Privacy Policy

The data controller responsible for your personal data is Daniel Kasprzyk, who operates the Rezme service ("we", "us", "our"). Full business details and postal address: see the Legal Notice at /imprint.

Contact Information:

• Email: privacy@rezme.dev
• Website: https://rezme.dev

For users in the European Union, we process your data in compliance with the General Data Protection Regulation (GDPR) and applicable national data protection laws.

We collect the following categories of personal data:

Account Data:

• Email address
• Password (encrypted/hashed)
• Account creation date
• Subscription status and history

Profile Data:

• Full name
• Phone number (optional)
• Location/address (optional)
• Professional summary
• Work experience history
• Education history
• Skills and competencies
• Languages spoken
• Projects and achievements
• Certifications
• Profile picture (optional)

Usage Data:

• Log data (IP address, browser type, pages visited)
• Feature usage patterns
• CV generation history
• Application tracking data

Device & Security Data:

• Device fingerprint (a unique identifier generated from your browser and device characteristics)
• IP address at registration, login, and payment
• User agent (browser type and version)
• Terms of Service acceptance record: timestamp, version of the Terms accepted (the ‘Last updated’ date; not recorded for accounts created before 16 October 2026) and IP address

Payment Data (processed by Stripe):

• We do not store your payment card details
• Stripe processes and stores payment information
• We receive transaction confirmations and subscription status

We process your personal data for the following purposes:

Service Delivery:

• Creating and managing your account
• Generating customized CVs using AI
• Tracking your job applications
• Providing customer support

Service Improvement:

• Analyzing usage patterns to improve features
• Debugging and fixing technical issues
• Developing new features

Communications:

• Sending transactional emails (password reset, verification)
• Service updates and announcements
• Marketing communications (with your consent)

Legal Compliance:

• Responding to legal requests
• Enforcing our terms of service
• Fraud prevention and security
• Device fingerprinting to detect multi-account abuse and payment fraud
• IP address logging for chargeback dispute evidence (Visa Compelling Evidence 3.0)
• Payment card fingerprint tracking to detect card reuse across accounts

We process your data based on the following legal grounds:

Contract Performance (Article 6(1)(b)):

• Account creation and management
• CV generation services
• Subscription and billing
• Sign-in with Google or GitHub, if you choose that method

Legitimate Interests (Article 6(1)(f)):

• Service improvement based on server logs and aggregated statistics
• Security and fraud prevention
• Bot protection on sign-up, password reset, e-mail verification and waitlist forms (Cloudflare Turnstile)
• Customer support
• Device fingerprinting and IP logging for fraud prevention and chargeback defense

Consent (Article 6(1)(a)):

• Marketing communications
• Optional features and integrations
• Loading third-party content (YouTube, Instagram, TikTok) embedded in blog posts, only after you click "Load content"
• Product analytics (PostHog) and browser error monitoring (Sentry) — only after you click "Accept All" or enable "Analytics Cookies" under "Manage preferences" in the cookie banner; you can withdraw consent at any time via "Cookie Preferences" in the footer
• Cookies and similar technologies (non-essential)

Legal Obligation (Article 6(1)(c)):

• Tax and accounting requirements (Polish VAT Act Articles 112–112a, Tax Ordinance, Accounting Act)
• Responding to legal requests

We share your data with the following categories of recipients:

AI Processing - OpenAI:

• Purpose: CV and cover letter generation, CV parsing, match analysis, AI interview (including voice transcription) and safety moderation of text and profile photos
• Data shared: Profile information (including your name and professional history), job descriptions, and, depending on the feature, the text of a CV you upload for parsing (which may include contact details you put in it), your interview answers and your e-mail address (match analysis and AI interview); see our Data Retention Policy, Section 9
• Location: United States
• Safeguards: Standard Contractual Clauses (SCCs)

Payment Processing - Stripe:

• Purpose: Processing subscription payments
• Data shared: Email, payment information
• Location: United States
• Safeguards: Standard Contractual Clauses, PCI-DSS compliance

Email Services - Resend:

• Purpose: Transactional and service emails
• Data shared: Email address, name
• Location: United States
• Safeguards: Standard Contractual Clauses

Product Analytics - PostHog (only after your consent):

• Purpose: Understanding how the Service is used (page views, clicks on buttons and links, sign-up and conversion funnels) and improving it
• Data shared: Pseudonymous user ID, e-mail address and account role (after sign-in), device and browser data, IP address, pages visited and events; session recording (replay) is not used
• Location: PostHog EU cloud (eu.i.posthog.com), European Union; the provider is PostHog, Inc. (United States)
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)
• Loaded only after you give analytics consent; not loaded if you choose "Reject Non-Essential"

Error Monitoring - Sentry (only after your consent in the browser):

• Purpose: Detecting and fixing technical errors and performance problems
• Data shared: Error details and stack traces, browser type, page URL, performance traces and, only when an error occurs, a short replay of the moments before it with all text and inputs masked and media blocked (no routine session recording); we do not send IP addresses, cookies or request headers to Sentry by default. Our servers also report server-side errors to Sentry when this is configured; these reports may contain pseudonymous user identifiers (e-mail addresses are masked)
• Provider: Functional Software, Inc. (Sentry), United States
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)

Bot Protection - Cloudflare Turnstile (sign-up, password reset, e-mail verification and waitlist forms):

• Purpose: Protecting these forms against automated abuse (bots, fake sign-ups). Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in securing the Service and preventing fraud; you may object (see Section 8)
• Data shared: When one of these forms is shown, your browser loads a script from challenges.cloudflare.com, and Cloudflare receives your IP address, browser and device signals and the result of the challenge. When you submit the form, our server sends the challenge token and your IP address to Cloudflare to verify it. The script is not loaded on other pages
• Provider: Cloudflare, Inc., United States. For the verification itself Cloudflare acts as a processor on our behalf; for using signals to improve its bot detection Cloudflare acts as an independent controller under its own privacy policy (https://www.cloudflare.com/turnstile-privacy-policy/)
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)

Sign-In - Google (only if you choose "Sign in with Google"):

• Purpose: Letting you create an account or sign in with your Google account. Legal basis: Art. 6(1)(b) GDPR (providing the sign-in method you requested)
• Data shared: Google receives the data your browser sends when it loads Google's sign-in script and button (such as your IP address and browser data) and the details of your sign-in with Google. The script is loaded only on the sign-in and registration pages. From Google we receive a signed ID token and store only your Google account identifier and your verified e-mail address.
• Provider: Google Ireland Limited (for users in the EEA) and Google LLC, United States, acting as an independent controller under its own Privacy Policy (https://policies.google.com/privacy)
• Location: United States
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)

Sign-In - GitHub (only where offered and only if you choose "Sign in with GitHub"):

• Purpose: Letting you create an account or sign in with your GitHub account. Legal basis: Art. 6(1)(b) GDPR (providing the sign-in method you requested)
• Data shared: If you choose it, you are sent to github.com to authorise the sign-in. Our server then exchanges the authorisation code with GitHub and retrieves your GitHub account identifier and your verified e-mail address; we store only these two items. Nothing is sent to GitHub if you do not choose this option
• Provider: GitHub, Inc. (Microsoft), acting as an independent controller under its own privacy statement
• Location: United States
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)

Embedded Content - YouTube (Google), Instagram (Meta), TikTok (only after you click "Load content"):

• Purpose: Showing videos and posts embedded in some blog posts. Legal basis: Art. 6(1)(a) GDPR, your consent given by clicking "Load content" for that one item (also the consent required for access to your device under Article 399 of the Polish Electronic Communications Law)
• Before you click, nothing is requested from these providers: the post shows only a placeholder, with no iframe, script or preview image. We do not remember your choice, so each item must be loaded separately and again on each visit
• Data shared: After you click, your browser contacts the provider and sends your IP address and browser data, and the provider may set cookies or similar identifiers. YouTube videos are loaded from the privacy-enhanced domain youtube-nocookie.com
• Provider: Google Ireland Limited (YouTube), Meta Platforms Ireland Limited (Instagram) and TikTok Technology Limited and TikTok Information Technologies UK Limited (TikTok), each acting as an independent controller under its own privacy policy
• Location: depends on the provider and may include the United States
• Safeguards: the provider may transfer data to a third country, including the United States; where the provider is certified under the EU-U.S. Data Privacy Framework, the basis is the Commission's adequacy decision (Art. 45 GDPR); in other cases, by loading the content you give your explicit consent to such a transfer (Art. 49(1)(a) GDPR), aware that in a third country your data may not enjoy a level of protection equivalent to the GDPR

AI Processing - Anthropic (PLANNED, NOT ACTIVE):

• Status: our software can use Anthropic as an alternative AI provider, but it is not configured and no data is sent to Anthropic. It will only be enabled after a data processing agreement and a Chapter V transfer mechanism are in place; this policy will be updated before that happens
• Purpose: CV content generation and customization
• Data shared: Profile information, job descriptions. Legal basis: Art. 6(1)(b) GDPR
• Location: United States
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)

AI Portrait Generation - Replicate (PLANNED, NOT ACTIVE):

• Status: the AI portrait feature is switched off and no photos are sent to Replicate. It will only be enabled after Replicate has signed a data processing agreement with standard contractual clauses for the transfer to the United States; this policy will be updated before that happens
• Purpose: Generating AI profile portraits, only when you use the portrait feature
• Data shared: The photo(s) you upload (which show your face) and the generation settings you choose
• Note: the photo is used only to generate a stylized portrait that resembles you. We do not use it to identify or authenticate you or anyone else, and we do not run face recognition or build a face database; the AI model uses the face only to preserve your likeness in the generated image. Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested)
• Location: United States
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)

AI Portrait Generation - FAL.ai (PLANNED, NOT ACTIVE):

• Status: FAL.ai is an alternative provider for the AI portrait feature. It is switched off together with that feature and no photos are sent to FAL.ai. It will only be enabled after a data processing agreement and a Chapter V transfer mechanism are in place; this policy will be updated before that happens
• Purpose: Generating AI profile portraits, only when you use the portrait feature. Legal basis: Art. 6(1)(b) GDPR
• Data shared: The photo(s) you upload (which show your face), used only as described for Replicate above
• Location: United States
• Safeguards: transfer mechanism under Chapter V GDPR (see Section 6)

Hosting - Hetzner:

• Purpose: Hosting of the application, database and backups (data processor)
• Data shared: All data described in Section 2 that is stored in the Service
• Location: Hetzner Online GmbH data centre in the EU/EEA (Germany or Finland)
• Safeguards: Data processing agreement under Article 28 GDPR; no transfer outside the EEA by this provider

We do not sell your personal data to third parties.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States.

For transfers to the United States:

• We rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR) where the recipient is certified under it, and otherwise on Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46 GDPR)
• We conduct Transfer Impact Assessments where required
• We implement supplementary technical measures (encryption, pseudonymization)

We ensure that any international transfer of your data is subject to appropriate safeguards in accordance with GDPR Chapter V. You can obtain a copy of the safeguards by contacting privacy@rezme.dev.

We retain your data for the following periods:

Active Accounts:

• Account and profile data: Until you delete your account
• Generated CVs: Until you delete them or your account
• Usage logs: 90 days

After Account Deletion:

• Backup data: Encrypted backups are kept for up to 90 days; if we ever restore from a backup, we delete again any accounts that were deleted before
• Anonymized analytics: Indefinitely
• Legal/tax records: as a rule 5 years from the end of the relevant calendar year (see Data Retention Policy)

Records Kept After Account Deletion (pseudonymised, not anonymised):

• When your account is hard-deleted, your profile, CVs, contact data and e-mail are erased. We keep one small record that is PSEUDONYMISED, not anonymised: your user ID is replaced by a keyed hash (HMAC-SHA256 with a secret key held only by us). It contains no e-mail address or name, but because we can still re-create the hash it remains personal data and the GDPR continues to apply to it
• Exactly what is kept: the pseudonym; the date your account was deleted; the time you accepted the Terms of Service, the version of the Terms you accepted and the IP address from which you accepted them, and the record of your separate consent to immediate performance (time and version) — until the end of the calendar year in which 6 years from acceptance or consent respectively elapse (limitation period for claims, Article 118 of the Polish Civil Code), i.e. at most 7 years; your device fingerprint and the date it was last collected (18 months from the last time it was collected); your payment card fingerprints (a Stripe identifier, not the card number) and the time of your last transaction (18 months from that transaction)
• Purposes: defence of legal claims (e.g. chargeback or consumer disputes), proof of your acceptance of the Terms, and fraud prevention
• Legal basis: Article 17(3)(e) GDPR (erasure does not apply to the extent processing is necessary for the establishment, exercise or defence of legal claims) and our legitimate interest under Article 6(1)(f) GDPR
• The 18-month periods (device fingerprint, card fingerprints) are our own policy: we set them to cover the time limits for raising and resolving chargeback disputes in the card networks; they are not prescribed directly by law.
• You may object to this processing (Article 21(1) GDPR); we will comply unless we demonstrate compelling legitimate grounds or the need to establish, exercise or defend legal claims.
• Each item is deleted automatically when its period ends
• Erasure log: when we delete your account we keep an internal log entry containing only your internal account identifier (a random ID) and the date of deletion — no e-mail, name or content — for up to 400 days, longer than our longest backup retention, solely so that if we ever restore the database from a backup made before your deletion we can delete your account again immediately. Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 5(2), 24(1) and 17(1) GDPR (our obligation to erase effectively and to be able to demonstrate that the erasure was carried out, including after a restore from backup) and, in addition, our legitimate interest under Article 6(1)(f) GDPR in making sure a deleted account cannot “come back” from a backup. Copies are kept in our encrypted backups for the same period
• IP addresses and user agent strings stored with generation records are deleted with the account. The only IP address we keep is the one recorded when you accepted the Terms (see above)
• Stripe: before we delete your customer profile in Stripe we unset the IP address, user agent and device fingerprint that we attached as metadata to your checkout sessions and subscriptions (where Stripe allows it; checkouts never linked to your profile cannot be reached). Stripe, as an independent controller of payment data, may retain transaction records (including checkout-session and subscription records together with the metadata we passed to it: our internal user ID, the record of your express consent to immediate performance and, where it could not be removed, the IP address, user agent and device fingerprint) for as long as the law it is subject to requires and for dispute handling — see the Stripe Privacy Policy (https://stripe.com/privacy). Invoices and payment records also stay in our accounting records for the period required by Polish accounting and tax law, with direct identifiers removed from our own database
• PostHog: if you consented to analytics, we instruct PostHog to delete your analytics profile together with the associated events; PostHog processes deletions asynchronously, so this may take some time. We do not record sessions in PostHog, so there are no PostHog recordings to delete. If the request fails we retry it automatically for 90 days

Inactive Accounts:

• We may delete accounts inactive for more than 24 months after notification

Under GDPR, you have the following rights:

Right of Access (Article 15):

• Request a copy of your personal data
• Understand how we process your data

Right to Rectification (Article 16):

• Correct inaccurate personal data
• Complete incomplete data

Right to Erasure (Article 17):

• Request deletion of your personal data
• "Right to be forgotten"

Right to Restriction (Article 18):

• Limit how we process your data

Right to Data Portability (Article 20):

• Receive your data in a structured format
• Transfer data to another service

Right to Object (Article 21):

• Object to processing based on legitimate interests
• Object to direct marketing

Rights Related to Automated Decision-Making (Article 22):

• Not be subject to solely automated decisions
• Request human review of AI-generated content

To exercise your rights:

• Use the account settings in your dashboard
• Contact us at privacy@rezme.dev
• We will respond within one month (extendable by two further months in complex cases, of which we will inform you)

We distinguish between technologies that are necessary to provide the Service and those that require your consent. Under Article 399 of the Polish Electronic Communications Law, we store information on your device or access it only after informing you of the purpose and obtaining your consent, except where this is necessary to provide a service you explicitly requested.

Strictly Necessary (no consent required):

• Authentication tokens (localStorage) and session management
• Security features
• Device fingerprint (generated once, stored locally for fraud prevention)
• Your cookie consent choice, theme and language preferences (including the first-party cookie rezme_lang)

Third-Party Cookies (Stripe):

• Fraud prevention cookies set by Stripe during checkout
• These are necessary for payment security

Embedded Content (YouTube, Instagram, TikTok) — only with your click:

• Blog posts may contain videos or posts from these providers. Until you click "Load content" for an item, nothing is requested from the provider. After you click, the provider receives your IP address and may set its own cookies; YouTube is loaded from youtube-nocookie.com. We do not remember your choice. See Section 5

Analytics and Monitoring (only with your consent):

• PostHog (product analytics) — may store an identifier in your browser's localStorage and cookies
• Sentry (error monitoring and performance traces)
• Web Vitals (performance measurements)
• These are activated only after you click "Accept All" or enable "Analytics Cookies" under "Manage preferences" in the cookie banner. If you choose "Reject Non-Essential", they are not loaded. You can change or withdraw your choice at any time via "Cookie Preferences" in the footer; withdrawal does not affect the lawfulness of processing carried out before it.

We do NOT use:

• Google Analytics or other advertising/marketing cookies
• Social media tracking pixels

For more details, please see our Cookie Policy at /cookies.

Our Service is not intended for children under 16 years of age.

We do not knowingly collect personal data from children under 16. If we discover that we have collected data from a child under 16 without parental consent, we will delete it promptly.

If you believe we have collected data from a child under 16, please contact us at privacy@rezme.dev.

We implement appropriate technical and organizational measures to protect your data:

Technical Measures:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Secure password hashing (PBKDF2)
• Regular security updates and patches

Organizational Measures:

• Access controls and authentication
• Employee security training
• Incident response procedures
• Regular security assessments

Despite our efforts, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but will notify you of any breaches as required by law.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

We will notify you of material changes by:

• Posting the updated policy on our website
• Sending an email notification
• Displaying a notice in the application

The "Last updated" date at the top indicates when the policy was last revised.

For privacy-related inquiries:

• Email: privacy@rezme.dev
• Response time: Within one month (extendable by two further months in complex cases, of which we will inform you)

Data Protection Authority: If you are in Poland, you have the right to lodge a complaint with:

UODO (Urząd Ochrony Danych Osobowych) ul. Stawki 2 00-193 Warszawa https://uodo.gov.pl

For other EU countries, you may contact your local data protection authority.

Consumer disputes: The EU Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025 (Regulation (EU) 2024/3228). If you are a consumer in Poland, you can seek help from the Office of Competition and Consumer Protection (UOKiK, https://uokik.gov.pl) or a county (city) consumer ombudsman (powiatowy/miejski rzecznik konsumentów).