Privacy Policy

Last updated: 1 July 2026

Applicable law: Digital Personal Data Protection Act, 2023 ("DPDP Act"); Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

1. Who we are

Resume Truth is an AI-assisted resume analysis platform operated from India. In DPDP Act terms, we act as the Data Fiduciary for information you submit; you are the Data Principal.

2. Data we collect

• Account data: name, email, authentication tokens (Google OAuth or email/password).
• Resume content: the file you upload (PDF/DOC/DOCX) and every field extracted from it — name, contact info, employment history, education, skills, certifications, projects, achievements.
• Payment metadata: Razorpay order/payment IDs, amount, status. We do not store card, UPI, netbanking, or CVV data — Razorpay handles this as an RBI-authorised payment aggregator.
• Usage data: pages viewed, features used, IP address, browser, device, timestamps, coarse location (country/state), cookies, referrer.

3. Purpose and legal basis

We process data on the basis of your consent (Section 6, DPDP Act) and for the certain legitimate uses listed in Section 7, only for the following purposes:

• Generating your resume analysis, scores, rewrites, and CV Builder outputs;
• Processing your payments and issuing receipts;
• Providing customer support and grievance redressal;
• Complying with tax, accounting, and legal obligations;
• Detecting fraud, abuse and security incidents;
• Improving our AI models only on anonymised, aggregated data. We do not use your identifiable resume content to train third-party AI models.

4. Sharing with third parties

We share the minimum data necessary with:

• Cloud infrastructure & database — for storage and hosting;
• AI model providers (Lovable AI Gateway) — resume text is sent for analysis; providers are contractually barred from retaining prompts for training;
• Razorpay Software Pvt Ltd — for payment processing;
• Google (OAuth & Search Console) — for authentication and SEO analytics;
• Government / law enforcement — only when compelled by a valid legal order under Indian law.

We do not sell your data. We do not send your resume to any recruiter or employer without your explicit action.

5. Data retention

• Resumes and reports: retained while your account is active, up to a maximum of 5 resumes per user as enforced by our system.
• Payment records: retained for 8 years as required under the Income Tax Act, 1961 and GST law.
• Account data: retained until you request deletion.
• Backups: purged within 30 days of deletion.

6. Your rights under the DPDP Act

You have the right to:

• Access — obtain a copy of your personal data;
• Correction & erasure — correct or delete inaccurate data;
• Grievance redressal — file a complaint with our Grievance Officer;
• Nominate — designate a person to exercise rights on your behalf in case of death or incapacity;
• Withdraw consent at any time — this will not affect processing done before withdrawal.

To exercise any right, write to support@resumetruth.in. We will respond within the timelines mandated by the DPDP Act.

7. Security

We implement reasonable security practices in line with the SPDI Rules, 2011 and Section 8(5) of the DPDP Act, including:

• Transport encryption (HTTPS/TLS);
• At-rest encryption of stored files;
• Row-Level Security (RLS) so users can only access their own data;
• Role-based access controls for admin and support staff;
• Regular security audits and dependency scanning.

No system is 100% secure. In the event of a personal data breach we will notify affected users and the Data Protection Board of India as required under Section 8(6) of the DPDP Act.

8. Children

Our services are intended for users 18 years of age and older. We do not knowingly collect data from children. If you believe a child has submitted data, please contact us for immediate deletion.

9. International transfers

Data may be processed on cloud infrastructure located outside India as permitted under Section 16 of the DPDP Act. We ensure adequate contractual safeguards with all such processors.

10. Cookies

We use essential cookies for authentication and session management, and analytics cookies to understand usage. You may disable cookies in your browser; some features may not work as a result.

11. Grievance Officer (mandatory disclosure)

• Name: Resume Truth Grievance Officer
• Email: support@resumetruth.in
• Acknowledgement: within 24 hours
• Resolution: within 15 days as required under Rule 3(2) of the IT Rules, 2021 and Section 8(10) of the DPDP Act.

If you are unsatisfied you may escalate to the Data Protection Board of India established under the DPDP Act.

12. Changes

We may update this policy. Material changes will be notified by email or in-app notice. Continued use constitutes acceptance.