Privacy Policy

Last updated 30 September 2026

Your resume is personal. This policy explains what ResumeX stores, why, who else sees it and how you stay in control.

Who is responsible

ResumeX is run by Mehboob Ehsan Khan Omi in Bangladesh, who decides how your personal data is used (the “data controller”, or “data fiduciary” under Bangladesh's Personal Data Protection Act). For anything about your data, email us at support@resumex.cc.

What we collect

  • Account details: your name, email address and a securely hashed password (we never see or store the password itself).
  • Resume content: everything you enter in the builder, including contact details, work history, references and an optional photo. If you add biodata details to a resume (such as parents' names and addresses), they are kept in that resume only, are never shown on share links and are never sent to the AI. We never ask for national ID numbers.
  • Career Profile: if you set one up, the career details you keep in it (the same kind of content as a resume). We don't ask for or keep sensitive identity details such as national ID numbers.
  • Job applications: if you track applications, the job details you save (such as the job post, deadlines and notes), the contacts you add, and a copy of the resume you sent. Links you ask us to read are fetched by our server once to fill in the job details. We email you reminders about your own deadlines and interviews, and a weekly digest, unless you turn them off in your account settings or with the link in any of those emails.
  • Usage records: for each AI request, which feature it was, how many credits it used and how much text went in and out (not the text itself), to apply fair-use limits and keep costs in check. When you download a PDF, which template it used, to apply the Refund Policy.
  • Payments: if you buy a plan, Paddle (our reseller and merchant of record) takes the payment. We never see or store your card details. Paddle tells us your plan, what was charged and refunded, and your billing country, and we keep those records for accounting even after an account is deleted (without the link to the account).
  • Upgrade steps: when a paid feature is shown to you as locked, or you open the checkout, we note that it happened and from which feature, to understand which features are worth paying for. Only the step is recorded, not your content. These records are deleted with your account, or after about 13 months.
  • Technical data: our hosting providers keep standard server logs (such as IP address and browser type) for security and troubleshooting.
  • Feedback you send: your message, the page you were on, a screenshot if you add one, and your email so we can reply. We use it only to improve ResumeX and to answer you.
  • Error reports: when something breaks, the site sends us the error and the page address (without anything after the “?”). Emails and long numbers are removed before we store it.
  • How you found us: when you sign up we note whether you used a campaign code, the tag of the link you arrived by (for example “ref=fb-post”), and a scrambled code for your network (not your IP address) so we can spot mass sign-ups.

You can use the builder without an account. In that case your draft stays in your own browser and is never sent to us unless you save it or use an AI feature.

Private sessions go further: nothing is saved on our servers or in your browser, and the resume disappears when you close the tab. You can download your PDF, or save a file to your own device and open it again later. The PDF and the ATS check are created entirely in your browser.

How we use it

  • To provide the service: save your resumes, generate PDFs, run the ATS check and show public pages you choose to share.
  • To keep accounts secure, prevent abuse and enforce limits.
  • To send essential emails, such as password reset links. We don't send marketing emails without your consent.

We don't sell your data, show ads or use advertising trackers.

Why we're allowed to use it

  • To provide what you signed up for: your account, resumes, Career Profile, applications, reminders and any plan you buy.
  • Your consent: you agree to this policy when you create an account, and you choose when to use AI features, share a resume publicly or send feedback. You can withdraw consent at any time by stopping that use, turning emails off or deleting your account.
  • Legitimate interests: keeping ResumeX secure and fair (limits, abuse checks, error reports) and understanding how people find us.
  • The law: keeping payment records for accounting and tax.

AI features

When you use an AI feature (the assistant, rewrites, cover letters, importing a resume, or help with a specific job), the relevant resume content, and for job help the job description you saved, is sent to Google's Gemini models (through the Gemini API or Google Cloud's Vertex AI) to generate the answer and is handled under Google's terms for those services. We send only what the feature needs and never your password or photo. The ATS check itself runs in your browser and does not use AI.

The ATS checker

When you upload a PDF to the ATS checker, it's sent over an encrypted connection to our API, which extracts its text and returns it to your browser, where the checks run. The file is held in memory only while it's read. It isn't saved, logged or used for anything else, and no AI is involved. We count checks per network address to keep the free checker fair, and those counts expire within the hour.

Public resumes

Resumes are private by default. If you turn on sharing, anyone with the link can view and download that resume, and search engines may index the page. Turn sharing off at any time to remove access.

Cookies and local storage

We don't use advertising or analytics cookies, or any tracker that follows you across sites, so there's no cookie banner to click. ResumeX keeps only a few things in your browser's local storage, each needed for the site to work as you asked:

  • Your sign-in, until you log out.
  • An unsaved draft of the resume you're working on without an account, until you save it or clear it (never in a private session).
  • An invite code or the tag of the link you came from, for 30 days, sent once when you sign up.
  • Small display choices, such as list or board view, and whether you've seen a welcome message.

When you open the checkout, Paddle's payment form may set its own cookies needed for the payment and to prevent fraud, under Paddle's privacy policy. Our fonts are served from our own site. Clearing your browser data removes everything above.

Who processes your data

We rely on these providers to run ResumeX. They process data only to provide their service to us:

  • Vercel: hosts the website.
  • Google Cloud: runs our servers, and Google's Gemini models for AI features.
  • MongoDB Atlas: our database.
  • Paddle: payments, as merchant of record.
  • Our email provider: account emails and reminders.

Where your data is stored: these providers' servers are outside Bangladesh (for example in India, Singapore, the EU or the United States). We use established providers with strong security and contractual safeguards, and send them only what's needed. By creating an account you agree to your data being processed there.

How long we keep it

  • Your account, resumes, Career Profile and applications: until you delete them. Deleting removes them from our database straight away.
  • Unfinished sign-ups: 30 minutes. Until you enter the code we email you, only your name, email and a hashed password are held, and no account exists.
  • Feedback: two years, or until you delete your account.
  • Error reports: 90 days after the error last happened.
  • AI usage records: 180 days. PDF download records: 12 months. Upgrade steps: about 13 months.
  • Limit counters: from an hour to a few days. Server logs at our hosting providers: about 30 days.
  • Payment records: as long as accounting and tax law requires, without the link to your account once it's deleted.
  • Backups: we keep about a month of weekly backups, so deleted data is gone from them within about five weeks.

Your rights and choices

  • Access and portability: download all your data from Account settings.
  • Correction: edit your resumes, Career Profile and name at any time.
  • Deletion: delete individual resumes, or your whole account (with your Career Profile) from Account settings.
  • Withdrawing consent: stop using a feature, turn emails off in Account settings or with the link in any email, or delete your account.
  • Under Bangladesh's Personal Data Protection Act, the GDPR in the EU/UK and similar laws, you may have further rights, such as asking what we hold about you or objecting to how it's used.

To use any of these rights, email us at support@resumex.cc from the address on your account. We'll reply within 30 days. If you're not happy with our answer, you can complain to the data protection authority where you live.

Security

Passwords are hashed with bcrypt, connections are encrypted in transit, every part of the service is rate-limited, and changing your password signs out every other device. You can turn on two-factor authentication with an authenticator app; admin accounts must use it, and admin actions are recorded in an audit log. Two-factor secrets are encrypted at rest. No system is perfectly secure, so please use a strong, unique password. If a breach is likely to put you at risk, we'll tell you and the authorities as the law requires.

Children

You must be 18 or older to create an account, and we don't knowingly collect data from anyone younger. If you think someone under 18 has an account, email us at support@resumex.cc and we'll delete it. Anyone can use the builder without an account; then the resume stays in your own browser.

Changes and contact

We'll update this page when our practices change and note the date at the top. For privacy questions or requests, email us at support@resumex.cc.