Privacy policy

1. Introduction

Welcome to CircleResume. This Privacy policy ("Policy") explains how Florentin-Cristian Dumitrache, trading as Dumitrache Florentin-Cristian Persoană Fizică Autorizată (PFA), registered in Romania under CUI 46679040, Trade Register no. F40/3777/2022, with registered address at 188 Iuliu Maniu Boulevard, 061124, Bucharest, Romania ("CircleResume", "we", "us", or "our"), collects, uses, shares, and protects personal data when you access or use the CircleResume platform at circleresume.com and all related websites, applications, features, and services (collectively, the "Platform").

For the purposes of the EU General Data Protection Regulation (GDPR) and equivalent laws, CircleResume is the data controller responsible for your personal data. Our full company registration and contact details are available on our Company details page.

Personal data means any information that relates to an identified or identifiable natural person. This includes, but is not limited to, names, email addresses, IP addresses, and any content you create on the Platform.

This Policy applies to all users worldwide and should be read together with our Terms and conditions and our Cookie policy.

By creating an account or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please discontinue use of the Platform immediately.

2. Personal data we collect

We collect personal data from three sources: directly from you, automatically when you use the Platform, and from third-party services you choose to connect. If you use the Platform without an Account (guest mode), draft content you enter may be stored on your device and, if you save through the guest flow, on our servers, as described in subsection (d) below.

3. How we use your personal data

We use your personal data for the following purposes:

4. We do not sell your personal data

CircleResume does not sell, rent, trade, or otherwise provide your personal data to third parties for monetary or other valuable consideration.

We do not share your personal data for cross-context behavioural advertising, profiling, or targeted marketing. We do not use data brokers, and we do not allow third parties to collect personal data from our Platform for their own purposes.

This applies regardless of your location. For California residents: under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), this constitutes our notice that we do not "sell" or "share" personal information as those terms are defined under California law.

5. Third-party service providers

We share personal data with the following third-party service providers who act as data processors on our behalf (or, in the case of payment providers, as independent controllers). We only share the minimum data necessary to provide our service.

We do not share your personal data with any parties other than those listed above. When we share data with these providers, it is only so they can perform specific tasks for us — such as hosting our database, storing your files, sending transactional emails, or processing payments — not in exchange for money, advertising, or any other benefit from them. Each provider listed above acts as a data processor on our behalf and processes your data only under our instructions, except Polar, which acts as an independent data controller for payment data (see Section 6). We do not share your personal data with any other parties, except where required by law (see Section 19).

6. Payment processing

Payments are processed by Polar (Polar Software Inc.), which acts as an independent data controller for payment data. Polar Software Inc. is a US company (Delaware) with operations in Sweden. Payment data may be processed in the United States and other countries as described in Polar's Privacy Policy. When you make a purchase:

• You are redirected to Polar's secure checkout page where you enter your payment details directly with Polar.
• We never receive, process, or store your credit card numbers, bank account details, or any full payment instrument data.
• We send Polar your user ID so they can associate the subscription with your CircleResume account, and your country (from onboarding) so checkout can apply the correct billing and tax treatment.
• A Polar customer account is automatically created when you sign up for CircleResume.

For information on how Polar handles your payment data, please review Polar's Privacy Policy.

7. Social logins

The Platform offers the ability to register and sign in using your Google account. If you choose to do this:

• We receive your name, email address, profile picture URL, and email verification status from Google.
• Authentication tokens (access token, refresh token, ID token) are stored securely in our database to maintain your sign-in session.
• We do not post to your Google account, access your contacts, or request any permissions beyond basic profile information.

We are not responsible for Google's use of your data. We recommend reviewing Google's Privacy Policy and managing your permissions via your Google Account settings.

8. PDF share links

When you export a resume or cover letter as a PDF, we generate a time-limited shareable link that allows anyone with the link to download the PDF. These links:

• Are secured with a cryptographic signature (HMAC-SHA256) and cannot be guessed or forged.
• Expire automatically after 7 days from generation.
• Do not require the recipient to have a CircleResume account.
• Contain the full content of your resume or cover letter, including any personal information you have included in the document.

We apply technical measures so that share links cannot be guessed or forged by third parties who do not possess the link. However, anyone who obtains a valid link — whether because you shared it directly, because a recipient forwarded it, or because it was otherwise disclosed — can access and download your PDF for as long as the link remains active. CircleResume is not responsible for access to your resume, cover letter, or personal information by persons other than those you intended to share with, including where a link is forwarded, re-shared, or falls into unintended hands. You are solely responsible for deciding whom to share each link with and for any consequences of that disclosure.

After the link expires, the associated PDF file is permanently deleted from our storage by an automated daily cleanup process.

9. Cookies and tracking technologies

We use essential cookies to operate the Platform, optional functional preferences (such as your theme and sidebar layout) that you can enable in our cookie banner, and analytics technology that is activated only with your consent. Full details, including the specific cookies and similar technologies we use and how to manage them, are available in our Cookie policy.

We do not use advertising cookies, social media tracking pixels, cross-site trackers, or any similar technologies.

10. International data transfers

CircleResume is operated from Romania (European Union). However, several of our third-party service providers are located outside the European Economic Area (EEA), primarily in the United States. This means your personal data may be transferred to and processed in countries outside the EEA.

When your personal data is transferred outside the EEA, we ensure it is protected through one or more of the following legally recognised transfer mechanisms:

• EU-US Data Privacy Framework (DPF):Several of our US-based providers are self-certified under the EU-US Data Privacy Framework with the US Department of Commerce, which has been recognised by the European Commission as providing adequate protection (Adequacy Decision of 10 July 2023). You can verify a provider's certification at dataprivacyframework.gov.
• Standard Contractual Clauses (SCCs): Where a provider is not covered by the DPF or an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission (Decision 2021/914) or equivalent safeguards offered by the provider (for example in their data processing terms or DPA). These mechanisms impose contractual obligations on the recipient to protect your data to a standard equivalent to that within the EEA.
• Adequacy decisions: For providers in countries that the European Commission has determined offer an adequate level of data protection (e.g., Iceland or Switzerland), no additional safeguards are required.

Below is a summary of the transfer mechanisms we rely on for each provider, based on their published privacy documentation and contractual terms as of the date of this Policy:

11. Data retention

We retain your personal data only for as long as necessary to provide our services and fulfil the purposes described in this Policy. Specific retention periods are:

If we are legally required to retain certain data for a longer period (e.g., for tax or accounting purposes), we will retain only the minimum data necessary for the specific legal obligation.

12. Data security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Password hashing: Passwords are securely hashed before storage — we never store passwords in plain text.
• Secure session cookies: Authentication cookies use the Secure flag and are transmitted only over HTTPS.
• Signed share links: PDF share links are protected with HMAC-SHA256 cryptographic signatures.
• Rate limiting: API endpoints are protected against abuse through request rate limiting.
• Access controls: Administrative access is restricted to authorized personnel only.

While we take all reasonable steps to protect your data, no method of electronic storage or transmission is 100% secure. If you believe your account has been compromised, please contact us immediately at contact@circleresume.com.

13. Your privacy rights

Depending on your location, you may have the following rights regarding your personal data. We honour these rights regardless of where you live, to the extent we are able.

The following table summarises the same rights by applicable law:

14. Children's privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from children or minors under 18 years of age.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at contact@circleresume.com. We will promptly investigate and delete the data if confirmed. If we learn that we have collected personal data from a person under 18, we will delete that data without undue delay. This is consistent with our obligations under the GDPR (EU), UK GDPR, and other applicable laws. In the United States, the Children's Online Privacy Protection Act (COPPA) applies to children under 13; our Platform is not directed to children under 18 and we do not knowingly collect data from minors.

15. De-identified and aggregate data

We may create de-identified (anonymised) or aggregated data from personal data by removing information that makes the data personally identifiable. Such data is no longer considered personal data under applicable laws.

We may use de-identified data for internal analytics, improving our services, and other lawful business purposes. We commit to maintaining and using such information in de-identified form and will not attempt to re-identify it.

For example, we may look at aggregated onboarding trends — such as which countries users select, how they heard about us, and what goals they choose — to improve CircleResume and understand whether the product is meeting user needs. This is strictly for our own internal use. We do not sell, rent, or share this information with advertisers, data brokers, or any other third party, and we do not use it to build individual advertising profiles about you (see Section 4).

16. Automated decision-making, profiling, and AI features

CircleResume does not use automated decision-making or profiling that produces legal or similarly significant effects on you.

We do not analyse your personal data to create profiles, make predictions about your behaviour, or make automated decisions that affect your access to our services. All decisions regarding your account (such as subscription management) are based on objective criteria (e.g., payment status) and are not the result of automated profiling. This disclosure is made in accordance with Article 22 of the GDPR and equivalent provisions under UK GDPR.

Note on AI rewriting features. The AI rewrite feature available to Pro subscribers is a user-initiated, assistive tool. It does not make any automated decisions about you, your account, or your access to the Platform. It simply generates a suggested rewrite of document text that you have voluntarily selected and submitted. You retain full control over whether to accept, modify, or discard any AI-generated suggestion. No profiling or automated decision-making within the meaning of Article 22 GDPR occurs in connection with this feature.

For the AI rewrite feature, the third-party AI model provided by OpenAI processes only the text you explicitly submit via the rewrite button. It does not have access to your account information, identity, subscription status, or any other personal data beyond the text of the section being rewritten.

Note on the document import feature. Importing a resume or cover letter from a PDF is likewise a user-initiated, assistive tool. It does not make any automated decision about you, your account, or your access to the Platform; it only converts a file you choose to upload into editable text that you review and control. Because the purpose of the feature is to reproduce your document, the full text extracted from the file you upload — including any personal data it contains — is processed by our extraction providers (LlamaIndex and OpenAI) for that limited purpose, as described in Section 5. No profiling or automated decision-making within the meaning of Article 22 GDPR occurs in connection with this feature.

17. Business transfers

If CircleResume is involved in a merger, acquisition, reorganisation, sale of assets, or bankruptcy, your personal data may be transferred as part of that transaction. In such event, we will notify you via email and/or a prominent notice on the Platform before your personal data is transferred and becomes subject to a different privacy policy. The acquiring entity will be required to honour the commitments made in this Policy or obtain your separate consent for any materially different processing.

18. Third-party links

The Platform may contain links to third-party websites, services, or resources that are not owned or controlled by CircleResume (e.g., Polar checkout, Google sign-in). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service you access through or in connection with the Platform. This Policy applies solely to data collected by CircleResume.

19. Disclosure required by law

We may disclose your personal data if required to do so by law, or if we believe in good faith that such action is necessary to: (a) comply with a legal obligation, court order, or governmental request; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Platform; (d) protect the personal safety of users of the Platform or the public. Where legally permitted, we will make reasonable efforts to notify you before disclosing your data.

20. Do-Not-Track signals

Some browsers include a "Do Not Track" (DNT) feature that sends a signal to websites requesting that your browsing activity not be tracked. Because there is no universally accepted standard for how to respond to DNT signals, we do not currently respond to them. However, our analytics are already consent-based: we do not load analytics technologies unless you explicitly consent via our cookie banner. This means that your privacy preferences are respected regardless of your browser's DNT setting.

21. Additional disclosures for U.S. residents

a) California

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

• Categories of personal information collected: Identifiers (name, email, IP address), internet activity (page views, browser type), professional information (employment history, education — only as entered by you in your resume), and inferences (none — we do not create profiles or inferences about you).
• Sale of personal information: We do not sell your personal information.
• Sharing for cross-context behavioural advertising: We do not share your personal information for cross-context behavioural advertising.
• Sensitive personal information: We do not intentionally collect sensitive personal information as defined by the CCPA/CPRA. Your resumes may contain information you choose to include; we do not use such information for purposes other than providing the document creation service.
• Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their direct marketing purposes.

b) Other U.S. states

Several other U.S. states have comprehensive consumer privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA), with more taking effect over time. If you are a resident of such a state, you have rights comparable to those described in Section 13 — including the rights to access, correct, and delete your personal data, and to opt out of its sale or of targeted advertising.

As stated in Section 4, we do not sell your personal data, do not share it for targeted or cross-context behavioural advertising, and do not use it for profiling that produces legal or similarly significant effects (see Section 16). You may exercise any of your rights, regardless of your state, using the methods described in Section 13. We do not discriminate against you for exercising these rights. Where your state grants a right to appeal a decision on your request, you may do so by replying to our decision or contacting us at legal@circleresume.com.

22. Changes to this policy

We may update this Privacy policy from time to time to reflect changes in our practices, technologies, or legal requirements. The updated version will be indicated by the "Last updated" date at the top of this page.

If we make material changes that significantly affect how we process your personal data, we will notify you by reasonable means (such as a notice on the Platform or an email to the address associated with your account) before the changes take effect. We encourage you to review this Policy periodically.

23. Contact us

If you have any questions, concerns, or requests regarding this Privacy policy or our data practices, please contact us:

Full company registration details are also available on our Company details page. We aim to resolve all privacy-related inquiries within 30 days of receipt.