Your data, explained honestly.

Resume Sketch ("Resume Sketch", "we", "us") is an AI resume builder. This Privacy Policy explains what personal data we collect when you use resumesketch.com, the Resume Sketch app, public share links, our AI-assistant integrations (ChatGPT, Claude) and any other place that links to this page (together, the "Service"), and what we do with it.

For the data you put into your account, Resume Sketch is the data controller (in India, the "data fiduciary"). When you create an account you confirm that you have read this policy. Using the Service is also governed by our Terms & Conditions.

Things you give us

• Account details: name, email address and password (stored only as a secure hash by our authentication provider; we never see it). If you sign in with GitHub or LinkedIn, we receive your name, email and profile picture from that service.
• Profile and resume content: everything you enter or import: contact details, work history, education, projects, skills, certifications, custom sections, target roles, cover letters and job descriptions you paste in.
• Files: resumes you upload to import or analyse (PDF, DOCX, text) and the profile photo you add to photo templates.
• AI conversations: the messages you send to the AI assistant and agent mode, and the content those features generate for you.
• Consents: which version of these terms you accepted, when, and whether you turned recruiter sharing on or off (with a dated history of every change).
• Feedback and support: what you send through the feedback button or by email.

Things you connect

• Gmail (optional): an encrypted access token that lets us send the cold emails you approve, plus a short log of sent emails (recipient, subject, time). See Gmail below.
• ChatGPT, Claude and other AI apps (optional): the connection tokens that let an assistant you authorised read and edit your resumes.
• Your own AI API keys (optional): stored in your browser only and sent with each AI request you make. We don't save them on our servers.

Things we record automatically

• Usage and billing: your plan, plan dates, AI credits used and remaining, bonus credits, referral links and who joined through them.
• Share links: links you create, whether they're active, and view counts. To count a view only once, we keep the viewer's IP address for 30 minutes.
• Technical and security data: IP address, browser and device type, pages requested, timestamps and error logs. We use these for rate limiting, fraud and abuse detection, debugging and security.
• Analytics: pages visited and general interaction data through Google Analytics, used in aggregate to understand which features are used. See our Cookie Policy.
• Notifications: if you enable push notifications, your browser's push subscription.

We do not knowingly collect sensitive data such as health, religion, caste, biometrics or financial account numbers. Please don't put them on your resume unless you really need to.

• Provide the Service: store your resumes, render templates, export PDFs, run share links and sync your account across devices.
• Run AI features you ask for: writing, rewriting, tailoring to a job, scoring, analysis, cover letters and cold emails.
• Protect the Service and its users: rate limiting, detecting fake or duplicate accounts, stopping credit and referral abuse, and investigating misuse of AI (see who can see your data).
• Billing and credits: track plan periods, AI credit usage, bonus credits and referral rewards.
• Communicate with you: account emails (confirmation, password reset, security notices), changes to these terms and replies to support requests. Product news only if you opted in, with an unsubscribe link in every email.
• Improve Resume Sketch: aggregated, de-identified usage statistics to decide what to build and fix.
• Recruiter sharing: only if you turned it on, and only your starred resume (see recruiter sharing).
• Legal duties: to comply with law, respond to lawful requests and enforce our Terms.

Legal bases (where laws like the GDPR apply): performing our contract with you; your consent (recruiter sharing, optional connections, analytics where required); our legitimate interests in security, abuse prevention and improving the Service; and legal obligations. Under India's Digital Personal Data Protection Act, 2023 we process your data on the basis of your consent and for the legitimate uses the Act allows.

When you use an AI feature, we send the relevant part of your resume, profile, job description or chat message to an AI model provider, which returns the result to you. Depending on the model you pick, this is one of:

• Built into Resume Sketch: Microsoft Azure AI Foundry and Sarvam AI.
• With your own API key: OpenAI, Anthropic, xAI, DeepSeek or Groq. Your use of those keys is also governed by that provider's terms.

• We send only what the feature needs, over encrypted connections, through the providers' business APIs.
• We do not use your resumes or chats to train our own AI models, and we don't sell them to anyone for training.
• AI providers process this data under their API terms and data processing commitments. They may keep it for a limited time for abuse monitoring.
• We keep records of AI usage (feature, time, credits charged) and, for security, may review the prompts sent from an account when investigating misuse.

We want to be upfront: Resume Sketch is not end-to-end encrypted. Your data is encrypted in transit and at rest, but authorised Resume Sketch administrators can read your account data through our internal admin tools. This includes your account details, profile, every resume and cover letter, plan and credit usage, share links, connected services and feedback.

When we look

• You ask for help (support, a bug report, a billing question) and we need to see the problem.
• To investigate suspected misuse: abuse of AI or credits, fake or duplicate accounts, referral fraud, spam, illegal or harmful content, or security incidents.
• To fix a technical problem affecting your account or data.
• To meet a legal obligation or respond to a valid legal request.
• To check your starred resume before sharing it with a recruiter, if you turned recruiter sharing on.

What administrators can do

• Reset your password, change or confirm your email, or send you a sign-in link.
• Change, renew or cancel your plan, and adjust credits.
• Make an account read-only (frozen), suspend (ban) it, or delete it.
• Delete resumes, turn off share links, disconnect Gmail and revoke connected AI apps.

The safeguards

• Access is limited to a short list of named administrator accounts.
• Every administrative action is written to an audit log (who, what, when).
• Administrators are bound by confidentiality and use access only for the purposes above, never for marketing or curiosity.

Service providers (processors)

They process data on our behalf, under contract, only to provide their service:

• Supabase: database, authentication and file storage.
• Cloudflare: hosting, content delivery and protection against attacks.
• Upstash: short-lived caching and rate-limit counters.
• AI providers: Microsoft Azure AI Foundry, Sarvam AI, or the provider of your own API key (see AI).
• Google: Gmail sending (only if you connect it) and Google Analytics.
• GitHub and LinkedIn: only if you choose to sign in with them.
• Payment processor: handles paid plans. Card details go straight to them; we never see or store full card numbers.

Other cases

• Recruiters and hiring partners: only with your consent, only your starred resume. Details.
• People you share with: anyone with a share link you create can see that resume until you turn the link off.
• Legal reasons: when required by law, court order or a valid government request, or to protect the rights, safety and property of our users, the public or Resume Sketch.
• Business changes: if Resume Sketch is merged, acquired or sells its assets, your data may move to the new owner, who must keep honouring this policy. We'll tell you first.

We do not sell, rent or trade your personal data, and we don't share it with advertisers.

• It's a separate, optional choice. You can use every Resume Sketch feature without it.
• When it's on, we may share your starred resume (the one marked with a star on your dashboard), including the contact details on it, with recruiters, hiring managers and staffing partners looking for candidates.
• We never share your other resumes, AI chats, cover letters, uploaded files, account email or billing details.
• Turn it off any time in Profile → Privacy & sharing. Sharing stops immediately, but we can't recall copies a recruiter has already received.

Read the full details on the recruiter sharing page.

On Pro and Max you can connect your Gmail account to send cold emails from your own address. When you connect, Google asks you to allow one permission: send email on your behalf (gmail.send). We also receive your Google account's email address, to show which account is connected.

• We only send an email when you press Send and confirm it. We never send anything on our own.
• We cannot read, search, label or delete any email in your inbox. That permission is never requested.
• We store the access token Google gives us, encrypted (AES-256), only to send the emails you ask for, and keep a short log of what you sent so you can see it in the editor.
• You can disconnect at any time from your profile or the cold email panel, which deletes the token and revokes access. You can also remove access in your Google account's security settings.

Resume Sketch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or use it to train AI models.

• Essential: keep you signed in, protect forms, remember an invite link (30 days) and carry your sign-up choices through GitHub/LinkedIn sign-in (1 hour).
• Preferences: theme and editor settings, kept in your browser's local storage.
• Analytics: Google Analytics cookies that measure visits in aggregate.

You can block or delete cookies in your browser settings. Blocking essential cookies will sign you out. More in the Cookie Policy.

• Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest by our infrastructure providers.
• Row-level security in our database, so every account can only read its own rows.
• Extra encryption (AES-256) for sensitive tokens such as Gmail access.
• Rate limits and abuse detection on sign-in, AI and every public endpoint.
• Restricted, logged administrator access (see who can see your data).

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires, without undue delay.

• Account, profile, resumes, files and chats: until you delete them or your account.
• When you delete your account: your account, resumes, profile, photos, share links and connections are deleted immediately. Copies in encrypted backups are overwritten within 30 days.
• Consent history: kept while your account exists and up to 3 years after, so we can prove what you agreed to.
• Administrative audit log and security logs: up to 2 years.
• Billing records: as long as tax and accounting laws require (usually up to 8 years in India).
• Rate-limit counters and view de-duplication: minutes to hours.
• Data a recruiter received through recruiter sharing is held by that recruiter under their own policy.

Depending on where you live, you have the right to:

• Access your data, and export it (download resumes as PDF, or ask us for a full copy).
• Correct it: edit your profile and resumes at any time.
• Delete it: delete resumes yourself, or your whole account in Profile → Account.
• Withdraw consent: turn off recruiter sharing, disconnect Gmail or AI apps, or block analytics cookies. Withdrawing doesn't affect what was done before.
• Object or restrict certain processing, and nominate someone to exercise your rights if you can't (India's DPDP Act).
• Complain to us first, and if unresolved, to your data protection authority (in India, the Data Protection Board of India).

Email support@resumesketch.com from your account email to make a request. We may need to verify it's you, and we respond within 30 days.

Resume Sketch is for people aged 16 and over (or the age of digital consent where you live, if higher). We don't knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

Our providers run servers in several countries, so your data may be processed outside the country where you live, including in India, the United States and the European Union. Where required, we rely on safeguards such as standard contractual clauses and only use providers that commit to protecting personal data.

We'll update this page when our practices change and change the version and effective date at the top. For material changes we'll tell you by email or in the app, and ask you to review and accept the new version before you continue using Resume Sketch.

For privacy questions, requests or complaints, write to our grievance officer at support@resumesketch.com with the subject "Privacy". We acknowledge every request within 7 days.