Privacy Policy

Last updated: February 5, 2026

This Privacy Policy explains how Resume Forge ("we", "us", or "our") collects, uses, discloses, and protects your personal information when you use our service. By using Resume Forge, you agree to the practices described in this policy.

1. Information We Collect

Account Information

When you sign in with Google OAuth, we receive your name, email address, and profile picture. We do not store your Google password.

Resume Content

Information you provide when building resumes, including your education, work experience, skills, certifications, and projects.

Job Application Data

Job descriptions you submit for parsing, along with extracted structured data such as job titles, requirements, and company information.

Payment Information

We store your Stripe customer ID and subscription tier. Credit card details are handled entirely by Stripe and are never stored on our servers.

Authentication Data

Device identifiers, hashed refresh tokens, and token expiry times used to keep your sessions secure.

Usage Metrics

Aggregate usage data such as the number of resumes created and job descriptions parsed, used to enforce plan limits.

2. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases to process your personal data:

• Contract performance — Processing necessary to provide the Resume Forge service you signed up for, including resume creation, job description analysis, and PDF generation.
• Consent — When you sign in via Google OAuth, you consent to the transfer of your basic profile information to us.
• Legitimate interests — Improving our service, enforcing usage limits, preventing fraud, and ensuring security. We balance these interests against your rights and freedoms.
• Legal obligation — Complying with applicable laws, such as tax and financial reporting requirements related to payment processing.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Resume Forge service
• Analyze job descriptions using AI to extract structured data
• Generate PDF resumes from your content
• Process payments and manage subscription tiers
• Enforce usage limits based on your plan
• Improve our service and user experience
• Send service-related communications

4. Third-Party Services

We share data with the following third-party services:

• Google OAuth 2.0 — Used for secure sign-in. We receive your basic profile information from Google.
• Stripe — Handles payment processing. Card details are managed entirely by Stripe and never touch our servers.
• Google Gemini AI — Powers job description analysis. Submitted text is sent to Google’s API for processing.
• Gotenberg — A self-hosted service used to convert your resume content into PDF format. Your data does not leave our infrastructure.

5. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our third-party service providers (Google, Stripe) operate. When such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on the service provider’s certification under an applicable data transfer framework.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• No passwords are stored — authentication is handled entirely through Google OAuth
• Refresh tokens are hashed before storage
• JWT access tokens expire after 1 hour; refresh tokens expire after 24 hours
• All communication is encrypted over HTTPS
• Data is stored in a secured PostgreSQL database

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. Authentication tokens automatically expire and are cleaned up regularly. You may request deletion of your account and all associated data at any time by contacting us.

8. Your Rights

Under the GDPR and other applicable data protection laws, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request corrections to inaccurate or incomplete personal data.
• Right to erasure — Request deletion of your personal data ("right to be forgotten").
• Right to data portability — Request a machine-readable copy of the data you provided to us.
• Right to restrict processing — Request that we limit how we use your data in certain circumstances.
• Right to object — Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — You have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.

To exercise any of these rights, please contact us using the details below. We will respond to your request within 30 days.

9. Children's Privacy

Resume Forge is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the service after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or want to lodge a complaint, please contact us at [email protected].