Privacy Policy

1. Scope

This Privacy Policy explains what personal data we collect when you use our resume builder, job-application tracker, job agent and website (together, the "Service"), why we collect it, how long we keep it, and the rights you have over it.

It is written to describe what our systems actually do. For where data is stored, how long it is kept and how to have it deleted or exported, see our Data Policy, which forms part of this policy.

2. Data We Collect

Account data

Your name, email address, phone number (when you sign in with WhatsApp), username, profile picture (if you add one) and the sign-in methods you use. You sign in with a one-time code sent to your email address or WhatsApp number; we do not ask you to create a password.

Payment and plan data

The plan you bought, its billing period and status, payment and invoice references, the amount charged and any tax, and your AI credit balance and usage history. Card, UPI and bank details are entered directly with our payment provider and are never stored on our systems.

Content you create

Resume and cover-letter content - which typically includes your name, contact details, work history, education, skills, links and any photo you choose to upload - plus the styling and template choices that go with it, and previous versions we store so you can roll back.

Job-application records you add to the tracker, including the company, role, notes, any job description or document you attach, and any details you enter about other people (for example a recruiter's name, email or phone number). Please only add other people's details where you have a lawful reason to do so.

Job-agent conversations, prompt attachments you upload, and the job-search preferences you give the agent (including location, work mode and salary expectations).

Technical and usage data

Resume view and download counts, the last time a resume was viewed or downloaded, session records (including IP address and browser user-agent), and short-lived technical identifiers used to rate-limit abuse and stop repeated views.

We also record product and marketing events - for example that a page or section was viewed, a plan was chosen, or a sign-up or purchase completed - against a visitor identifier, together with campaign click identifiers such as gclid or fbclid when you arrive from an ad. These events never include the content of your resume.

Advertising measurement

When you create an account, start a checkout or complete a purchase, we may send Google and Meta a one-way SHA-256 hash of your email address and phone number, together with the event identifier and the campaign click identifier (gclid, wbraid, gbraid, fbclid or the Meta browser identifiers) from the ad you arrived on. Hashing is one-way: the provider can check whether a match exists but cannot read your email address or number back.

We do this so a purchase can be credited to the ad that produced it even when the purchase happens later - for example from a WhatsApp link, where the click identifier captured on your first visit is carried with the link. The hash is used only for that matching. Your resume, your messages and the plain text of your email address or phone number are never sent this way.

If you start building a resume and leave before paying, or create an account without buying a plan, we may create a recovery link. That record holds your email address or phone number, the resume or plan you were looking at, how often the link was opened, and which messages we sent. Recovery links expire after 30 days.

If you use AI features, the parts of your content needed for that request are sent to the AI model provider we use - see section 5.

3. Why We Use It

• To provide the Service - creating your account, building and exporting resumes, tracking applications, running the job agent.
• To keep your account secure - authentication, session management, sign-in verification, fraud and abuse prevention.
• To run AI features you ask for - generating and reviewing resume content using the AI model providers we operate, measured in the AI credits your plan includes.
• To operate and improve the Service - aggregate usage counts, error diagnosis, rate limiting, capacity planning.
• To contact you - service messages such as sign-in codes, receipts, failed-payment notices, and account or security notices. We also offer follow-up messages about a resume you started on WhatsApp and by email: the checkout box for these is pre-selected and can be unticked there or switched off later in your settings, and every message includes a way to stop.
• To meet legal obligations - for example retaining billing records where tax law requires it.

4. What We Do Not Do

• We do not sell your personal data.
• We do not use your resume content to train AI models, and we do not permit our AI providers to train on it.
• We do not put the content of your resume into analytics or advertising tools. We do use Google Tag Manager, Google Analytics, Google Ads and Meta to measure visits and conversions (see sections 6 and 7), and those tools may receive event data, device identifiers and hashed contact details - never the text of your resume.

5. AI Processing

AI features are built into the Service and run on provider accounts that we hold - you do not need to connect your own AI account or supply an API key. Each request sends only the parts of your content needed for it (for example the text you ask us to rewrite, or the resume and job description for a match) to the model provider we route that feature to.

AI usage is measured in credits that each plan includes. Each plan grants a fixed number of credits for its billing period; credits do not carry over and expire when the period ends. You can see your balance and a history of what was used in your account settings.

We do not use your content to train models, and we do not permit our AI providers to train on it. If we change the providers behind these features, we will name them in this policy before they process your content.

6. Sharing

We share personal data only with the providers below, and only for the purposes described:

We may also disclose data where we are legally required to, or where it is necessary to protect the rights and safety of our users or the public. If we ever share data with a buyer as part of a merger or acquisition, we will tell you before your data becomes subject to a different privacy policy.

7. Cookies

We use a session cookie that keeps you signed in. We also load Google Tag Manager, which may set analytics and advertising cookies or identifiers for the platforms named in section 6, and Meta may set its own identifiers when you arrive from one of its ads. These are used to measure visits and purchases, not to read your resume.

You can clear or block cookies in your browser. Without the session cookie you will not be able to stay signed in; blocking the analytics and advertising cookies does not affect the Service, only our measurement of it.

8. How Long We Keep It

We keep your data while your account is active. When you delete your account we delete your account, resumes, applications, job-agent data and uploads, subject to the exceptions set out in our Data Policy (for example billing records that tax law requires us to retain).

9. Your Rights

You can:

• Access and export your data - export is available from your account settings.
• Correct your data - most of it you can edit directly in the builder or your profile.
• Delete your account and the content in it, from your account settings.
• Object to or restrict processing, and withdraw any consent you have given, at any time.
• Complain to us first, and to your data-protection authority (in India, the Data Protection Board; in the EU/EEA, your national supervisory authority).

To exercise any of these, contact us using the details on our Contact page. We respond to verified requests within the timelines required by applicable law (30 days under the EU/UK GDPR, and without undue delay under India's Digital Personal Data Protection Act, 2023).

10. Security

We use encryption in transit, access controls on our production systems, hashed credentials and API keys, and AES-256-GCM encryption for stored provider credentials and messaging-channel secrets. No system is perfectly secure, so please keep your account access safe.

If a breach affects your personal data, we will notify you and the relevant authority as required by law.

11. Children

The Service is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

12. Changes

We will update this policy when our practices change, and we will tell you about material changes by email or in the Service before they take effect. The "last updated" date above always shows the current version.

13. Contact

Privacy questions and data-subject requests: hello@oxyresume.com. Please see our Contact page for how to reach us.