This policy explains what personal data InMyResume collects when you use inmyresume.com, why we collect it, who we share it with and what rights you have. We wrote it to match what the service actually does.
1. Who is responsible for your data
The controller of your personal data is: ZakWeb s.r.o., Korunní 2569/108, Vinohrady, 101 00 Praha 10, Business ID: 30129494, registered in the Commercial Register kept by the Municipal Court in Prague, file C 457015. Contact: info@inmyresume.com.
If you have any question about this policy or your data, write to info@inmyresume.com. We do not have a designated data protection officer.
2. What data we collect
Account data. Your e-mail address and password (stored only as a hash by our authentication provider), or, if you sign in with Google, your name, e-mail address and profile picture provided by Google.
CV and career content. Everything you type, paste or import into the CV builder, cover letter generator, ATS check or job match tool: name, contact details, photo, work history, education, skills, languages, links and any other details you choose to include. A CV may contain sensitive information if you add it (for example a date of birth or nationality); please include only what you want an employer to see.
Purchase data. When you buy a paid plan, our payment partner Lemon Squeezy collects your name, e-mail, billing address and payment details. We receive the order and subscription status, the plan, the amount and your e-mail address. We never see or store your full card number.
Messages. What you send us through the contact form, feedback forms or by e-mail.
Consent to marketing e-mail. If you sign up for tips and news (with a form on the site, a tick box at sign-up or in your profile), we keep your e-mail address, language, where and when you gave consent, the exact consent wording, a one-way hash of your IP address and browser details. An address entered in a form joins the list only after you confirm it with the link we e-mail you. Withdrawals are recorded the same way. We never use the e-mail address in your CV for marketing without your consent.
Usage and device data. Pages you visit, events such as starting a CV or opening a pricing dialog, session start and end, device type, browser, user agent, screen resolution, language, time zone, referrer, and your IP address with the approximate country and city derived from it.
CVs created without an account. If you generate a CV on our homepage or on a landing page without signing up, we keep a copy of that CV together with the time, the page it was made on, its language and a one-way hash of your IP address. We do this to see how many CVs the service actually produces and whether they come out usable, because without an account there is nothing else to measure. To download such a CV you enter your e-mail address, and we send the link to the CV there: we keep that address with the CV, to send you that link and messages about that CV, never for marketing unless you tick the separate box. We delete these copies, with the address, after 30 days, and you can ask us to delete yours sooner at any time — write to info@inmyresume.com.
Affiliate program partners. If you join our affiliate program, we keep your referral code, when you accepted which version of the affiliate terms, your notification settings and, for payouts, the details you enter: whether you take part as an individual or a business, your full legal or company name, address, country of tax residence, company registration and VAT numbers, and your PayPal or Wise e-mail or bank account (IBAN and BIC/SWIFT). We also keep your commissions and a record of every payout with the details it was sent to.
Referrals. If you arrive through a partner’s affiliate link and accept cookies, we store the partner’s code in the imr_ref cookie. When you then sign in or buy, your account is linked to that partner, so they are credited for your purchases. The partner never learns who you are: they see only totals (clicks, sign-ups, paid orders and amounts). Clicks on affiliate links are counted per day with a one-way hash of your IP address, to stop repeated clicks from inflating the numbers.
Usage limits. To enforce the daily limits on free AI imports and PDF exports we store a counter per day, tied to your account or, if you are not signed in, to a one-way hash of your IP address.
Links for one company. A user with the Job Search Pack can make a link to their CV for one job application and send it to one company. When you open such a link we record when it was opened, how long and how far the CV was read, whether the PDF was downloaded, the type of device and the country derived from the IP address. We do not store the IP address; to tell different devices apart we keep only a one-way hash of the IP address and browser, which is different for every link and cannot be matched across links. Nothing is stored in your browser. Only the user who sent you the link sees this, and we e-mail them the first time the link is opened.
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating your account, saving and exporting your CVs and cover letters, publishing your web CV | Account data, CV content | Contract, Art. 6(1)(b) |
| AI features: generating, improving and analysing CV and cover letter text | CV content, job descriptions you paste | Contract, Art. 6(1)(b) |
| Selling and delivering paid plans, handling refunds, keeping accounting records | Purchase data, account data | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Transactional e-mails (account confirmation, password reset, welcome e-mail, sharing a CV, the link to a CV made without an account, the notice before an inactive account is deleted) | E-mail address | Contract, Art. 6(1)(b) |
| Tips, news and offers by e-mail (newsletter) | E-mail address, language | Consent, Art. 6(1)(a), and Section 7 of Czech Act No. 480/2004 Coll. |
| Proving that you gave or withdrew consent | Consent record (see above) | Legal obligation to demonstrate consent, Art. 6(1)(c) and Art. 7(1) |
| Answering your messages | Messages, e-mail address | Legitimate interest in responding, Art. 6(1)(f) |
| Preventing abuse and enforcing free usage limits, keeping the service secure and fixing errors | Hashed IP address, account ID, technical logs | Legitimate interest, Art. 6(1)(f) |
| Measuring how many CVs the service produces and whether they come out usable | CVs created without an account, hashed IP address | Legitimate interest, Art. 6(1)(f); deleted after 30 days |
| Visit statistics and improving the product | Usage and device data | Legitimate interest, Art. 6(1)(f); you can opt out at any time |
| Running the affiliate program: partner accounts, statistics, commissions, notifications | Partner account data, referral code, commissions | Contract with the partner, Art. 6(1)(b) |
| Paying commissions and keeping payout and tax records | Payout details, payout records | Contract, Art. 6(1)(b); legal obligation (accounting and tax law), Art. 6(1)(c) |
| Crediting the partner who referred you | imr_ref cookie, the link between your account and the partner | Consent to cookies, Art. 6(1)(a); then our and the partner’s legitimate interest in correct commissions, Art. 6(1)(f) |
| Counting clicks on affiliate links and preventing fake clicks | Hashed IP address, click date and source | Legitimate interest, Art. 6(1)(f) |
| Measuring the results of our Google Ads campaigns | Cookie identifiers, conversion events | Legitimate interest / consent where required, Art. 6(1)(a),(f) |
| Measuring the results of our TikTok ads | Cookie identifiers, page views, checkout and purchase events (sent by our server, with your e-mail address and account ID hashed), IP address and device data | Consent to cookies, Art. 6(1)(a) |
| Telling a job seeker that the company opened their CV link, and showing them each opening | Time, length and extent of reading, PDF download, device type, country, hash of the IP address and browser | Legitimate interest of the job seeker and ours in knowing whether an application arrived, Art. 6(1)(f) |
We do not sell your personal data and we do not use your CV content to train AI models.
4. Who we share data with
We share data only with providers that help us run the service, each bound by a data processing agreement or equivalent terms:
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, authentication and file storage (CV photos) | Account data, CV content, usage data |
| Vercel | Hosting, server functions, cookieless page statistics (Vercel Analytics) | Technical request data, IP address |
| OpenAI | AI text generation and analysis | CV content and job descriptions you submit to an AI feature |
| Lemon Squeezy | Merchant of record: checkout, payments, invoices, tax, refunds | Purchase data |
| Resend | Sending e-mails | E-mail address, e-mail content |
| PayPal, Wise or your bank | Sending affiliate commissions to partners (as independent controllers under their own terms) | Partner’s name, payout e-mail or bank account, amount |
| Sign in with Google; Google Ads conversion measurement; web fonts | Account data (sign-in), cookie identifiers and IP address (ads, fonts) | |
| TikTok | TikTok ads measurement (TikTok pixel), only after you accept cookies | Cookie identifiers, page views, checkout and purchase events (sent by our server, with your e-mail address and account ID hashed), IP address and device data |
| Umami (via hithide.com) | Cookieless visit statistics | Page views, referrer, device data |
| Affonso | Affiliate referral tracking for partners in the Affonso program | Referral cookie identifier, visit data and IP address (with cookie consent), amount and customer ID of a credited purchase |
| ipapi.co | Looking up the approximate location of an IP address for visit statistics | IP address |
| Sentry | Error monitoring, when enabled | Technical error data, may include IP address |
We may also disclose data where the law requires it, for example to a court or public authority, or to protect our rights in a dispute.
Public web CV. If you publish your web CV or business card, anyone with the link can see the information you chose to publish, and search engines may index it. You can unpublish it at any time.
5. Transfers outside the EU
Some of the providers above (for example OpenAI, Vercel, Lemon Squeezy, Resend, Google and TikTok) are based in the United States or process data there. Such transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. You can ask us for more information about the safeguards used.
6. How long we keep data
- Account data and CV content: for as long as your account exists. When you ask us to delete your account, we delete it and its content within 30 days, apart from backups, which are overwritten in the normal backup cycle. We also delete accounts that nobody has used for 12 months (no sign-in, no change to a CV or the profile), together with their content. We always e-mail you first, at least 30 days before, and one click in that e-mail or signing in keeps the account.
- CVs created without an account: 30 days from the moment they were generated, then deleted automatically.
- Purchase and invoice records: for the period required by tax and accounting law (in the Czech Republic up to 10 years). Lemon Squeezy keeps its own records as the seller.
- Newsletter: until you unsubscribe, using the link in every e-mail or in your profile. An unconfirmed address gets only the confirmation e-mail and is deleted after 30 days. Records of giving and withdrawing consent: while you are subscribed and 3 years after, so we can show we had the right to write to you.
- Affiliate partner accounts: for as long as you take part in the program. Payout details and payout records: for the period required by accounting and tax law (in the Czech Republic up to 10 years after the payout).
- The link between a referred account and its partner: for as long as the account exists. The
imr_refcookie: 60 days, or until you decline cookies. Daily click counts per hashed IP address: no longer than 90 days. - Messages you send us: as long as needed to handle your request, and no longer than 3 years.
- Visit statistics with your IP address: no longer than 26 months.
- Daily usage counters: no longer than 90 days.
- Openings of a link for one company: until the user deletes the application or their account.
- Data processed by OpenAI: OpenAI may keep API inputs and outputs for up to 30 days to detect abuse, and does not use them to train its models.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected (most of it you can edit yourself in your profile and CV);
- have your data deleted;
- restrict how we process your data;
- receive your data in a portable, machine-readable format;
- object to processing based on our legitimate interest, including visit statistics;
- withdraw your consent at any time, without affecting processing that happened before;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We make no such decisions; AI results are suggestions for you to review.
To exercise any of these rights, write to info@inmyresume.com from the e-mail address linked to your account. We will answer within one month. We may ask you to confirm your identity first.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.
9. Security
All traffic to the service is encrypted with HTTPS. Access to your CVs and account in the database is restricted per user by row-level security rules, passwords are stored only as hashes, and only a small number of administrators can access production systems. No system is perfectly secure; if a breach affects your data and poses a risk to you, we will notify you and the supervisory authority as the law requires.
10. Children
The service is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We update this policy when the service or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you by e-mail or in the app before it takes effect.
