Privacy Policy
This policy explains how Premsan Inc (“Premsan”, “we”, “us”) handles personal data in Resumical — this website, the web app, the API, and the Resumical apps for iPhone, iPad and Android. Premsan is the controller of that data.
1. What we collect
- Your account. Your name, your email address, and either a password, stored only as a hash, or, when you sign in with Apple or Google, your identifier with that provider and the sign-in tokens it issues to us. Each session records the IP address and the browser or device it was opened from, and when it expires. We also record the date on which you accepted the Terms, and which version, and the day you last used the account.
- What you provide. The facts you give Resumical, the messages you exchange with it, the documents it writes and every version of them, the pictures and PDFs you attach, and the PDFs it renders. What you include is your choice, and the resume forms of some countries ask for details that others do not, such as a date of birth, a nationality or visa status, or a photo. Resumical stores them as you gave them and uses them for your documents, and you can edit or delete any document, and delete any memory, at any time.
- Links you paste. If you paste a link to a job posting, our server fetches that page on your instruction and adds its text to your conversation. The site you linked receives a request from our server, not from you.
- Purchases. On the web, payment is taken by Stripe: it receives your email address and your account id, and your card details go to Stripe and never reach us. We keep the checkout’s id and the number of pages it bought. In the app, payment is taken by the App Store or Google Play; we receive the transaction’s id, confirm it with Apple or Google, and record it against your account.
- What the assistant remembers. The facts you tell the assistant about yourself, your work and how you want it to work, kept as memories so every later conversation starts with their titles and descriptions: each one’s kind, title, description and details, whether you or the assistant wrote it last, and when. You see and delete them in Settings, and correct one by telling the assistant; their titles and descriptions go to the model with every message you send it, and a memory’s details when the assistant opens it.
- Your voice. When you turn on voice mode, what you say is recorded and sent to be written down as text; the text goes to the assistant as your message, and the recording is deleted once it is written down. The assistant’s replies are read aloud by your own device’s voice.
- Help. When you write to us from Help: your messages, any pictures you attach, our replies, and details that help us answer, namely the browser you wrote from or the app’s version and operating system, the screen you came from, the screen size, your time zone and your most recent failed requests to our servers. Our team reads them in our own support tool, where, if you have allowed the assistant, Resumical’s model may draft a reply that a team member reviews before sending.
- Usage. Monthly counts of runs, renders and model tokens, kept in your account’s own storage for our accounting. Server logs hold request metadata, including your IP address, and error reports for a short time, for security and debugging.
- The bot check. Cloudflare Turnstile runs on our sign-in and sign-up pages, and on the app’s sign-in screen, to distinguish people from automated programs.
- Nothing else. We use no advertising, no analytics, no tracking across sites or apps, no advertising identifier and no data brokers.
2. What we do with it
We use personal data to run Resumical: to write, render and check your documents, to sign you in, to send you the emails the account needs (a verification link and a password reset), to take payment and add the pages you bought, to keep the service running and prevent abuse, to answer you when you write to us, and to meet legal obligations. We do not use your facts, conversations or documents to train models, we do not sell personal data, and we do not share it for advertising.
3. Why we are allowed to
Where the GDPR or a similar law applies, we rely on these legal bases:
- Performing our contract with you: your account, your facts, your conversations and documents, and the payments. Without them we cannot provide the service.
- Our legitimate interests: keeping Resumical running, finding failures, and preventing abuse and automated sign-ups. This is limited to what running the product requires, namely the usage counts, the logs and the bot check; it does not include profiling or advertising.
- A legal obligation: payment records and anything else the law requires us to keep.
- Your consent: for anything the law treats as a special category of data, such as a photo, a nationality, or a health or family detail you choose to put in a document. You give consent by adding the detail, and you withdraw it by deleting the fact, the document or the account.
4. Who else processes it
Resumical runs on Cloudflare: the servers, the storage that holds your account, the model that writes for you, the browser that renders the PDF, the email we send and the bot check are all Cloudflare services on our own account. None of your prompts goes to any other AI provider. The model runs on Cloudflare Workers AI, and the assistant sends it nothing until you allow that, on the web or in the app, when it asks before your first message; you can turn it off in Settings (under Account in the phone app), and the assistant then asks again before your next message. Some email may be sent through Resend instead. Stripe takes payment on the web; card details go to Stripe directly. Apple and Google take payment in the app, and each confirms a purchase to us when you make one. When the app opens, it asks Expo’s update service whether a newer version of our code is available; that request includes the operating system, our project id and a random identifier the app generated for itself, but no account or device identifier, and Expo sees the IP address it comes from. These providers process data only on our instructions and are each bound to protect it at least as well as this policy does; we will list a new provider here before it starts.
In voice mode, each recording of what you say goes to Cloudflare Workers AI to be written down as text, and to no other provider; we do not keep the recording.
Signing in with Apple or Google sends us your identifier and email address from that provider. For the sign-in, each provider acts on its own behalf, not as our processor, and its handling of your account with it is governed by its own privacy policy. The App Store and Google Play are the sellers of what you buy inside the app, and their handling of your payment is governed by their own policies.
When the assistant searches the web, the words it searches for, which it writes from your conversation, go through Cloudflare to Linkup, or to Ceramic.ai when Linkup cannot answer; neither keeps them once it has answered. When the assistant reads a web page, our servers fetch it from its site in a request that names Resumical, and the site sees nothing else of yours.
5. Where it is
Your data is processed on Cloudflare’s global network, and stored on it under Cloudflare’s own commitments for international transfers. Premsan is in Japan, a country the European Commission recognises as providing an adequate level of protection for personal data.
6. On the phone
The app keeps on your device a sign-in token, the language and appearance you chose, the random identifier used for update checks, whether it has asked you for a review, and, when you share a PDF, a copy of that PDF in the app’s own cache for the share sheet. It reads from your camera, your photos or your files only when you tap the paperclip and choose one; the first time you use the camera, the operating system asks for your permission. It uses the microphone only while voice mode is on, and the operating system asks your permission the first time you turn it on. Nothing is read in the background. Purchases go through the store’s own payment sheet. The app contains no advertising or analytics library, and it may show the operating system’s own review prompt once, after you first share a PDF.
7. Cookies
On the web we set only the cookies the product needs to work: the one that keeps you signed in, and those Cloudflare Turnstile sets on the sign-in and sign-up pages to distinguish people from automated programs. This website and the web app keep your theme and language in your browser’s own storage. We use no advertising cookies, no cross-site trackers and no analytics, so there is no cookie consent banner. Clearing your cookies signs you out.
8. How long we keep it, and deleting it
We keep your account and everything in it for as long as the account exists. Deleting a fact removes it. Deleting a document removes it, its conversation, its versions, its attachments and its renders. Verification and reset links expire automatically.
If your account goes unused for a month and has never bought a pack, we delete it and everything in it, as if you had deleted it yourself. An account that has bought a pack is never deleted for going unused.
You can delete your account at any time: on the web under Account in Settings, or in the app under Account. Everything we hold for you is erased from the service at once (documents, facts, conversations, versions, attachments, renders, Help messages, usage and balance) and then the account itself, apart from the records listed below. Deletion cannot be undone.
These records remain after the account is deleted:
- For a purchase made in the app, a record of the store’s transaction id, the date and the id of the account it was credited to, so that the store cannot credit the same receipt twice, and because the law requires payment records to be kept. The account it refers to no longer exists.
- Stripe, Apple and Google keep their own records of a payment under their own legal obligations.
- Cloudflare keeps restorable copies of our databases for up to 30 days, so that they can be restored after a failure; the copies then expire.
- Server logs are deleted automatically after a short time.
9. Your rights
You can read, correct and delete every fact and document yourself, download any document as a PDF, copy its text as plain text or Markdown, and delete your account, without asking us. Depending on where you live, you may also have the right to a copy of the rest of what we hold about you, to restrict how we process it, to object to processing we base on legitimate interests, to withdraw consent where we relied on it, and to move your data elsewhere. Write to support@resumical.com and we will answer within one month.
If you live in California or another U.S. state with a similar law, you have the right to know what personal data we hold about you, to delete it, and to correct it; the controls above do that. We do not sell or share personal data as those laws define those terms, so there is nothing to opt out of, and exercising a right does not change the service or the terms you receive.
If you think we have handled your personal data wrongly, you can complain to a data protection authority: in the EEA or the United Kingdom, the one where you live or work or where the problem happened; in Japan, the Personal Information Protection Commission. You may contact us first, but you do not have to.
10. Security
Every connection is encrypted in transit. Passwords are stored as hashes. Each user’s data is kept in its own isolated storage and is deleted with the account, apart from the records listed in section 8. The app keeps its sign-in token in the operating system’s secure storage, not in a cookie. Credentials are never written to our logs. If you find a security vulnerability, report it to security@resumical.com and allow us time to fix it before you disclose it.
11. Children
Resumical is not for anyone under 16, and we do not knowingly hold a child’s data. If you think a child has an account, tell us and we will delete it.
12. Changes
We may update this policy. When a change is significant, we will say so in the web app or the phone app, or by email. The date at the top identifies the current version.
13. Contact
Premsan Inc — 530-0001, 12-12, Osaka Ekimae Dai-2 Bldg., 1-2-2 Umeda, Kita-ku, Osaka-shi, Osaka, Japan. support@resumical.com.