PRIVACY POLICY

my-resume.in ("we", "us", "the Service") is a personal-project resume builder that helps you store your professional profile once and generate ATS-optimised, tailored resumes from it. This Privacy Policy explains what we collect, why, and the rights you have over your data. We try to keep this human-readable — if anything is unclear, email us (see section 11).

01Overview

The Service is operated by Zevo Works (GSTIN 29DUUPG0736G1ZA), a sole proprietorship based in Kempanahalli, Davanagere, Karnataka, India, and made available to users worldwide. We are the data controller for the personal data you submit. We collect only what we need to operate the resume generator, and we do not sell your data to anyone. Ever.

We collect and process your personal data with your consent, which you give when you register an account and when you choose to use AI features. Your consent is specific to operating the Service. You may withdraw consent for AI features at any time by not using them, and withdraw consent entirely by deleting your account — which triggers deletion of your data as described in Storage & retention (see also Your rights).

02Data we collect

We collect the following categories of data, all of which you knowingly provide or are technically required to operate the Service:

• Account data: name, email address, hashed password (bcrypt). If you sign in with Google, we receive your Google account email, name, profile picture URL and a Google ID — never your Google password.
• Profile data: everything you fill in on the Profile Hub — personal details, education, work experience, internships, skills, projects, certifications, languages, achievements and links (LinkedIn, GitHub, portfolio).
• Resume artefacts: uploaded resume PDFs, parsed text, generated LaTeX source, compiled PDFs and the metadata associated with each build.
• Job descriptions: any JD text you paste in for AI tailoring.
• Usage telemetry: pageviews, route timings, browser/OS user-agent string, approximate locale and a randomly generated session ID created per visit and not linked to your account or identity. We do not store precise IP addresses with your account.
• Support communications: if you email us, we keep the message thread.

03How we use your data

We use the data above only to:

• authenticate you and keep your session alive;
• store your profile so you can generate unlimited resumes from it;
• compile resumes, render previews, and let you download PDFs;
• send your job description to our AI provider so it can tailor a resume to it (see section 05);
• diagnose bugs, monitor performance and improve the product;
• respond to support requests.

We do not use your profile data to train AI models, and we do not run ads.

04Storage & retention

Data is stored in our managed database and object storage. Compiled PDFs and uploaded resumes are kept until you delete them or close your account. Account and profile data are kept for as long as your account is active. When you delete your account from the Profile Hub → Account page, we permanently remove your account, profile, all resumes and JD data within 30 days from primary storage. Encrypted backups are rotated within 90 days. Support email threads are kept for up to 24 months, then deleted, unless a longer period is needed to resolve an ongoing issue or to meet a legal or tax obligation.

05Sharing & third parties

We share data only with the sub-processors needed to run the Service:

• Cloud hosting & database — our application, database (PostgreSQL) and file storage run on a Hostinger VPS; as our infrastructure provider, Hostinger has access to data at rest on that server.
• AI providers — when you use AI features (resume parsing, JD tailoring, cover letters, cold emails, study plans), the relevant text is sent to a model provider for inference through our provider chain: DeepSeek (via NVIDIA NIM), NVIDIA NIM, Anthropic (Claude), and Google (Gemini). We do not authorise providers to train on this data where that option is available, and we keep this list current as our providers change.
• Razorpay (payments) — when you buy a paid plan, your name, email and payment details are processed by Razorpay to complete the transaction and issue a GST invoice. We never see or store your full card number, UPI PIN, or bank credentials.
• Google OAuth — only if you choose Google sign-in.
• LaTeX compiler — runs in our infrastructure (Docker); your data is not sent to a third party for compilation.
• Legal authorities — only if compelled by valid legal process.

We never sell, rent, or trade your personal data.

Cross-border processing. Some of our sub-processors (including the AI providers above) operate servers outside India. By using the AI features, you consent to your data being transferred to and processed in the jurisdictions where these providers operate. We send only the text needed for the feature you invoked and rely on those providers' contractual and technical safeguards.

06Cookies & tracking

We use a single first-party, HTTP-only session cookie that is strictly necessary to keep you logged in — it carries no advertising or tracking function, so it does not require separate consent. Our usage telemetry (pageviews, route paths, timings) is first-party and anonymised / non-personal — it is not linked to your account or used to identify you. We do not use third-party advertising cookies, fingerprinting, or cross-site trackers.

07Your rights

You can, at any time:

• Access & correct your profile data directly from the Profile Hub.
• Export your generated resumes as PDF.
• Delete individual resumes or job descriptions from the dashboard.
• Delete your entire account from Profile Hub → Account → Delete Account.
• Withdraw consent — for AI features, by not using them; entirely, by deleting your account, which triggers deletion of your data.

Under applicable laws (GDPR, where you are in the EU/EEA, and India's DPDP Act, 2023), you may also have the right to data portability, restriction of processing, and to lodge a complaint with a supervisory authority. Email us to exercise any of these rights; we aim to respond to such data-rights requests within 30 days (general queries are usually answered sooner).

08Security

Passwords are hashed with bcrypt. Sessions use HTTP-only, signed cookies over HTTPS. We follow least-privilege access on our infrastructure and patch dependencies regularly. No system is perfectly secure, however, and we cannot guarantee absolute security. Please use a strong, unique password and keep it private.

Data breach notification. In the event of a personal-data breach that is likely to affect you, we will notify affected users and the Data Protection Board of India without undue delay, as required by the DPDP Act, 2023.

09Children

The Service is not directed at children under 16. If you believe a minor has created an account, contact us and we will remove the account.

10How your resume is processed

When you upload a resume, we handle it in a deliberate, privacy-conscious sequence. The key point up front: your original file is never sent to the AI — only the plain text pulled from it is — and the uploaded file is deleted straight after that text is extracted.

• 1. Upload & validation. You upload a PDF or DOCX (max 5 MB). It is saved temporarily on our server under a random, unique filename.
• 2. Text extraction. We extract only the text content — pdf-parse for PDFs, mammoth for DOCX. If too little text comes out (under ~50 characters — usually an image-only or scanned file), the upload is rejected. Text is capped at roughly 200,000 characters (~50 pages).
• 3. Local pre-processing. Before any AI call, we run pattern-based (regex) extraction on the text to pull out your email, phone, LinkedIn/GitHub/portfolio links, a best-guess name, and interests. These act as safety-net fallbacks in case the AI misses them.
• 4. Sending to the AI. Only the plain text string is sent to the AI provider — never the original file. The text is wrapped in a detailed set of instructions telling the model to act as a resume parser and return structured data (personal info, education, skills, experience, projects, certifications, achievements, hobbies, links). The request runs through a provider chain (DeepSeek → NIM → Claude → Gemini).
• 5. Retry & fallback. If the AI returns malformed data, we ask it to correct the format. For long resumes we use a two-pass approach — one pass for personal/education/skills/certifications/achievements/links, another for the bulkier experience and projects — then merge the results.
• 6. Post-processing. We merge our locally-extracted contacts over the AI result to fill any gaps, normalise names to title case, categorise and de-duplicate skills, and split long paragraph-style bullets into individual points.
• 7. Cleanup. The uploaded file is then permanently deleted from our server — the original document is never kept long-term. Only the structured profile and any resume you choose to save are retained, per section 04.

11Grievance officer

For any privacy or data-protection concern, our Grievance Officer under the IT (Intermediary Guidelines) Rules, 2021 and the DPDP Act, 2023 is:

• Name: Gangadhara K S (Proprietor, Zevo Works)
• Email: info@zevo-works.in
• Address: Kempanahalli, Davanagere, Karnataka, India

We acknowledge complaints within 24 hours and resolve them within 15 days of receipt.

12Changes

We may update this policy as the product evolves. Material changes will be highlighted on the home page or via email. The "Last updated" date at the top always reflects the current version.

13Contact

Questions, deletion requests, or anything else — email info@zevo-works.in. We aim to respond within 5 working days.