Security & Compliance

What we handle

Resume content you submit (name, contact info, experience, education, skills), plus target-role context used to tailor wording. We do not train public models on your submissions without explicit consent, and do NOT ask for government IDs, passwords, or payment credentials inside the builder.

Data handling commitments

• Input is used only to generate your resume output (GDPR Art.5 — data minimization).
• We minimize retained data and avoid storing secrets longer than needed.
• Transfers use standard encryption in transit (TLS) (GDPR Art.32 — security of processing).
• You control export and deletion of your documents.

Compliance posture

GDPR: we act on your instruction as the data subject / controller for your own submitted personal data (Art.6). We support data deletion on request (right to erasure, Art.17) and follow secure-default configuration and input validation (OWASP Top 10).

Subprocessors

We rely on our hosting provider (Vercel) and payment processor (Waffo). No resume data is sold to third parties.