ResumeForU Privacy Notice

All products · ResumeForU legal overview

This document is provided in English.

Privacy · Terms of service · Refund policy

លក្ខខណ្ឌសេវាកម្ម — Nodesify · គោលការណ៍ឯកជនភាព — Nodesify

English · Bahasa Melayu

This notice explains how Nodesify Technology handles personal data through ResumeForU, including guest drafts, saved resumes, purchases, downloads, support and optional public profiles. It applies whether or not you create an account.

Nodesify’s separate account privacy notice explains the shared identity service. ResumeForU receives the account identifier, email, verification status and profile name needed for sign-in and product access. Shared sign-in does not itself give other Nodesify products access to your resumes or purchase history. This notice explains ResumeForU product processing; the company website notice is not a substitute for it.

You provide resume information such as your name, contact details, location, links, summary, employment, education, skills, projects, certifications and languages. We also store template choices, editor settings, saved drafts and version snapshots. Imports populate the editor with information you choose to provide. Personalized resource downloads may use your account name.

For guests, we create a product identifier and a browser session token. A guest draft is saved on our servers; it is not stored only on your device. Signing in or claiming a guest purchase can associate the draft and purchase with your chosen account.

For purchases, we receive checkout email and transaction information from you and Stripe, including payment references, amounts, currency, payment or dispute status and receipt information. We retain the first and last name recorded at purchase. Stripe handles card entry; ResumeForU does not receive or store your full card number or security code.

We record the product document versions confirmed at checkout, a server timestamp and the related resume identifier. Older records may include onboarding acknowledgements. These records do not themselves contain an IP address or device fingerprint; separate security records may contain technical identifiers.

We receive information you send to support and technical information generated when you use the service, such as request times, IP addresses, browser or device information, errors and security events. Providers may also send payment, authentication and email-delivery events needed to operate the service.

We process identity and resume data to provide the features you request: saving, editing, rendering, exporting, restoring versions, recovering access and publishing a profile if you choose. We process transaction and agreement records to fulfill purchases, send service emails, handle refunds or disputes and meet recordkeeping duties. Technical and support information helps us diagnose problems, protect accounts and prevent fraud or abuse.

We rely on the legal grounds applicable to the processing and your jurisdiction. These include processing necessary to provide a requested service or perform a contract, comply with law, and consent where required. Where the law permits reliance on legitimate interests, these may include service security and proportionate operational analysis, subject to your rights. This is not a claim that every jurisdiction recognizes the same legal grounds.

Information required to identify a resume, maintain access or complete a purchase must be supplied for that feature to work. Other resume sections, profile publication and optional contact fields are your choice unless the feature identifies them as required. Omitting optional information does not prevent basic use, although it may affect the resulting document or feature.

You can request access or correction and withdraw consent where processing depends on it. Withdrawal does not invalidate earlier lawful processing. If information is necessary for a requested feature, withdrawing permission or requesting its removal may prevent us from continuing that feature. Accepting terms or reading this notice does not opt you into marketing. Current product emails concern service delivery, access and transactions.

Authorized staff and service providers may process the information needed for their roles. Providers include the Nodesify identity service powered by Logto for authentication; hosting, rendering and database infrastructure for the application; Cloudflare for network protection and R2 file storage; Stripe for payments; and Plunk for transactional email. If you accept optional measurement, PostHog receives limited product usage events and campaign labels, and Google, Microsoft Advertising or Reddit receives the corresponding advertising conversion information described below.

Rendering and storage providers process resume content and generated files. Email providers process recipients and service-message content. Payment providers process checkout and transaction information. Analytics providers receive the limited usage information described below. A provider may also act independently for processing it is legally responsible for, such as payment compliance; its own notice applies to that processing.

We may disclose relevant information to advisers, payment providers, courts, regulators or authorities when necessary to handle a dispute, protect rights or comply with applicable law. A business transfer may involve necessary records, subject to applicable safeguards and notice requirements. Optional public sharing is described separately below.

We do not sell resume content or use it to train public AI models. A future optional feature that introduces materially different processing will need an updated explanation and consent where required before that processing begins.

A profile is private until you publish it. Publishing can expose your name, headline, bio or summary, location, links, skills, projects, employment, education, credentials, languages and any availability indicator you enable. Email and phone are shown only when their separate visibility settings are enabled. Check the public preview before publishing; hiding email and phone does not hide the other profile fields.

Anyone who can reach a published profile may read, copy or share it. Updating the underlying resume can change the published profile. Unpublishing stops access through the service, but we cannot erase copies already saved by other people, search engines or external services. Share only information you intend to make public and have the right to disclose.

Essential cookies support guest access, sign-in and security. The ResumeForU guest cookie is configured for up to 30 days. Shared sign-in cookies are managed through Nodesify’s identity service. Browser storage may temporarily preserve editor or identity-entry state. Clearing it or using a different device can remove access to an unclaimed guest draft; an account or purchase-recovery process is needed to restore access where available.

Optional product analytics is disabled until you accept measurement. When enabled, our server sends limited usage events to PostHog: normalized page routes without query strings, coarse entry source, fixed feature and section categories, import methods and outcomes, template choices, preview and export outcomes, and purchase amounts, currency, refunds and disputes. Random browser consent and resume journey identifiers connect these actions; account, resume, order and payment-provider identifiers are not sent. We do not send resume or job-description text, names, contact details, filenames or raw referring URLs. We do not enable automatic interaction capture or person profiles, and we disable event IP geolocation. Separately, you may opt into masked troubleshooting recordings for the current browser session. These recordings are sent to PostHog EU and retained for 30 days; inputs, text, images, documents and embedded content are masked or blocked, and console logs and network payloads are not recorded. Recording consent is separate from analytics consent and can be withdrawn with the recording control. We also send fixed failure categories, operation names and HTTP statuses for consenting browsers; raw error messages and resume content are not included in product analytics. Hosting, network and security providers still process technical information, including IP addresses, to deliver requests, diagnose errors and protect the service. This does not describe the separate analytics choices on nodesify.com.

We keep limited operational milestones linked to an existing resume: its creation time and the first useful preview, checkout and prepared PDF times. Payment records provide payment, refund and dispute outcomes. We also retain a coarse entry-source category, such as direct, search or social, rather than a referring URL. The category stays in page memory during navigation; it does not create an analytics cookie, browser identifier or device fingerprint. These records help identify problems completing a resume and delivering a purchase. Internal monitoring receives aggregate counts and timings, without resume text, names, email addresses or access tokens. Page-request counts can include reloads and bots and are not counts of unique people.

Resume milestone records are included in your product-data export and removed when the resume is deleted or your product profile is closed. Aggregated monitoring history may remain under its operational retention settings. This processing does not re-enable third-party visitor tracking or optional analytics on the company website.

Product analytics requires the current consent version; a material purpose change prompts a new choice. The browser choice lasts up to 180 days. Product analytics links and queued events are deleted on withdrawal or product profile closure, and expired consent cannot deliver queued events. PostHog Cloud makes events available within its plan retention window: one year on the free plan and seven years on paid plans. This window is not a deletion schedule, and a shorter event retention period is not configurable. Contact support to request access or erasure of events already delivered to PostHog. These measurements describe consented browsers and prepared files, not all visitors, verified downloads or a guarantee of ATS acceptance.

The public resume checker processes pasted resume and job-description text in your browser without uploading that text through the checker. This is distinct from the builder, which saves resume data to provide editing and downloads. The checker’s text is held in page state rather than intentionally persisted by that tool.

Optional advertising measurement is off until you choose Accept. Declining does not prevent building or purchasing a resume. The rb_measurement first-party cookie remembers your choice for up to 180 days. If accepted, we retain a random browser consent reference, campaign tokens, encrypted Google, Microsoft Advertising or Reddit click identifiers and links to resume milestones and Checkout Sessions. We attribute purchases to the last non-direct campaign within 90 days. These attribution records are retained for up to 180 days and are included in your product-data export when linked to your resumes.

With the current measurement permission, our server can send the corresponding advertising provider — Google, Microsoft Advertising or Reddit — its click identifier, purchase time, purchase value and currency. Google and Reddit also receive a purchase reference; Microsoft receives its conversion goal name. Google Data Manager and Microsoft offline conversions can receive updated net values after refunds or disputes. Reddit receives a purchase event once; later refunds and disputes reduce our internal net revenue reports rather than restating that event. We do not send resume content, contact details, names, email addresses or our account identifier for this measurement. Google uploads deny advertising personalization. We use server APIs without loading advertising pixels. These providers may process information internationally under their own privacy notices and applicable safeguards.

PostHog also receives validated campaign source, medium, campaign name and ID, ad group ID and creative labels so that we can compare the steps from a campaign visit to purchase. Click identifiers stay encrypted in our attribution store and are not sent to PostHog. Connecting advertising reports to PostHog can import campaign spending, clicks and impressions. Expanding measurement to Microsoft Advertising, Reddit and these campaign labels requires a new browser choice.

Use Tracking preferences in ResumeForU to withdraw permission. Withdrawal removes this browser’s stored attribution, product analytics links and queued events, and pending advertising conversion records, and stops future sharing; it does not undo processing already completed by PostHog, Google, Microsoft Advertising or Reddit. Deleting a resume removes its attribution links; closing a product profile removes browser attribution linked to its resumes. Contact support for access or erasure requests involving information already shared with these providers. Campaign measurement does not enable the separate optional analytics on nodesify.com. Disabling essential browser storage can prevent sign-in or guest access.

We operate from Malaysia. Our providers may process information in other countries where they operate, and we do not promise that all data stays in Malaysia. Transfers must comply with applicable law, including any required assessment, contractual protections or other recognized transfer conditions. Contact the data protection contact below for information about the safeguards relevant to your data.

We use access controls, protected transport, restricted file access and security monitoring to protect information. Authorized systems must be able to process resume content to render and deliver it; this is not an end-to-end encrypted service that only you can decrypt. No system is completely secure. Protect your account, device, receipt and claim links, and report suspected unauthorized access.

If a personal data breach occurs, we will assess it and notify the relevant regulator and affected individuals when required by applicable law, using the applicable thresholds and deadlines. We will explain relevant protective steps where notification is required.

Active resume and profile data is retained to provide editing, version history and downloads. Unpaid guest drafts become eligible for scheduled cleanup after 30 days without activity. Guests with paid purchases are excluded from that inactivity cleanup so purchases can be recovered. Eligibility for cleanup is not a promise of deletion at exactly 30 days.

Generated files are temporary delivery artifacts and can be regenerated from retained resume data. Storage cleanup is configured to remove older artifacts; expiring a download link does not itself delete the underlying file. The actual cleanup timing depends on the retention configuration and scheduled processing.

Deleting your ResumeForU profile disables product access and public profiles. We remove resume content and version snapshots and attempt to purge generated files. Storage outages may delay file removal until cleanup succeeds. Backup copies may remain until their rotation period ends; deletion is not instantaneous across every backup or provider.

When purchase records exist, we retain transaction and agreement evidence needed for accounting, receipts, refunds, disputes and legal obligations. This may include payment references, amounts, currency, receipt email and the purchase name, including an approved correction. Accounting evidence is normally retained for seven years after the end of the relevant tax year; late tax filings or unresolved legal matters may require longer retention. Records needed to provide an active purchased entitlement remain while that entitlement is provided. After product closure, we review retained evidence against those periods and remove personal data no longer needed. This does not permit indefinite retention of active resume content after deletion.

A minimal closed-profile marker, including the account identifier and closure time, prevents shared sign-in from automatically recreating a deleted product profile. Without purchases, profile contact details and acceptance history are removed. Providers such as Stripe may retain records they are independently required to keep. Security, support and analytics records are retained only while needed for their stated purposes, including incident investigation and legal duties.

Depending on the law that applies, you may request access, correction, deletion, withdrawal of consent, portability, restriction or objection to particular processing, and may complain to the relevant regulator. These rights have conditions and exceptions; naming a jurisdiction does not automatically make every law applicable to the service.

Signed-in users can export their product data and delete their ResumeForU profile from the Account page. Guests and anyone unable to sign in can contact support. We may request proportionate information to verify identity or authority before disclosing or changing personal data. Do not send passwords or full payment-card details.

The purchase name lock limits self-service editing; it does not remove a right to request correction of personal data. Contact support about an error or a lawful name change. We will review the request, distinguish historical purchase evidence from current profile data, and explain the action available or any lawful reason for refusal. It does not authorize transferring a purchase to another person.

We handle requests within the period required by applicable law and explain any permitted extension or limitation. You can contact our data protection contact or the Malaysian Personal Data Protection Commissioner through the official website linked below. Where another regulator has jurisdiction, you may complain to it as well.

Deleting a ResumeForU profile does not close your shared Nodesify account or delete data held by other products. Request company-wide closure from the Nodesify account team. The team verifies and coordinates the request and explains what records must remain. Deleting a shared identity alone does not erase every product database, and deleting a product does not automatically request a refund.

ResumeForU is intended for people aged 18 or over. Do not provide unnecessary sensitive information, identifiable patient information or another person’s private data without appropriate authority. If you believe a child has supplied personal data or a profile exposes information improperly, contact us so we can investigate and take appropriate action.

We publish revisions with a date and version. Material changes to purposes or sharing will be explained with additional notice and consent where required. Moving this product notice to a company legal page does not itself authorize new uses of your data or remove your rights. The contact details and links below can be used for questions, requests and complaints.

Nodesify Technology · 202603004114 (RA0131566-P)

11, Jalan Gunung Lambak 16, Taman Gunung Lambak, 86000 Kluang, Johor, Malaysia

Support: support@resumeforu.com
Data protection: support@nodesify.com

• Export data or delete your product profile (sign-in required)
• Request closure of the shared Nodesify account
• Malaysian Personal Data Protection Commissioner