Resumate ("we", "us"), trading as Serreli IT, places great value on the protection of your personal data. In this privacy policy we explain what data we collect, why we do so, and what your rights are.
This policy applies to all services of Resumate, including our AI-powered resume builder web application.
Contact details:
Email: support@getresumate.com
Chamber of Commerce: 99363550
Last updated: January 2, 2026
2. What personal data do we collect?
2.1 Account data
Email address
Name (first and last name)
Profile photo (optional)
Unique user ID
2.2 Resume data
Personal information (name, email, phone number, location)
Work experience (company, position, period, description)
Education (institution, degree, period)
Skills
Certificates and courses
Profile photo (optional)
2.3 Cover letter data
Job postings (via URL or manually pasted)
Resume content used for generation
Generated cover letters
Metadata (company name, job title, date)
Usage statistics (number of generations per 24 hours for rate limiting)
Note: Cover letters are generated with AI and stored until you delete them. This feature is only available for active subscribers.
2.4 Payment data
Stripe Customer ID (no direct payment details)
Subscription status and type
Transaction history (via Stripe)
Note: We do not store credit card numbers or bank details. All payments are processed by Stripe.
2.5 Technical data
IP address (for security)
Browser type and version
Usage statistics (anonymous)
3. Why do we process your data?
3.1 Legal basis
We process your personal data based on:
Contract performance : to provide our services (Article 6(1)(b) GDPR)
Consent : for AI optimization and newsletter (Article 6(1)(a) GDPR)
Legitimate interest : for analysis and service improvement (Article 6(1)(f) GDPR)
3.2 Purposes
Generating and storing your resumes
AI optimization of resume content (with your consent)
Generating personalized cover letters via AI
Rate limiting for cover letter generations (anti-abuse)
Subscription management and billing
Customer service and support
Improving our services
Compliance with legal obligations
4. AI Processing and OpenAI
Important: For AI optimization of your resume and cover letter generation, we use OpenAI's API (GPT-4o model).
4.1 What happens?
Your resume data is sent to OpenAI (with your consent) for optimization
For cover letters, your resume content + job posting is sent to OpenAI
OpenAI generates improved content for your resume and personalized cover letters
OpenAI retains this data for no longer than 30 days (per their policy)
OpenAI does not use your data for training their models
4.2 Your control
AI optimization is optional
Cover letter generation is only available for active subscribers
Rate limiting: maximum 5 cover letters per 24 hours (anti-abuse)
You can stop using AI features at any time
You can edit resumes manually without AI
All generated cover letters can be deleted from your account
More information about OpenAI's privacy: https://openai.com/policies/privacy-policy
5. Security of Your Data
5.1 Encryption technology
We employ a multi-layer encryption strategy for maximum security and GDPR compliance:
5.1.1 Database Encryption (End-to-End for sensitive resume data)
Algorithm : AES-256 (Advanced Encryption Standard) via CryptoJS
Which data : All sensitive personal information is encrypted before being stored in the database:
Personal data: name, email address, phone number, location, profile photo
Work experience: company name, job title, job description
Privacy guarantee : Even database administrators cannot read your personal data without the encryption key
Automatic decryption : When you log in, your data is automatically decrypted so you can view and edit it
Benefit : Maximum privacy. Data is unreadable at rest in the database.
5.1.2 Object Storage Encryption
Algorithm : AES-256-GCM (Galois/Counter Mode)
Where : All files in Replit Object Storage (resume previews, uploaded files)
Features :
16-byte random Initialization Vector (IV) per file
Authentication tags for data integrity verification
256-bit encryption key via SHA-256 key derivation
Benefit : Additional layer of protection for stored files
5.1.3 Database Infrastructure Encryption
Provider : Neon PostgreSQL (managed database)
Method : Encryption-at-rest (database files are encrypted on disk)
Transport : SSL/TLS encrypted connections
Additional layer : On top of our own AES-256 encryption of sensitive fields
5.1.4 What is NOT encrypted?
Metadata : User ID, resume ID, creation date, last modified
Reason : This data is needed for database queries and does not contain sensitive information
Template choice : Your template selection is not sensitive
5.2 Transport Security
HTTPS Only : All connections via TLS 1.3 (latest version)
HSTS : HTTP Strict Transport Security to prevent downgrade attacks
Certificate Pinning : SSL certificate validation
5.3 Access Control & Monitoring
Least Privilege : Minimal access rights per system component
Authentication : Supabase JWT-based auth with Row Level Security (RLS)
Audit Logging : All database changes are logged
Automated Backups : Daily encrypted backups with 30-day retention
5.4 Payment Data
No card data storage : We never store credit card numbers, CVV codes or bank details
Stripe PCI-DSS Level 1 : Highest security for payment processing
Tokenization : Only Stripe Customer ID is stored for subscription management
5.5 Organizational measures
Minimal access to personal data (need-to-know basis)
Regular security audits and penetration testing
Privacy by design and by default principles
Incident response plan for data breaches
Authorized personnel training on GDPR and security best practices
Technical Details:
For transparency: our encryption implementation uses crypto-js with AES-256 for database field-level encryption and Node.js native crypto module with AES-256-GCM for Object Storage encryption. All encryption keys are securely managed via environment variables and never stored in code. The encryption key for database encryption is at least 256-bit and is tested at every server startup to ensure correct operation.
6. Retention Period
Account data : As long as your account is active
Resumes : As long as your account is active, or until you delete them
Cover letters : As long as your account is active, or until you delete them
Rate limiting data : 24 hours after generation (for anti-abuse monitoring)
Inactive accounts : 24 months after last login, then automatically deleted (including all resumes and cover letters)
Financial data : 7 years (legal requirement)
Newsletter : Until unsubscription
7. Sharing with Third Parties
We only share your data with:
7.1 Service providers (processors)
OpenAI : For AI-generated content (US, adequacy decision + DPA)
Stripe : For payment processing (US/EU, adequacy decision + DPA)
We have concluded Data Processing Agreements (DPAs) with all the above parties in accordance with GDPR Article 28.
8. International Data Transfer
Some of our service providers are located outside the EU/EEA:
United States : OpenAI, Stripe, Replit
Safeguards: EU-US Data Privacy Framework + Standard Contractual Clauses (SCCs)
Your data is not transferred to countries without an adequate level of protection
9. Your Rights Under GDPR
You have the following rights:
Right of access (Article 15 GDPR): Request what data we hold about you
Right to rectification (Article 16 GDPR): Have incorrect data corrected
Right to erasure (Article 17 GDPR): Have your account and data deleted
Right to restriction (Article 18 GDPR): Temporarily halt processing
Right to data portability (Article 20 GDPR): Receive your data in a structured format
Right to object (Article 21 GDPR): Object to processing
Right to withdraw consent : For AI optimization and newsletter
9.1 How to exercise these rights?
Via your account: most actions can be performed yourself
Via email: support@getresumate.com
We will respond within 1 month (Article 12(3) GDPR)
9.2 Filing a complaint
Not satisfied? You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
Website: https://autoriteitpersoonsgegevens.nl
10. Cookies and Tracking
We use the following cookies:
10.1 Functional cookies (necessary)
Session cookies for login
Storing preferences
These cookies are necessary and do not require consent
10.2 Analytical cookies
Anonymous usage statistics
Only with your consent
11. Children
Our service is not intended for persons under 16 years of age. We do not knowingly collect data from children under 16.
If you are under 16, you may only use our service with the consent of your parents or guardian.
12. Changes to Privacy Policy
We may update this privacy policy from time to time.
Major changes will be communicated at least 30 days in advance
Minor changes take effect immediately
The current version can always be found on this page
Date of last change is listed at the top of this document
13. Contact
Do you have questions about this privacy policy or how we handle your data?
Get in touch:
Email: support@getresumate.com
We will respond to your query within 5 business days.
Resumate is an AI resume builder for job seekers, at getresumate.com and getresumate.nl. We help candidates get past the filter with a resume, a cover letter and a match per job posting. Resumate is not a recruiter ATS and not a job board.