1. Who we are
ResumeForge (“we”, “us”, “our”) is a software-as-a-service platform that helps job seekers create AI-powered CVs, cover letters, and job application materials. We are the data controller for personal data processed through resumeforge.app.
Privacy contact: privacy@resumeforge.app
2. Data we collect
- Account data: email address, name, password hash (or OAuth token reference)
- Profile & CV data: work history, education, skills, and any information you enter to generate documents
- Billing data: subscription status, plan type; payment card details are processed exclusively by Stripe and never stored on our servers
- Usage data: pages visited, features used, document generation logs (for quota enforcement)
- Analytics data: IP address (hashed), browser type, device type — only when you consent to performance cookies
- Consent log: timestamp, your cookie preferences, and the GPC signal state — stored in anonymised form for compliance audit
- Support communications: messages you send to our support team
3. Legal bases & retention periods
We process personal data only where we have a valid legal basis under GDPR Art. 6, UK GDPR, FADP Art. 19, and LGPD Art. 7. The table below lists each processing activity, its legal basis, and how long we retain the data.
| Processing activity | Legal basis (GDPR Art. 6) | Retention period |
|---|---|---|
| Account creation & management | Performance of contract (Art. 6(1)(b)) | While account active + 30 days after deletion |
| Login via Google OAuth | Performance of contract (Art. 6(1)(b)) | Duration of active session |
| CV & cover letter generation | Performance of contract (Art. 6(1)(b)) | While account active |
| Job compatibility scoring | Performance of contract (Art. 6(1)(b)) | 90 days after generation |
| Support communications | Legitimate interest — quality & safety (Art. 6(1)(f)) | 2 years after resolution |
| Google Analytics (GA4) | Consent (Art. 6(1)(a)) | 14 months (configured in GA4) |
| Hotjar session recordings | Consent (Art. 6(1)(a)) | 365 days |
| Billing records & invoices | Legal obligation — tax law (Art. 6(1)(c)) | 10 years |
| Document generation logs | Legitimate interest — quota enforcement (Art. 6(1)(f)) | 24 months |
| Consent audit log | Legal obligation — GDPR Art. 7 accountability (Art. 6(1)(c)) | 3 years |
4. Sub-processors & international transfers
To provide our services, we share personal data with the following sub-processors. Where data is transferred outside the EU/EEA/UK/Switzerland, we rely on Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework (DPF) as the transfer mechanism.
| Sub-processor | Country | Purpose | Transfer safeguard |
|---|---|---|---|
| Neon Inc. (AWS us-east-1) |  USA | PostgreSQL database hosting | SCCs + EU–US DPF |
| Vercel Inc. | USA | Hosting, Edge Functions, CDN | SCCs — DPA available |
| Google LLC | USA | OAuth login, Analytics (GA4), AI generation (Gemini — EU/UK/CH/BR users) | SCCs + EU–US DPF — DPA accepted in GCP Console |
| Stripe Inc. | USA | Payment processing & subscription management | SCCs + EU–US DPF — DPA included in Stripe ToS |
| Hotjar Ltd. |  MaltaUSA | Heatmaps & session recordings (performance cookies only) | SCCs — DPA available |
| DeepSeek (Hangzhou DeepSeek AI) |  China | AI content generation (users outside EU/UK/CH/BR) | ⚠️ SCCs under review — EU/UK/CH/BR users are routed to Google Gemini |
List last updated: June 2026. To request the full list of sub-processors or DPA copies: privacy@quickmoca.com
5. AI & automated decisions
How we use AI
ResumeForge uses large language models (LLMs) to power two core features:
- CV & cover letter generation — your professional data is sent to the AI model to produce personalised documents. The AI output is always presented to you for review before saving.
- Job compatibility scoring — we generate an automated score (0–100) that reflects how closely your profile matches a job description. This score may influence which jobs are shown to you or recommended.
Your rights regarding automated decisions
Under GDPR Art. 22, UK GDPR Art. 22, and LGPD Art. 20, you have the right to:
- Not be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects on you
- Request human review of any compatibility score generated for your profile
- Receive an explanation of the main criteria used in the scoring
- Contest a result you consider unfair or inaccurate
To exercise these rights, contact us at privacy@resumeforge.app. Response time: 30 days (GDPR/UK GDPR/LGPD) or 45 days (CCPA).
AI sub-processors
Data sent for AI processing is handled by the following providers, selected based on your geographic location:
- Google Gemini API — users in the EU, UK, Switzerland, and Brazil (DPA accepted with Google)
- DeepSeek API — users in all other countries (SCCs under review)
6. Your rights
Depending on your location, you may have the following rights regarding your personal data:
| Right | GDPR / UK GDPR | CCPA/CPRA | LGPD |
|---|---|---|---|
| Access / Know | ✓ | ✓ | ✓ |
| Rectification / Correction | ✓ | ✓ | ✓ |
| Erasure / Deletion | ✓ (Art. 17) | ✓ | ✓ (Art. 18) |
| Data portability | ✓ (Art. 20) | ✓ | ✓ (Art. 18) |
| Restrict processing | ✓ (Art. 18) | — | ✓ |
| Object to processing | ✓ (Art. 21) | — | ✓ |
| Contest automated decision | ✓ (Art. 22) | — | ✓ (Art. 20) |
| Opt out of sale / sharing | N/A | ✓ (§1798.120) | N/A |
To exercise any right, email privacy@resumeforge.app with your request. We will respond within 30 days (GDPR) or 45 days (CCPA).
7. Do Not Sell or Share My Personal Information
Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have the right to opt out of the “sale” or “sharing” of their personal information for cross-context behavioural advertising.
ResumeForge does not sell personal information to third parties for monetary consideration. We may share certain analytics data (e.g., via Google Analytics) for performance measurement purposes — which may qualify as “sharing” under CPRA.
To opt out: you can use the cookie preference panel (accessible via the “Cookie Settings” link in the footer) to disable Performance and Marketing cookies. We also honour the Global Privacy Control (GPC) browser signal — if your browser sends Sec-GPC: 1, we automatically apply opt-out preferences without requiring any action from you.
For further requests or to confirm your opt-out status: privacy@resumeforge.app
9. UK GDPR — Users in the United Kingdom
ResumeForge complies with the UK General Data Protection Regulation (UK GDPR), as retained in UK law by the Data Protection Act 2018, supervised by the Information Commissioner's Office (ICO).
Your rights under UK GDPR
- Right of access to your personal data (Art. 15)
- Right to rectification of inaccurate data (Art. 16)
- Right to erasure (“right to be forgotten”) (Art. 17)
- Right to data portability (Art. 20)
- Right to object to processing (Art. 21)
- Right not to be subject to solely automated decisions with significant effects (Art. 22)
To exercise any of these rights, contact us at privacy@resumeforge.app. We will respond within 30 days.
How to complain to the ICO
If you are not satisfied with our response, or if you believe we are processing your personal data in a way that does not comply with the UK GDPR, you have the right to lodge a complaint with the ICO:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Note regarding UK representative (UK GDPR Art. 27): ResumeForge is currently assessing whether the volume of data processing involving UK residents requires the appointment of a UK representative under Art. 27. This section will be updated when that assessment is complete.
10. Contact & Data Protection
To exercise your rights, submit a data subject request, report a privacy concern, or ask any question about this policy:
Email: privacy@resumeforge.app
Response time: up to 30 days (GDPR / UK GDPR / LGPD) or 45 days (CCPA)
UK users: if you do not receive a response within 30 days, you may lodge a complaint with the ICO at ico.org.uk/make-a-complaint.
EU users: you may contact the data protection authority (DPA) of your EU member state. A full list is available at edpb.europa.eu.
Swiss users: you may contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.
Brazilian users: you may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.