This policy explains what personal data Diff Resume collects, why, who processes it on our behalf, how long we keep it, and the rights you have over it — including under the EU General Data Protection Regulation (GDPR). The data controller is DotDev Dominik Tarkiewicz, ul. Legnicka 16, 53-673 Wrocław, Poland, reachable at support@diffresume.com.
1. Data we collect
- Account data — your email address, optional display name and profile photo, and authentication data. If you sign in with Google or GitHub, we receive your email and basic profile from that provider.
- Resume content — the resumes you upload and the structured versions we parse from them. A resume is rich personal data: work history, education, contact details, and anything else you chose to include, such as a photo or GDPR consent statement. We store it so you can reuse it; we never share it except with the processors below, and only to provide the Service.
- Job descriptions you paste for tailoring, and the tailored resumes produced from them.
- Billing data — your credit balance, credit transactions, and subscription status. Payments are handled by Stripe; we never see or store card numbers.
- Support correspondence — if you email us, the message, your address, and any attachments. Mail to our support address is received by Resend and forwarded to a Gmail inbox we operate, and replies are sent from there.
- Technical data — server logs (IP address, request metadata) kept for security and debugging.
We use no analytics or advertising trackers. The only cookies are the authentication session cookie and your light/dark theme preference.
2. Why we process it (legal bases)
- Providing the Service (contract, Art. 6(1)(b) GDPR): storing your resume, tailoring it with AI, rendering PDFs, managing credits and subscriptions.
- Payments and accounting (contract and legal obligation, Art. 6(1)(b)–(c)): processing purchases through Stripe and retaining transaction records.
- Security and abuse prevention (legitimate interest, Art. 6(1)(f)): server logs and rate limiting.
- Answering your messages (legitimate interest, Art. 6(1)(f), or contract where you ask about your account): handling support correspondence.
We do not use your data for advertising, we do not sell it, and neither we nor our AI providers use your resume content to train AI models.
3. Who processes it (sub-processors)
These providers process personal data on our behalf, each under a data processing agreement:
- Supabase — Database, authentication, and file storage (accounts, resumes, avatars, credit ledger). Privacy policy.
- Vercel — Application hosting, bot protection (Vercel BotID, which checks browser signals to tell people from automated abuse), and the AI Gateway that routes our AI requests. Privacy policy.
- OpenAI — AI model provider. Our AI requests are routed through Vercel AI Gateway to a hosted model — currently OpenAI. Processes resume text and job descriptions to parse and tailor resumes. API inputs are not used to train models. Privacy policy.
- Stripe — Payment processing and billing. Card details go directly to Stripe and never touch our servers. Privacy policy.
- Resend — Email delivery. Sends account emails (sign-up confirmation, password reset) and receives mail sent to our support address. Privacy policy.
- Sentry — Error monitoring. Receives technical reports when something fails (error type, code location, page address, browser type) so we can fix it. Resume content, job descriptions, cookies, and form data are removed before a report is sent. Privacy policy.
- Google (Gmail) — Support inbox. Mail you send to our support address is forwarded to, and answered from, a Gmail mailbox operated by us. Privacy policy.
Some of these providers are established in the United States. Where data leaves the EEA, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses, per each provider’s data processing agreement.
4. How long we keep it (retention)
- Resumes and tailored versions — kept until you delete them in the app or delete your account.
- Account and profile data — kept until you delete your account.
- Account deletion is immediate and permanent: your profile, resumes, avatar, credit history, and subscription records are deleted right away and cannot be recovered.
- Payment records at Stripe — Stripe retains transaction records after account deletion where required for tax, accounting, and anti-fraud obligations.
- Support correspondence — kept in our support inbox for up to 12 months after the thread is resolved, then deleted; Resend retains received mail for a short window (typically under 30 days) for delivery and debugging. Account deletion does not erase support emails automatically — ask us and we will delete them.
- Server logs — retained by our hosting providers for a short rolling window (typically under 30 days).
5. Your rights
Under the GDPR you can:
- Access and export your data — use “Download my data” on your account page to get a machine-readable JSON copy (this also covers portability);
- Rectify your data — edit your profile and resumes directly in the app;
- Erase your data — use “Delete account” on your account page, or delete individual resumes in the app;
- Object or restrict processing based on legitimate interest, by contacting us;
- Complain to your local data protection authority.
6. Security
All traffic is encrypted in transit. Data access is scoped per user at the database level (row-level security), avatars live in private storage served via short-lived signed URLs, and payment credentials never reach our servers.
7. Children
The Service is not directed at children under 16.
8. Changes and contact
We will notify you of material changes to this policy before they take effect. Questions or requests: support@diffresume.com or the contact page.