Privacy Policy
Last updated: · Wersja polska (wiążąca)
This policy explains what personal data RezuYes (formerly Rezumator) processes, why, on what legal basis and for how long, who receives it and what your rights are (Art. 13 GDPR). The Polish version (Polityka prywatności) is binding.
1. Controller
The controller is [UZUPEŁNIJ: imię i nazwisko], a sole trader registered in Poland in the Central Register and Information on Economic Activity (CEIDG) under the business name [UZUPEŁNIJ: firma (nazwa działalności z CEIDG)], [UZUPEŁNIJ: adres (ulica, kod pocztowy, miasto)], Poland, tax ID (NIP) [UZUPEŁNIJ: NIP], VAT ID PL[UZUPEŁNIJ: NIP], REGON [UZUPEŁNIJ: REGON]. Contact for all data-protection matters: [UZUPEŁNIJ: e-mail kontaktowy]. No data protection officer has been appointed.
2. Purposes, legal bases, data and retention
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Generating the Preview, the Correction and the content (CV, LinkedIn copy, interview questions) – providing the electronic service | Your description, the text of your existing CV, your LinkedIn profile text, the job posting, your Correction instructions, the optional photo, the generated content, language, chosen design | Art. 6(1)(b) (contract) | Unpaid CVs: 30 days after generation. Paid CVs: 12 months after purchase (so you can download them again) |
| Sale, payment and delivery of the digital content | E-mail, package, amount, currency, country (from Stripe), payment session ID, access tokens, remaining generations, date and time of your consent to immediate delivery | Art. 6(1)(b) (contract) | 5 years from the end of the calendar year of the purchase |
| VAT invoices, tax and accounting | Invoice details (tax ID, company name, address), e-mail, amount, date, invoice number | Art. 6(1)(c) (legal obligation – Polish VAT Act, Tax Ordinance, accounting rules) | 5 years from the end of the calendar year in which the tax obligation arose |
| Proving the withdrawal-right waiver, handling complaints, establishing, pursuing or defending claims | Order data, consent timestamp, correspondence | Art. 6(1)(f) (legitimate interest); for complaints also Art. 6(1)(c) | Until the limitation period for claims expires (generally 6 years; 3 years for periodic and business-related claims) |
| Daily free-preview limit, protection against abuse and bots | A salted SHA-256 hash of your IP address and a per-day counter; optionally a Cloudflare Turnstile token | Art. 6(1)(f) (security, abuse prevention) | Up to 7 days. The IP address itself is not stored in the database |
| Contact and replies to your messages | E-mail and the content of the correspondence | Art. 6(1)(f) | Until the matter is closed, then until any claims become time-barred |
| Operation and security of the site (hosting logs) | IP address, date and time, page address, browser type | Art. 6(1)(f) | Briefly, as configured by the hosting provider |
Providing data is voluntary. Without any information about you we cannot generate a CV (we then show a sample demo CV); without an e-mail address you cannot place an order; without invoice details we cannot issue an invoice.
CV files uploaded for reading (.pdf, .docx) are processed on the server only to extract their text and are not stored; .txt and .md files are read in your browser.
Please do not enter special-category data (e.g. about health, religion or political opinions) or other people's data unless it is necessary. If your CV contains third-party data (e.g. references), you are responsible for having a basis to share it.
3. Photo (optional)
Adding a photo is optional. The photo is cropped to a square and compressed in your browser – the original file never leaves your device. The reduced version (JPEG) is sent to our server and stored with the CV data so that it can appear in the chosen design, in the PDF and in the e-mail attachment. The photo is not sent to the AI model and is not used for facial recognition or any other biometric identification. It is kept as long as the CV it belongs to (section 2).
4. Processing by artificial intelligence
To generate the content we send your description, existing CV text, LinkedIn profile text, the job posting and – for a Correction – your instructions and the current CV text (without the photo) to the API of Anthropic PBC (a Claude-family model). Anthropic acts as a processor under its commercial terms and data processing addendum. According to Anthropic, inputs and outputs of its commercial products, including the API, are not used to train its models by default; Anthropic may retain them for a limited period under its retention policy (e.g. to detect abuse).
The content is generated automatically and may contain mistakes – check it before sending it to an employer (see the Terms, section 15).
5. Recipients and processors
| Recipient | Role | Location |
|---|---|---|
| Anthropic PBC | Content generation by the AI model (processor) | USA |
| PostHog Inc. (EU Cloud, Frankfurt) | Cookieless usage statistics (no CV content, no contact details) | EU (Germany); USA for support access |
| Stripe Payments Europe, Limited (and Stripe group companies) | Payment processing, fraud prevention, VAT calculation where enabled; Stripe is a separate controller for payment data | Ireland / USA |
| Supabase, Inc. | Database (processor) | Data region: [UZUPEŁNIJ: region Supabase, np. EU Central (Frankfurt)]; US company |
| Vercel Inc. | Hosting, server-side code, PDF generation (processor) | USA / global edge network |
| Resend | Sending e-mails with your files (processor) | USA |
| inFakt sp. z o.o. | Issuing and sending VAT invoices (processor) | Poland |
| Cloudflare, Inc. | Turnstile bot check – only when enabled (processor) | USA / global network |
| Google (Google Fonts) | Font delivery – your browser loads fonts from Google's servers, which receive your IP address | Ireland / USA |
| [UZUPEŁNIJ: accounting office, if any] | Bookkeeping | Poland |
Data may be disclosed to public authorities where the law requires it. We do not sell your data or share it for marketing.
6. Transfers outside the EEA
Some recipients (Anthropic, Vercel, Resend, Cloudflare, Supabase, Stripe, Google) are based in the USA or may process data there. Transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) for certified recipients (list: dataprivacyframework.gov) and otherwise on the Commission's Standard Contractual Clauses (Decision 2021/914, Art. 46(2)(c) GDPR) with supplementary measures. You can request a copy of the safeguards at [UZUPEŁNIJ: e-mail kontaktowy].
7. Your rights
You have the right of access and to a copy (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). As there are no accounts, please give us the e-mail used for the purchase or the link to your CV so we can find your data. We reply within one month. Data we must keep under tax law is deleted when the required period ends.
You may lodge a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl – or with the authority in the country where you live or work.
8. Profiling and automated decisions
We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The AI model writes document text at your request; the job-match score is for information only. We do not profile users for marketing.
9. Cookies and local storage
The Service sets no tracking or advertising cookies and stores no analytics identifiers on your device. Your browser's local storage holds only what is needed to provide the service you ask for:
dcv.history– your list of CVs (ID, company, job title, date, language, match score);dcv.tokens– access tokens for your paid CVs;dcv.pass– your "5 attempts" pass;dcv.template– the chosen CV design;rezumator:builder– the draft of the "build a CV from scratch" form (may contain the contact details and work history you typed).
This data stays on your device and is sent to us only with actions you take yourself. You can delete it in your browser settings. Storing it is strictly necessary for the service, so no consent is required (Art. 5(3) of Directive 2002/58/EC; Art. 399(3) of the Polish Electronic Communications Law). The Stripe Checkout page (stripe.com) and, when enabled, Cloudflare Turnstile may use their own cookies or similar technologies under their own policies.
Usage statistics. We use PostHog (PostHog Inc., data hosted in the EU – Frankfurt) in cookieless mode to understand how the Service is used, e.g. how many people generate a preview and how many buy. Nothing is stored on your device. PostHog receives the pages you visit, clicks on buttons and links, technical data (browser, device type, approximate country) and your IP address, from which only a hash that changes every day is kept to count unique visitors. We never send it the content of your CV, your name, e-mail or phone number, and session recording is off. Legal basis: our legitimate interest in measuring and improving the Service (Art. 6(1)(f) GDPR); you can object at any time by writing to us or by blocking the script in your browser.
10. GDPR clause in your generated CV
Each generated CV includes, at the bottom, a consent clause for the processing of personal data in recruitment. It concerns processing by the employer you send the CV to – not by RezuYes.
11. Security
Measures include: encrypted HTTPS connections; server-side masking of the Preview; a database reachable only from our server (no public browser access); random access tokens for paid content; storing IP addresses only as a salted hash; data minimisation (e.g. the photo is compressed in your browser). Card data is handled only by Stripe.
12. Minors
The Service is intended for adults. A minor may make a purchase with the consent of a parent or legal guardian.
13. Changes and contact
We will announce material changes to this policy in the Service. Questions and requests about your data: [UZUPEŁNIJ: e-mail kontaktowy].