Privacy Policy

Last updated: February 28, 2026

1. Introduction

Welcome to Resume Hedgehog ("we", "our", "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use our website and services (the "Service").

This policy applies to all users worldwide and is designed to comply with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR) of the European Union, the California Consumer Privacy Act (CCPA), the UK Data Protection Act 2018, Brazil's Lei Geral de Proteção de Dados (LGPD), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Australia's Privacy Act 1988, and other applicable regional data protection regulations.

2. Data Controller

The data controller responsible for your personal data is Resume Hedgehog. If you have questions about this Privacy Policy or our data practices, please contact us at the email provided on our website.

3. Information We Collect

We collect the following types of information:

3.1 Account Information

  • Email address (required for registration)
  • Password (stored in hashed form)

3.2 Resume and Job Offer Data

  • Resume content you upload or paste (which may include your name, work history, education, skills, and other personal or professional details)
  • Job offer descriptions you paste into the Service
  • Answers you provide to AI-generated questions about your qualifications
  • Generated tailored resumes produced by the Service

3.3 Usage Data

  • Credit transactions and balance
  • Points and achievement data
  • Actions you perform within the Service (e.g., sharing, downloading, generating resumes)

3.4 Technical Data

  • Authentication tokens (stored in cookies)
  • Browser type, device information, and IP address (collected via server logs)

4. How We Use Your Information

We use your information for the following purposes:

  • Providing the Service: To create your account, generate tailored resumes, answer job-related questions, and deliver the core functionality of the Service.
  • Third-Party AI Processing: Your resume content, job offer descriptions, and answers to questions are sent to a third-party AI provider (currently OpenAI) for processing. This is essential to generate tailored resumes and answer job-related questions. By using the Service, you acknowledge and consent to this data transfer.
  • Credit and Points Management: To track your credit balance, transactions, points, and achievements.
  • Payment Processing: If you purchase credits, your payment is processed by Stripe. We do not store your payment card details.
  • Service Improvement: To understand how the Service is used and improve its features.
  • Communication: To send you service-related communications if necessary.

5. Third-Party AI Processing

Important: To provide resume tailoring and question-answering functionality, we transmit the following data to a third-party AI provider (currently OpenAI):

  • Your resume content (including personal and professional details)
  • Job offer descriptions you provide
  • Your answers to AI-generated questions

This data is transmitted via encrypted connections (HTTPS/TLS). The third-party AI provider processes this data according to their own privacy policy and data processing agreements. We recommend reviewing the AI provider's privacy practices. We do not control how the third-party AI provider retains or processes data beyond what is specified in our data processing agreements with them.

By registering for and using the Service, you explicitly consent to this transfer and processing of your data by third-party AI providers.

6. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or other jurisdictions that require a legal basis for processing personal data, we rely on the following:

  • Consent: You provide explicit consent when you register and accept this Privacy Policy and our Terms of Service, particularly for the transfer of your data to third-party AI providers.
  • Contract Performance: Processing is necessary to provide the Service you have requested.
  • Legitimate Interests: We may process data for service improvement and security purposes, provided such interests are not overridden by your rights.

7. Data Sharing and Disclosure

We share your data with the following categories of recipients:

  • Third-Party AI Provider (OpenAI): Resume content, job offers, and question answers for AI processing as described in Section 5.
  • Payment Processor (Stripe): Payment-related data when you purchase credits.
  • Legal Obligations: We may disclose data if required by law, regulation, legal process, or governmental request.

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. You may delete your account and associated data at any time via the Profile page. Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

9. Data Security

We implement industry-standard security measures to protect your data, including:

  • Password hashing using bcrypt
  • HTTPS/TLS encryption for all data in transit
  • Secure authentication via signed JWT tokens
  • Access controls to limit data access to authorized processes

While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of your personal data.
  • Rectification: Request correction of inaccurate data.
  • Erasure: Request deletion of your personal data ("right to be forgotten"). You can delete your account via the Profile page.
  • Data Portability: Request your data in a structured, machine-readable format.
  • Restriction: Request restriction of processing in certain circumstances.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw Consent: Withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

For CCPA (California residents): You have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information (we do not sell your data).

For LGPD (Brazil residents): You have the right to confirmation of processing, access, correction, anonymization, portability, deletion, and information about sharing.

To exercise any of these rights, please contact us via the email provided on our website or use the account deletion feature on the Profile page.

11. International Data Transfers

Your data may be transferred to and processed in countries other than your own, including the United States (where our AI provider operates). We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses or equivalent mechanisms as required by applicable law.

12. Cookies

We use essential cookies for authentication (JWT token). We do not use tracking cookies, advertising cookies, or analytics cookies. The authentication cookie is strictly necessary for the Service to function and does not require separate consent.

13. Children's Privacy

The Service is not intended for individuals under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through the information provided on our website. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.