Data Retention Policy

This Data Retention Policy describes how long Rezme ("we", "us") retains your personal data and the criteria used to determine retention periods. This policy supports our obligations under the General Data Protection Regulation (GDPR) and other applicable data protection laws.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

While your account is active, we retain all data associated with your account:

Profile Information:

• Name, email, phone, location, summary — retained for the lifetime of your account
• Profile image — retained until you replace or delete it
• Professional history (experiences, education, skills, languages, projects, certifications) — retained for the lifetime of your account

Job Applications:

• Job application records and status history — retained for the lifetime of your account
• Generated CVs and cover letters — retained for the lifetime of your account
• Match analysis results — retained for the lifetime of your account

Templates:

• Custom resume templates — retained for the lifetime of your account
• Template configurations and layouts — retained for the lifetime of your account

Authentication Tokens:

• JWT access tokens — expire after 15 minutes, not stored server-side
• Refresh tokens — 7 days, rotated on each use, revoked on sign-out
• Password reset tokens — expire after 60 minutes, single-use

Security Records:

• Failed login attempts — reset after 15-minute lockout period
• Account lockout records — cleared after lockout expires

Session Data:

• Active sessions are terminated on sign-out
• Inactive sessions expire based on refresh token lifetime (7 days)

Consent and Fraud Prevention Records:

• Device fingerprint — retained for 18 months from the last time it was collected
• Payment card fingerprints (from Stripe) and the time of the last transaction — retained for 18 months from the last transaction
• The 18-month periods (device fingerprint, card fingerprints) are our own policy: we set them to cover the time limits for raising and resolving chargeback disputes in the card networks; they are not prescribed directly by law.
• Terms of Service acceptance (timestamp, accepted version, IP address) — retained until the end of the calendar year in which 6 years from acceptance or consent respectively elapse (limitation period for claims, Article 118 of the Polish Civil Code), i.e. at most 7 years. For accounts created before 16 October 2026 the version was not recorded
• IP addresses and user agent strings stored with generation records — deleted with your account

Note: After account deletion we keep only the following, in PSEUDONYMISED (not anonymised) form — your user ID replaced by a keyed HMAC-SHA256 hash, no e-mail or name: the pseudonym, the date of account deletion, Terms acceptance time + version + IP address and the record of your separate consent to immediate performance (time + version, copied from Stripe) — until the end of the calendar year in which 6 years from acceptance or consent respectively elapse (limitation period for claims, Article 118 of the Polish Civil Code), i.e. at most 7 years; device fingerprint with the date it was last collected (18 months); and card fingerprints + time of last transaction (18 months). Purposes: defence of legal claims, proof of acceptance of the Terms and fraud prevention. Legal basis: GDPR Article 17(3)(e) and Article 6(1)(f). You may object to this processing (Article 21(1) GDPR); we will comply unless we demonstrate compelling legitimate grounds or the need to establish, exercise or defend legal claims. Each item is deleted automatically when its period ends.

Subscription Records:

• Active subscription details — retained for the lifetime of your account
• Subscription change history — retained as the payment records below (tax/accounting requirements)

Payment Records:

• Payment transaction records — retained until the tax liability becomes time-barred, i.e. as a rule 5 years counted from the end of the calendar year in which the tax payment deadline fell (Articles 112 and 112a of the Polish VAT Act, read with the Polish Tax Ordinance and Accounting Act); this period may be extended if the limitation period is suspended or interrupted
• Invoice data — retained until the tax liability becomes time-barred, i.e. as a rule 5 years counted from the end of the calendar year in which the tax payment deadline fell (Articles 112 and 112a of the Polish VAT Act, read with the Polish Tax Ordinance and Accounting Act); this period may be extended if the limitation period is suspended or interrupted
• Stripe customer record — retained for the lifetime of your account; deleted at Stripe on account deletion (invoices and charges may remain in Stripe in accordance with its privacy policy)

Usage Records:

• AI generation token usage — retained for 90 days
• CV upload parsing records (file name, size, token counts) — 90 days
• Feature usage analytics — retained for 12 months in anonymized form

CV Generation:

• Generated CV content — retained for the lifetime of your account
• Generation configuration and parameters — retained for the lifetime of your account

Cover Letters:

• Generated cover letter content — retained for the lifetime of your account

AI Interview Sessions and Generation Progress (temporary data):

• Interview session data and conversation history — kept in temporary storage and deleted automatically 24 hours after the last activity in the session
• Progress and status records of CV, cover letter and portrait generations — deleted automatically after 24 hours
• AI input-moderation counters (the number of inputs rejected per day) — deleted automatically after 48 hours, and immediately when your account is erased
• Interview coaching feedback — retained for the lifetime of your account

AI Portraits:

• Generated portrait images — retained for the lifetime of your account
• Portrait generation history — retained for 12 months

When you delete your account (via Settings > Delete Account):

Immediately Deleted:

• Profile information (name, email, phone, location, summary)
• Professional history (experiences, education, skills, etc.)
• Job application records and match analysis
• Custom templates and configurations
• AI-generated content (CVs, cover letters, portraits)
• Interview sessions and messages
• Authentication tokens and sessions
• Cookie consent preferences

Retained After Deletion:

• Payment transaction records — retained until the tax liability becomes time-barred, i.e. as a rule 5 years counted from the end of the calendar year in which the tax payment deadline fell (Articles 112 and 112a of the Polish VAT Act, read with the Polish Tax Ordinance and Accounting Act); this period may be extended if the limitation period is suspended or interrupted, with personal identifiers removed
• Anonymized usage statistics — retained indefinitely for service improvement
• Application log files that may contain your user ID are kept for at most 30 days; container console logs are rotated by size and overwritten
• Consent and fraud prevention ledger, PSEUDONYMISED (not anonymised; no e-mail, no name, user ID replaced by a keyed hash): pseudonym; date of account deletion; Terms acceptance time + version + IP address and record of your separate consent to immediate performance (time + version) — until the end of the calendar year in which 6 years from acceptance or consent respectively elapse (limitation period for claims, Article 118 of the Polish Civil Code), i.e. at most 7 years; device fingerprint + date it was last collected — 18 months; card fingerprints + time of last transaction — 18 months. The 18-month periods (device fingerprint, card fingerprints) are our own policy: we set them to cover the time limits for raising and resolving chargeback disputes in the card networks; they are not prescribed directly by law. Purposes: defence of legal claims, proof of acceptance of the Terms, fraud prevention. Legal basis: GDPR Article 17(3)(e) and Article 6(1)(f). You may object to this processing (Article 21(1) GDPR); we will comply unless we demonstrate compelling legitimate grounds or the need to establish, exercise or defend legal claims.
• Erasure log: when we delete your account we keep an internal log entry containing only your internal account identifier (a random ID) and the date of deletion — no e-mail, name or content — for up to 400 days, longer than our longest backup retention, solely so that if we ever restore the database from a backup made before your deletion we can delete your account again immediately. Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 5(2), 24(1) and 17(1) GDPR (our obligation to erase effectively and to be able to demonstrate that the erasure was carried out, including after a restore from backup) and, in addition, our legitimate interest under Article 6(1)(f) GDPR in making sure a deleted account cannot “come back” from a backup. Copies are kept in our encrypted backups for the same period
• Stripe: before we delete your customer profile in Stripe we unset the IP address, user agent and device fingerprint that we attached as metadata to your checkout sessions and subscriptions (where Stripe allows it; checkouts never linked to your profile cannot be reached). Stripe, as an independent controller of payment data, may retain transaction records (including checkout-session and subscription records together with the metadata we passed to it: our internal user ID, the record of your express consent to immediate performance and, where it could not be removed, the IP address, user agent and device fingerprint) for as long as the law it is subject to requires and for dispute handling — see the Stripe Privacy Policy (https://stripe.com/privacy)
• PostHog: if you consented to analytics, we instruct PostHog to delete your analytics profile together with the associated events; PostHog processes deletions asynchronously, so this may take some time. We do not record sessions in PostHog, so there are no PostHog recordings to delete. If the request fails we retry it automatically for 90 days

Deletion Timeline:

• Account data is soft-deleted immediately upon request
• Hard deletion (permanent removal from database) occurs within 30 days
• Backups are encrypted and kept for up to 90 days; if we ever restore from a backup, we delete again any accounts that were deleted before

Before deleting your account, you can export all your personal data:

• Go to Settings > Data Subject Requests (GDPR)
• Select "Right of Access" or "Right to Data Portability"
• Your data will be downloaded as a JSON file

The export is complete: it includes your profile, professional history, certifications, subscription and payment history, job applications, generated CVs and cover letters, match analyses, and usage records — everything we hold about you, as required by GDPR Articles 15 and 20.

Database and file backups:

• Daily automated backups — retained for 7 days on the server and off-site
• Weekly backups — retained off-site for 28 days
• Monthly backups — retained off-site for up to 90 days
• Pre-deployment backups — the last 10 deployments, never older than 90 days
• Backups are encrypted (age) before they are stored or copied off-site

Backups are encrypted and kept for up to 90 days; if we ever restore from a backup, we delete again any accounts that were deleted before.

We use third-party services that may retain data according to their own policies:

• Stripe (payments) — see https://stripe.com/privacy
• OpenAI (AI features) — acts as our processor (see Privacy Policy, Section 5). We send it the content needed for the feature you use: your profile (name, professional summary, work history, education, skills and projects), job descriptions, the text of a CV you upload for parsing (which may include contact details you put in it) and your interview answers (typed, or audio for voice transcription). Match analysis and the AI interview also send your e-mail address, and match analysis also your location. CV and cover letter generation do not send your e-mail address or phone number. For safety moderation, text you enter and profile photos you upload are also checked with OpenAI. See https://openai.com/privacy
• Resend (emails) — transactional email logs retained for 30 days
• Google (OAuth) — see https://policies.google.com/privacy

We do not control third-party retention periods. We minimize data shared with third parties to what is strictly necessary for service operation.

For questions about data retention or to request data deletion:

Email: privacy@rezme.dev Website: https://rezme.dev/dashboard/settings (Data Subject Requests section)

You may also exercise your GDPR rights by contacting us directly. We will respond within one month (extendable by two further months in complex cases, of which we will inform you).