Effective date: April 6, 2026
When you use Resumind we collect and store:
Providing your name, email address, and CV content is required to use the service. The profile photo is optional — you can use Resumind without uploading one.
We process your personal data under the following legal bases (GDPR Art. 6):
| Processing activity | Legal basis |
|---|---|
| Account creation and authentication | Art. 6(1)(b) — performance of a contract |
| Storing and managing your CVs, applications, and cover letters | Art. 6(1)(b) — performance of a contract |
| Billing and payment processing via Stripe | Art. 6(1)(b) — performance of a contract |
| AI-assisted CV suggestions (Anthropic Claude) | Art. 6(1)(a) — your consent, given by affirmatively choosing to use an AI feature |
| Optional profile photo | Art. 6(1)(a) — your consent, given when you upload the photo |
| Security logging and fraud prevention | Art. 6(1)(f) — our legitimate interest in operating a secure service |
| ATS scoring (automated CV profiling) | Art. 6(1)(b) — performance of a contract; see Section 10 |
We do not sell your data to third parties.
To deliver the service we share personal data with the following processors, each contracted under a GDPR Art. 28 Data Processing Agreement.
AI features are powered by Anthropic PBC (United States). When you choose to use an AI feature, the relevant CV content — which may include personal data — is transmitted to Anthropic’s API. Anthropic states that API-submitted data is not used to train their models. Transfers to the US are covered by Standard Contractual Clauses (Art. 46(2)(c) GDPR). We have conducted a Transfer Impact Assessment and confirmed that supplementary measures (API data minimisation and contractual non-training commitment) are in place.
Payment processing is handled by Stripe Inc. (United States) and Stripe Payments Europe Ltd (Ireland). When you subscribe to a paid plan, Stripe processes your billing name, email address, and payment card details. We do not store card numbers on our servers. Stripe is PCI DSS Level 1 certified. US transfers are covered by Standard Contractual Clauses and Stripe’s Binding Corporate Rules. See Stripe’s Privacy Policy at stripe.com/privacy.
Your data is stored in PostgreSQL databases and S3-compatible file storage hosted by [Infrastructure Provider — to be named before publishing], located in [country/region]. Transfers outside the EU/EEA, if any, are covered by Standard Contractual Clauses and a Transfer Impact Assessment. Passwords are hashed with bcrypt. Data in transit is encrypted via HTTPS (TLS 1.2+). Storage-at-rest encryption is provided at the infrastructure level.
Your authentication token (JWT) is stored in your browser’s localStorage and expires after a period of inactivity. We protect against cross-site scripting (XSS) attacks through a strict Content Security Policy. You should log out when using shared or public devices. Your AI preferences (tone and writing style) are also stored in localStorage on your device and are not transmitted to our servers independently.
We keep personal data only for as long as necessary:
| Data type | Retention period |
|---|---|
| Account data, CVs, applications, cover letters | Duration of your account. If inactive for 24 consecutive months we will email you and delete the account and all associated data 30 days later, unless you log in again. |
| Profile photo | Until you remove it or delete your account |
| Server access logs | 90 days |
| Backup copies | Up to 30 days after account deletion, then purged in the normal backup rotation cycle |
| Payment records | 10 years, as required by applicable fiscal law |
If you delete your account manually, your CVs, applications, cover letters, and profile data are permanently removed immediately. Backup copies are purged on the schedule above.
If you are in the EU or EEA you have the following rights:
To exercise any right, contact us at privacy@resumind.app.
We will respond within 30 days (extendable by a further two months for complex requests, with notice to you).
Right to lodge a complaint
You have the right to lodge a complaint with your national data protection supervisory authority at any time. In Italy:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma
www.garanteprivacy.it · garante@gpdp.itResumind is not required to appoint a Data Protection Officer under GDPR Art. 37, as it does not carry out large-scale systematic processing of special categories of data or systematic monitoring of individuals. For all privacy matters contact us directly at privacy@resumind.app.
We do not use third-party analytics or advertising cookies. The only browser storage we use is:
No cookie consent banner is required as we do not use non-essential cookies.
We collect only the data necessary to provide the service (Art. 5(1)(c) GDPR). When sending data to Anthropic for AI processing, we transmit only the specific CV sections relevant to your request — not your entire account. Security measures include: bcrypt password hashing, HTTPS/TLS encryption in transit, infrastructure-level encryption at rest, access controls limiting staff access to personal data, and Content Security Policy headers.
Resumind automatically analyses your CV to generate an ATS (Applicant Tracking System) quality score. This involves automated profiling of your CV’s structure, keywords, and formatting against common ATS criteria.
What this means for you: The score is a guidance tool visible only to you. It is not shared with employers or third parties and does not produce legal or similarly significant effects within the meaning of Art. 22(1) GDPR. Accordingly, Art. 22 mandatory safeguards do not apply, but we disclose this processing in the interest of full transparency.
Logic used: The score is calculated by heuristic rules that check for completeness of sections, keyword density, formatting conventions, and CV length. No external data about you is used.
Contact us at privacy@resumind.app if you have questions about how your score is calculated or wish to object to this processing.
We will notify you by email if we make material changes to this policy. The date of the last update is shown at the top of this page.
For privacy questions, to exercise your rights, or to withdraw consent: privacy@resumind.app