloud, when voice is enabled. They receive the text being read, which can include details you mentioned.
• Tavily — web search for company insights, when that feature is enabled. It receives the company name taken from the posting.
• Hostinger — the servers where the service and its database run.
• Meta (WhatsApp) — only if you choose to contact us or share your web résumé through WhatsApp; WhatsApp's own policy applies there.

If you publish a web résumé, anyone with the link can see it (unless you set a PIN), and search engines only index it if you allow that.

We may also disclose data when required by law or by a competent authority.

5. International transfers

Several of these providers process data outside Brazil, mainly in the United States. These transfers follow LGPD art. 33, relying on the contractual guarantees in each provider's terms, and we choose providers that commit to security and confidentiality.

6. How long we keep it

• Account, kits, interviews, tracker and voice transcripts: while your account exists. When you delete your account they are erased from the live database right away, together with the messages you sent us from that e-mail; AI cost records stay, with nothing that points to you; backup copies, where they exist, are overwritten as backups rotate.
• Payment records: kept for as long as tax and accounting law requires, without your name or e-mail once your account is deleted.
• Previews made without an account are tied to a random cookie in your browser; ask us through the contact form to delete them.
• Security records such as rate-limit counters expire within hours or days; records of AI usage and errors are kept only as long as needed for security and cost control.
• Visit statistics: raw events are deleted after 180 days. The record of your first visit is deleted after 180 days too if you never create an account, or kept while your account exists; deleting the account removes it and unlinks your events from you.
• Contact messages: as long as needed to handle your request.

7. Your rights and how to use them

Under LGPD art. 18 you can ask for: confirmation that we process your data; access to it; correction; anonymisation, blocking or deletion of unnecessary data; portability; information about who we share it with; information about refusing consent and its consequences; and withdrawal of consent. You can also object to processing based on legitimate interest.

• In your account page: download all your data (JSON), change your password, sign out of every device, and delete your account.
• For anything else: the contact form, topic “My data”. We answer within the legal deadlines.
• You can also complain to Brazil's data protection authority (ANPD) at gov.br/anpd.

8. Cookies

We use only first-party cookies and browser storage: what the service needs to work (sign-in, your anonymous previews, a verified PIN, your language, a friend's referral code) and the random visitor ID behind our own visit statistics. No advertising cookies and no third-party analytics. Details are in the Cookie Notice.

9. Security

Connections use HTTPS, passwords are stored only as salted hashes, sessions can be revoked, and access to the admin panel is restricted. No system is perfectly secure; if an incident puts your data at risk, we will tell you and the authorities as the law requires.

10. Children and teenagers

ResumeTailor is meant for adults. People under 18 should use it with the involvement of a parent or guardian.

11. Changes

When this policy changes we update the date at the top. If a change affects how we use your data in a significant way, we will announce it on the site before it takes effect.