Privacy Policy

1. Information we collect

Account information

When you sign up, we receive your email address from our sign-in provider, Amazon Cognito. If you sign up with email, you create your password on a sign-in page hosted by Amazon Cognito; Cognito handles the password, and we never see it. If you sign in with Google, Google shares your name, email address and profile picture link with us. We keep your email address and name in your Resmate profile. If we don’t have your name, we may fill it in from a resume you upload.

Resumes and job information you give us

• Resume files you upload (PDF or Word .docx, up to 10 MB) and the information we extract from them, such as your name, contact details, work history, education and skills.
• Resumes you create with the resume builder, and edits you make.
• Job descriptions you paste or choose from the job board, and job preferences you save, such as target titles and locations, experience level, minimum salary, skills and companies to exclude.
• Choices you make about your documents, such as which skills to keep or remove.
• Applications you track: the job, the company, the resume you used, the date and the status.

Resumes usually contain personal details. Please leave out anything employers don’t need, such as government ID numbers, bank details or health information.

Content we create for you

Tailored resumes, cover letters, LinkedIn profile text, match and ATS scores, skill-gap and recruiter-style reviews, and the files you download. These are stored in your account.

Payment information

Payments are handled by Stripe. When you subscribe, you enter your payment details on Stripe’s checkout page, and we never receive or store your full card number. We keep your Stripe customer ID, subscription ID, current plan, and whether a payment has failed.

Usage and technical information

• When you last used Resmate, and how many AI actions you’ve used today, so we can apply your plan’s daily limits.
• Job listings you’ve viewed or marked as applied, so we can label them for you.
• Technical logs that our servers create while handling requests, which can include your account ID. We use them to run, fix and secure the Service.
• Like any website, our hosting provider receives technical information such as your IP address and browser type in order to deliver the site to you.

We don’t use third-party analytics, advertising or session-recording tools.

Voice input

Some pages let you dictate text using your browser’s built-in speech recognition. Your browser handles the audio (and may use its maker’s online speech service to do so). We only receive the resulting text, and only if you submit it.

2. How we use your information

• To provide Resmate: read and score your resumes, tailor them to jobs, create documents, show job listings and matches, and keep track of your applications.
• To run your account: sign you in, keep you signed in, and apply your plan and its limits.
• To process payments and manage subscriptions through Stripe.
• To keep Resmate secure and working: prevent abuse, investigate and fix problems, and answer your messages.
• To comply with the law.

We don’t sell your personal information, we don’t share it for targeted advertising, and we don’t use your content to train AI models.

If you’re in the European Economic Area or the UK, our legal bases are: performing our contract with you (providing the Service you signed up for), our legitimate interests in keeping Resmate secure and working, complying with legal obligations, and your consent where the law requires it.

3. AI processing

Resmate’s AI features use Claude models made by Anthropic, which we access through Amazon Bedrock, a service of Amazon Web Services (AWS). When you use an AI feature, we send the content needed for that task — for example, your resume text, a job description and our instructions — to Amazon Bedrock, and we store the result in your account.

• Amazon states that model providers such as Anthropic don’t have access to the prompts and outputs processed through Amazon Bedrock.
• We don’t use your content to train AI models.
• AI processing runs in AWS regions in the United States.
• To avoid repeating the same work, we keep a cache of some AI results. Cached results aren't linked to your account, and they're deleted automatically about 30 to 90 days after they're created.
• AI can make mistakes. Review everything before you use it — see our Terms of Service.

4. How we share information

We share personal information with these service providers, only as needed to run Resmate:

• Amazon Web Services (AWS) — hosting, file and database storage, sign-in (Amazon Cognito) and AI processing (Amazon Bedrock).
• Stripe — payments and subscription management, if you buy a paid plan. We give Stripe an internal account ID so we can link payments to your account. Stripe handles your payment details under its own privacy policy.
• Google — only if you choose Sign in with Google. Google handles that sign-in under its own privacy policy.

We may also disclose information if the law requires it, to protect the rights, safety or security of our users, the public or Resmate, or as part of a merger, acquisition or sale of our business.

Resmate doesn’t send your resume to employers. When you apply for a job, you do so on the employer’s or job board’s website, and what you share there is covered by their policies.

5. Job listings

Our job board shows job postings collected from third-party job boards and from companies’ public career pages. Some postings include contact details that the employer published, such as a recruiting email address. If your details appear in a listing and you want them removed, email us at resvoai@gmail.com.

6. How long we keep information

We keep your account information and content while your account is open, until you delete it or ask us to delete your account. Some data is removed automatically:

• A job description you paste to replace a job-board listing's description is deleted automatically about 30 days after you paste it.
• Cached AI results are deleted automatically about 30 to 90 days after they're created.

You can delete individual resumes from your dashboard at any time.

Deleting your account

To delete your account, email resvoai@gmail.com from the email address you use for Resmate and ask us to delete your account. We’ll delete your account and the data linked to it — your profile, resumes and files, generated documents, job descriptions, preferences and application records — and confirm when it’s done. If you have a paid plan, cancel it in Billing first, or ask us to cancel it in the same email.

After your account is deleted:

• copies may remain in our database’s automatic backups for up to 35 days before they’re gone for good;
• if your account existed on 27 September 2026, a copy may also remain in a one-time backup of our database made that day, which we keep for up to one year and then delete;
• cached AI results, which aren't linked to your account, are deleted automatically within about 90 days of being created; and
• we may keep limited records where we need to for legal, tax or accounting reasons, or to resolve disputes — for example, records of payments. Stripe keeps its own payment records under its own policy.

7. Security

We take reasonable measures to protect your information:

• Connections to Resmate are encrypted with HTTPS.
• Uploaded and generated files are stored in Amazon S3, in a private storage bucket that blocks public access, and are encrypted at rest with AWS Key Management Service (KMS).
• Links for uploading and downloading files expire after a short time (an hour at most).
• Sign-in is handled by Amazon Cognito.
• Within Resvo, only people who need it to run the Service, support users or fix problems can access user data.

No method of storing or sending data is completely secure, so we can’t guarantee absolute security. If a breach affects your personal information, we’ll notify you as required by law.

8. Children

Resmate isn’t meant for anyone under 16, and we don’t knowingly collect personal information from children under 16. If you believe a child under 16 has given us personal information, email us and we’ll delete it.

9. International transfers

Resmate runs on AWS in the United States. We store your information in the AWS US East (N. Virginia) region, and AI processing runs in AWS regions in the United States. If you use Resmate from outside the United States, your information is transferred to and processed in the United States, where data protection laws may differ from those in your country. Stripe and Google may process information in other countries under their own policies.

10. Your rights and choices

You can:

• see and download your resumes and generated documents in the app at any time;
• edit your resume content in the app, and delete individual resumes from your dashboard;
• cancel your subscription in Billing → Manage Billing; and
• ask us for a copy of your personal information, or ask us to correct or delete it, by emailing resvoai@gmail.com.

Depending on where you live — for example in the EEA, the UK or certain US states — you may have other rights, such as the right to object to or restrict some processing, to receive your data in a portable format, or to complain to your local data protection authority. To use any of these rights, email us. We may need to confirm your identity first, usually by asking you to write from the email address on your account. We aim to respond within 30 days, and we won’t treat you differently for using your rights.

11. Browser storage and cookies

Resmate saves a few items in your browser so the app works:

• Sign-in tokens that keep you signed in (resmate_access_token, resmate_id_token, resmate_refresh_token).
• The resume you used last (resmate_last_resume_id) and when you last opened the job board (resmate_jobs_last_visit).
• Your display theme (resvo_theme) and resume design settings (resvo-design-…).
• Job board filters and scroll position (resmate_job_filters_v1, resmate_jobs_scroll), kept in session storage, which your browser clears when you close the tab.

Apart from the job board filters and scroll position, these items are kept in your browser’s local storage. Resmate itself doesn’t set cookies for your account, and we don’t use advertising or analytics cookies. The sign-in pages (hosted by Amazon Cognito), Google sign-in, and Stripe’s checkout and billing pages run on those providers’ own websites and may set their own cookies under their own policies. You can clear this data at any time in your browser settings; clearing the sign-in tokens signs you out.

12. The Resmate Autofill browser extension

If you install our optional browser extension, it fills job application forms on supported career pages (Greenhouse: boards.greenhouse.io and job-boards.greenhouse.io, including forms embedded on company career sites; Lever: jobs.lever.co and jobs.eu.lever.co) using data you already saved in your Resmate account — your profile and contact details, links, screening answers, and your resume file, fetched over HTTPS from your own account. On those pages it reads the application form's field labels locally to work out what each field asks; when you fill a form or click “I pressed Submit”, it saves that application's page URL, company, job title, status and an audit trail (which fields were filled, from which source, when) to your own account.

• The extension stores exactly one thing locally: a pairing token. It is hashed at rest on our side, expires after 90 days, is limited to 5 per account, and you can revoke all tokens at any time; disconnecting removes it from your browser.
• It talks only to resmate.ai (and a time-limited signed link to download your own resume file). No third-party services, no analytics, no ads.
• It never collects browsing history or reads any page other than supported application pages, never answers or stores EEO, demographic, criminal-history or date-of-birth questions, never bypasses CAPTCHAs or logins (it stops and shows a notice), and never submits an application — you always press Submit yourself.
• Per-account daily fill limits apply. Deleting your Resmate account deletes your profile, tracker and audit data under the retention terms above.

13. Changes to this policy

We may update this Privacy Policy from time to time. We’ll post the new version here and change the “Last updated” date. If a change is material, we’ll tell you before it takes effect, for example by email or with a notice on the site.

14. Contact us

For privacy questions or requests, email resvoai@gmail.com. Resmate is operated by Resvo.