This policy explains what personal data BuildAResume1 (buildaresume1.com) collects, why, how long we keep it, who we share it with and what your rights are under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is SC SITEMILE SRL, Str. Vasile Bideac nr. 4A, Chitila, Ilfov County, Romania, Trade Register no. J2012002424236, VAT RO30584106. Email: info@buildaresume1.com. For any privacy question or request you can write to this address or use our contact form (topic “Privacy / my data”). We have not appointed a data protection officer because we are not legally required to; the address above reaches the people responsible for data protection.
2. What data we collect
- Account data: first and last name, email address, password (stored only as a secure hash), the date you joined, and your acceptance of our Terms (date, version, shortened IP address).
- Resume content: everything you type into your resumes — for example contact details, job history, education, skills, languages, links, references and hobbies — and the photo you upload. Optional fields such as date of birth, nationality or photo are entirely your choice.
- Imported files: when you import a PDF or Word file, we read its text to fill in a new resume. The file itself is deleted immediately after processing and is never stored.
- Payment data: your plan, subscription status, renewal dates and Stripe customer reference. Card details are entered directly on Stripe’s page; we never receive them.
- Messages: what you send us through the contact or withdrawal forms or by email, and our replies.
- Technical and security data: IP address, browser type, date and time of requests, failed login attempts and counters used to prevent abuse (for example rate limits).
- Cookie choices: your selection in the cookie banner.
Please do not add sensitive information (such as health data, religious beliefs or political opinions) to a resume unless you really want it to appear there. If you do, we process it only to create the resume you asked for.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, storing and displaying your resumes, generating PDFs, importing files | Performance of our contract with you (Art. 6(1)(b)) |
| Processing payments, managing subscriptions, refunds and withdrawals | Performance of the contract (Art. 6(1)(b)) |
| Keeping invoices and accounting records | Legal obligation (Art. 6(1)(c)) under Romanian tax and accounting law |
| Service emails (receipts, trial ending reminders, confirmation of cancellation or withdrawal, important changes) | Performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Answering your messages | Our legitimate interest in replying to you (Art. 6(1)(f)), or the contract if your message is about it |
| Protecting the service against fraud, spam, brute-force and abuse; keeping it secure | Our legitimate interest in a safe and working service (Art. 6(1)(f)) |
| Keeping proof of your consents and of contract-related requests; defending legal claims | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| Optional cookies (only if we use them and you agree) | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
We do not sell your data, do not use your resume for advertising, and do not make decisions about you based solely on automated processing, including profiling.
4. Who receives your data
We use carefully selected service providers (“processors”) who act only on our instructions and under data processing agreements:
- Web hosting and email delivery: our hosting provider, with servers located in the European Union — stores the website, database and files.
- Cloudflare (Cloudflare, Inc., USA) — network security, protection against attacks and faster delivery of the site; all traffic passes through Cloudflare’s network.
- Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) — payment processing, invoices and the billing portal. For some purposes, such as fraud prevention and meeting financial regulations, Stripe acts as an independent controller; see stripe.com/privacy.
- Anthropic (Anthropic, PBC, USA) — only if you use the smart import: the text extracted from your file is sent to Anthropic’s AI model to be organised into resume sections. Under Anthropic’s commercial terms, data sent through its API is not used to train its models and is kept only for a limited time; see anthropic.com/legal/privacy.
We may also disclose data to public authorities when we are legally required to, and to our accountants and lawyers, who are bound by confidentiality.
5. Transfers outside the EU
Some providers (Stripe, Cloudflare, Anthropic) are based in the USA or may access data from there. Such transfers are protected by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s Standard Contractual Clauses together with additional safeguards. You can ask us for a copy of these safeguards.
6. How long we keep your data
| Data | Kept for |
|---|---|
| Account and resumes, photos | Until you delete them or your account. Deletion is immediate and permanent. |
| Imported files | Not stored — deleted right after processing. The extracted result is cached for up to 7 days so a repeated import of the same file is instant, then deleted. |
| Invoices and payment records | As long as Romanian tax and accounting law requires (currently up to 10 years), even after your account is deleted. |
| Proof of consent, withdrawal and refund requests | For the duration of your account and 3 years afterwards (the general limitation period for claims). |
| Contact messages | Up to 2 years after the conversation ends, unless they are needed for a legal claim. |
| Security counters and login-attempt records | From 15 minutes up to 24 hours. |
| Server logs kept by our hosting provider | Usually no longer than 30 days. |
| Cookie choice | 6 months, then we ask again. |
7. Your rights
You have the right to:
- access your data and get a copy of it;
- data portability — download your data in a machine-readable format with the “Download my data” button in Account settings;
- rectification — correct your data at any time in the editor and Account settings;
- erasure — delete resumes or your whole account yourself in Account settings;
- restriction of processing and to object to processing based on our legitimate interests;
- withdraw consent at any time (for cookies via “Cookie settings” at the bottom of every page), without affecting processing done before;
- lodge a complaint with a data protection authority — in Romania the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro, or the authority in the EU country where you live or work.
To exercise a right that you cannot use directly in your account, write to info@buildaresume1.com. We answer within one month and may ask you to confirm your identity.
8. Security
The site uses encrypted connections (HTTPS). Passwords are stored only as salted hashes. Resumes are private and only visible to you after logging in. We limit login attempts, protect forms against bots, restrict access to the database to authorised persons and keep software up to date.
9. Children
The service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has created an account, please contact us and we will delete it.
10. Cookies
We use only the cookies needed for the site to work, unless you agree to others. Details are in the Cookie policy.
11. Changes
We update this policy when our processing changes. The current version and its date are always on this page; we inform you of important changes by email or in your account.
Questions about this document?
We usually answer within 2 business days.