Privacy Policy

Last updated: March 14, 2026

1. Introduction

GitResume ("we", "us", "our") operates the website www.gitresume.co and the gitresume.co platform. This Privacy Policy explains how we collect, use, and protect your personal information when you use our services.

2. Information We Collect

We collect information in the following ways:

• Account Information: When you sign up via GitHub or Google OAuth, we receive your username, email address, display name, and avatar URL.
• Repository Data: When you connect a GitHub repository, we access your resume YAML files via the GitHub App integration to build your resume. We do not store your repository contents beyond what is necessary for rendering.
• Payment Information: When you subscribe to a paid plan, payments are processed by Paddle.com as our Merchant of Record. We do not directly collect or store credit card numbers or payment details. We store subscription status, plan type, and billing cycle information.
• Cookies: We use httpOnly cookies for authentication (JWT access and refresh tokens). See our Cookie Policy for details.

3. How We Use Your Information

• To provide and maintain the GitResume service
• To authenticate you and manage your account
• To build and deploy your resume from YAML files
• To host your public resume page at gitresume.co/@username/slug
• To process payments and manage subscriptions
• To send service-related emails (such as welcome emails and build status notifications)
• To improve and optimize our platform

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: Processing account information, repository data, and build artifacts to provide the service you signed up for.
• Legitimate Interests: Improving and optimizing the platform, preventing abuse, and ensuring service security.
• Legal Obligations: Retaining or disclosing information when required by law.
• Consent: Where applicable, we obtain your explicit consent before processing your data.

5. Third-Party Service Providers

We use third-party service providers to operate our platform, including:

• Payment Processor (Paddle): Processes all payment transactions, tax calculations, and compliance as our Merchant of Record. Payment information is collected and processed directly by Paddle and does not pass through GitResume servers. See Paddle's Privacy Policy.
• Hosting and Infrastructure Providers: Provide CDN, DNS, DDoS protection, and file storage services.
• Email Service Provider: Sends transactional emails on our behalf.

These providers process your data only to the extent necessary to deliver their services and are bound by their respective privacy policies.

6. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data only in the following circumstances:

• With your consent
• To comply with legal obligations
• To protect our rights, privacy, safety, or property
• With the service providers listed above, bound by confidentiality obligations

7. Public Resume Pages

When you deploy a resume, the content you include in your YAML file becomes publicly accessible at your chosen URL (gitresume.co/@username/slug). You control what information appears in your resume. You can delete your resume at any time — once deleted, the page will no longer be accessible and search engines will remove it from their indexes.

8. Resume Analytics

We collect anonymous viewing statistics for public resume pages, such as view counts, referrer sources, visitor countries, and device types. This data is visible only to the resume owner. We do not use cookies or third-party tracking tools for this purpose.

9. Data Storage

• All data transmission is encrypted using HTTPS
• Built artifacts (PDFs, HTML) are stored in encrypted cloud object storage

10. Data Retention

We retain your account data for as long as your account is active. When you delete your account, your data will be permanently removed within 30 days. Built artifacts (PDFs, HTML) are deleted immediately upon project or account deletion. Payment records are retained by Paddle as required by law.

11. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS), httpOnly cookies with SameSite=Lax, webhook signature verification (HMAC-SHA256), secure token handling, and DDoS protection and traffic filtering. However, no method of transmission over the Internet is 100% secure.

12. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Export your data (your resume YAML is always in your GitHub repo)
• Withdraw consent for optional data processing

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on our website. Your continued use of the service after changes constitutes acceptance.

14. Contact

If you have questions about this Privacy Policy, contact us at [email protected].