Privacy Policy

This Privacy Policy applies to ResWiz, including https://reswiz.ai, the authenticated web application, related emails, and support interactions (together, the “Service”). It does not govern an employer, job board, calendar provider, payment provider, or other third party operating under its own privacy policy.

ResWiz is responsible for the personal information described in this Policy. Questions and privacy requests may be sent to support@theresumewizard.ai.

Information you provide

• Account and invitation information: name, email address, authentication information, invitation details, profile image, and account preferences.
• Career profile information: contact details, location, work history, education, credentials, skills, achievements, professional summaries, writing samples, and similar information used in application materials.
• Job-search information: job descriptions and URLs, companies, roles, application status, contacts, interview information, reminders, notes, communications, and decisions you record in the Service.
• Files and generated materials: uploaded resumes and their extracted text or images, generated resumes, cover letters, outreach messages, application packets, and files you choose to store.
• AI interactions: prompts, chat messages, source material, feedback, and the content produced in response.
• Communications: support messages, beta-access requests, invitation messages, survey responses, and email preferences.

Information from connected services

• Google sign-in: basic profile information authorized through Google, such as your email address and name.
• Connected calendars: when you deliberately connect Google Calendar or Microsoft Outlook, we receive the connected account identifier and email address, authorization tokens, and calendar-event details such as title, description, time, location, meeting link, organizer, and attendee names and email addresses. Calendar access is read-only unless the Service clearly asks you to authorize a different action.
• Job and company sources: when you submit a job-posting URL, we may retrieve the page, structured job data, and publicly available company information needed to create the application record you requested.

Billing and transaction information

Stripe processes checkout and payment-card details. We receive related customer, subscription, plan, payment status, promotion, tax, and transaction identifiers, but we do not store your full payment-card number.

Technical and usage information

We and our infrastructure providers receive information such as IP address, request identifiers, device and browser type, operating system, timestamps, referring pages, requested URLs, error and security events, and general use of the Service. If you consent to analytics, PostHog and any enabled Google Analytics or Google Tag Manager configuration may also collect page views, interactions, approximate location derived from IP address, and pseudonymous device or browser identifiers. See our Cookie Policy.

We use personal information to:

• create and secure accounts, verify invitations, and authenticate users;
• maintain career profiles, application records, files, calendar connections, and preferences;
• generate, analyze, revise, render, and deliver resumes, cover letters, outreach, interview materials, and other content requested by the user;
• import and verify job postings, research relevant public company information, and prevent duplicate or unsafe imports;
• provide chat, search, memory, recommendations, and workflow features;
• process purchases, administer plans and usage limits, and prevent fraud;
• send transactional messages, requested invitations, service announcements, reminders, and—where permitted—product or onboarding messages;
• answer support and privacy requests;
• monitor availability, diagnose errors, enforce our Terms, protect users, and investigate abuse or security incidents;
• measure and improve the Service using optional analytics when consent is required; and
• comply with law and establish, exercise, or defend legal claims.

Many features use artificial intelligence. When you ask for a generation, analysis, rewrite, chat response, embedding, or similar feature, we may send the information needed for that request to OpenAI. This may include career history, job descriptions, writing samples, instructions, prior conversation context, and other content you selected or that is reasonably necessary to fulfill the request.

We store AI outputs with the related account records where needed to provide the feature. We also keep operational metadata such as model, token counts, cost, timing, and error status. Prompt and response content is excluded from diagnostic AI logs by default. If content logging is temporarily enabled for controlled troubleshooting or quality work, the content is access-restricted, length-limited, and cleared under the diagnostic retention period described below.

AI output can be incomplete, inaccurate, biased, or unsuitable. It must be reviewed by the user before submission to any employer or other person. See the AI and employment disclaimer in our Terms of Service.

Where the European Economic Area, United Kingdom, or another jurisdiction requires a legal basis, we rely on the following, as appropriate:

• Contract: to create your account, provide requested features, process subscriptions, and support the Service.
• Legitimate interests: to secure, maintain, troubleshoot, and improve the Service; prevent abuse; communicate about the Service; and manage our business, where those interests are not overridden by your rights.
• Consent: for non-essential analytics, connected services, and other processing where we specifically ask for consent. You may withdraw consent at any time, without affecting earlier lawful processing.
• Legal obligation: to keep required records, respond to lawful requests, and comply with tax, accounting, consumer-protection, and other laws.

We may disclose information in these circumstances:

• Service providers: vendors that help operate the Service, including OpenAI for AI processing; Stripe for billing; Amazon Web Services for file storage; Heroku and other hosting, database, cache, and infrastructure providers; Resend for email delivery; PostHog and Google for consented analytics; Google for sign-in and calendar access; Microsoft for calendar access; and Scout APM when application monitoring is enabled. They receive information only for the services they provide to us, subject to applicable contractual restrictions.
• At your direction: when you connect a service, download or share a document, follow a third-party link, or otherwise direct a disclosure.
• Legal and safety reasons: when reasonably necessary to comply with law or legal process; protect rights, safety, or property; investigate fraud, abuse, or security incidents; or enforce agreements.
• Business transfers: in connection with due diligence, financing, reorganization, merger, acquisition, or sale of assets. The recipient would be required to handle personal information consistently with applicable law and the commitments made in this Policy.
• Aggregated or de-identified information: where information can no longer reasonably identify an individual. We do not attempt to re-identify information maintained as de-identified.

We do not sell personal information for money. We do not use personal information for cross-context behavioral advertising. Optional analytics providers receive information only after the consent choice described in our Cookie Policy.

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy. The period depends on the type of information, whether your account remains active, your choices, operational requirements, and legal obligations.

• Account, career, application, chat, and generated content is generally retained while your account is active or until you delete the relevant record or request account deletion.
• Uploaded or generated files may remain in restricted backups for a limited period after deletion before backup rotation completes.
• Calendar tokens and synchronized event copies are retained while the connection remains active and are deleted or invalidated when you disconnect it, subject to limited security logs and backup rotation.
• Diagnostic AI prompt and response content, when content logging is enabled, is cleared after 30 days. Non-content AI usage metadata may be retained longer for security, cost accounting, and service operations.
• Billing, transaction, consent, and contract-acceptance records may be retained for the period needed to meet tax, accounting, fraud-prevention, dispute, and compliance obligations.
• Security and request logs are retained according to risk, troubleshooting, and infrastructure needs, then deleted or de-identified when no longer needed.

We may retain information longer when required by law, subject to a legal hold, or necessary to establish, exercise, or defend legal claims. When deletion is not immediately possible, we restrict the information from ordinary use until it can be removed.

We use administrative, technical, and organizational safeguards designed to protect personal information. These include access controls, encrypted transport, restricted administrative access, encrypted calendar authorization tokens, security headers, rate limits, vendor controls, and monitoring appropriate to the Service. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Protect your password and devices, do not share account credentials, and contact support@theresumewizard.ai promptly if you suspect unauthorized access.

We and our providers may process information in the United States and other countries that may have different data-protection laws. Where required, we use recognized transfer safeguards, such as adequacy decisions or standard contractual clauses, and apply supplementary measures appropriate to the transfer.

Account and content choices

• You may edit or delete many profile and application records in the Service.
• You may disconnect a calendar from account settings. You may also revoke access through the calendar provider.
• You may unsubscribe from optional onboarding or product email using the link in the message. Essential account, billing, security, and requested-service messages may still be sent.
• You may change optional analytics at any time through “Cookie preferences” in the site footer.

Privacy requests

Depending on where you live, you may have rights to know or access personal information, correct it, obtain a portable copy, delete it, restrict or object to processing, withdraw consent, opt out of certain disclosures or profiling, or appeal a denied request. You may also have the right to complain to your local data protection authority.

Submit a request to support@theresumewizard.ai. Describe the request and the email address tied to your account. We may ask for information reasonably necessary to verify identity and authority. We will respond within the period required by applicable law. You may use an authorized agent where the law permits; we may request proof of the agent’s authority and direct identity verification. We will not discriminate against you for exercising a privacy right.

Some rights are subject to exceptions. For example, we may retain records needed to complete transactions, protect security, meet legal obligations, or exercise legal claims. If we deny a request, we will explain the reason and any available appeal process when required.

This section provides additional information for residents of U.S. states with comprehensive privacy laws, where those laws apply to us. The table covers information collected during the preceding 12 months and the information we expect to continue collecting.

We collect these categories from you, connected services, submitted URLs and public sources, and service providers, as described above. We do not sell these categories for money or share them for cross-context behavioral advertising. We do not knowingly sell or share personal information of people under 18.

The Service is intended for people who are at least 18 years old and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child provided information to the Service, contact support@theresumewizard.ai so we can investigate and take appropriate action.

We may update this Policy to reflect changes in the Service, our practices, or law. We will post the updated version with a new effective date. If a change materially affects how we use information already collected, we will provide additional notice or request consent when required.

For questions, complaints, or privacy requests, email support@theresumewizard.ai. Please do not send passwords, full payment-card numbers, government identification numbers, or other unnecessary sensitive information by email.