Privacy Policy

Policy version

• Operator / personal information controller: Xi Guanwen
• Public address: Room 201, No. 14, Branch Lane 9, Lane 38, Nanda Road, Baoshan District, Shanghai, China
• Effective date: 2026-08-25
• Policy version: multiresume-legal-2026-08-25-v2
• Minimum age: 18+
• Support email: support@multiresu.me
• Privacy request email: privacy@multiresu.me

Data we process

• Account email, invite status, purchase whitelist status, and session metadata.
• PDF resumes, extracted text, structured resumes, job descriptions, user instructions, AI requests, and AI outputs.
• Order, payment event, quota, and refund or adjustment metadata for payment confirmation, quota grant, refund/support, and exception handling.
• Waffo Pancake checkout handles card and payment method details. MultiResume stores only the payment, order, quota, and refund metadata needed for confirmation, support, and audit.
• Support messages, issue descriptions, screenshots, and attachments you choose to provide.

AI provider processing

MultiResume uses third-party AI providers to generate parsing and optimization suggestions. AI requests may include the resume, JD, current editing content, and user instructions needed to provide the feature.

The current provider is Hangzhou DeepSeek Artificial Intelligence Co., Ltd., using deepseek-v4-flash / DeepSeek-V4-Flash at https://api.deepseek.com. DeepSeek's official privacy policy says it directly processes and stores personal information in the People's Republic of China, may use inputs to improve and train models, and provides a right to opt out of training or technology optimization. MultiResume is the downstream controller and does not claim DeepSeek endorsement.

MultiResume does not train or fine-tune its own models on resumes, job descriptions, user inputs, or outputs. This does not change DeepSeek's independent retention, training, technology-optimization, or opt-out boundary. MultiResume does not promise zero provider retention, provider no-training, or a fixed provider retention period.

Processors, sharing, and required disclosures

• Render provides application hosting; Supabase provides database, authentication, and related storage; the configured email service sends account and support communications; DeepSeek processes AI requests and outputs; Waffo Pancake provides checkout and payment processing.
• These processors receive only data necessary for their stated operational purposes and act under their own applicable terms and processing boundaries.
• MultiResume may disclose information where required by law, regulation, court order, or competent authority; to investigate security incidents or fraud; to protect users, rights, or the service; or at the user's direction or consent.
• MultiResume does not sell personal information.

Security incidents

MultiResume will investigate qualifying personal-data or security incidents and notify affected users and/or competent authorities where applicable law requires. No fixed 72-hour promise is made where it is not legally required.

Cross-border processing

Known principal processing boundaries include DeepSeek, which directly processes and stores information in the People's Republic of China, and Waffo Pancake checkout for card and payment-method details. Hosting, database, object storage, logging, and email/support regions depend on deployment configuration; MultiResume does not promise a fixed region. Card data does not pass through or reside on MultiResume servers.

Operational safeguards include restricted account access, authentication, data minimization, provider boundaries, and redacted operational logs. Specific provider contracts and regional safeguards depend on the deployed configuration.

For deletion, export, correction, consent withdrawal, or privacy complaints, contact privacy@multiresu.me.

Cookies, automatic metadata, and rights

• MultiResume does not sell personal information. It uses essential authentication/session, language, and theme cookies; no advertising cookie or third-party analytics SDK has been observed in the product.
• Automatically collected metadata includes IP/request time, basic browser and device information, route, request id, authentication state, quota/payment operation state, and security or abuse signals. Routine logs should not contain full resumes or prompts.
• You may request access, export, correction, deletion, restriction, consent withdrawal, or complaint handling at privacy@multiresu.me. We target a response within 30 calendar days after a verifiable request, subject to applicable law and executable system capability.
• No separate DPO has been appointed; privacy@multiresu.me is monitored directly by Xi Guanwen as the privacy contact. You may also complain to an applicable supervisory authority in your jurisdiction; MultiResume does not invent or designate a specific authority.
• If information from someone under 18 is accidentally collected, contact the privacy address for verification and deletion under applicable law. Third-party policies govern their own processing and are not replaced by this policy. Material changes are notified at least 30 calendar days in advance.

Logs and retention

• Routine logs should not store full raw resumes, full PDF text, full prompts, or full AI responses.
• Operational metadata may be used for troubleshooting, quota, cost control, abuse prevention, and beta review.
• Account, profile, user-authored resume, JD, and workspace content is retained while the account is active. After a verified deletion request or account closure, the target is deletion from active systems within 30 days. The current deployment has no verified, uniform backup-expiry mechanism, so MultiResume does not promise backup deletion within 90 days.
• Transient raw uploads, parse artifacts, and content-bearing operational diagnostics have a target maximum of 30 days unless saved as account content. Security, abuse, and access logs are retained for 180 days.
• Support, complaint, refund, abuse-review, and operator case records are retained for 24 months. Order, payment, refund, quota, consent, policy-acceptance, and audit records are retained for 7 years, or longer where law requires. De-identified aggregate statistics may be kept without a fixed limit when they cannot reasonably identify a person.
• For deletion, export, correction, consent withdrawal, training opt-out, or complaints, contact privacy@multiresu.me. We verify the requester and respond according to applicable law and the capabilities the deployment can actually execute.

Legal bases and data-subject rights

• Account, editing, export, AI, and purchase services: performance of a contract or steps requested before a contract.
• AI, cross-border processing, and checkout policy acceptance: explicit consent where required. You may withdraw consent; withdrawal does not affect processing already carried out lawfully.
• Security, abuse prevention, troubleshooting, and operational audit: legitimate interests. Statutory payment, refund, consent, and audit records: legal obligations or dispute handling.
• Where applicable, you may request access, a copy, qualified data portability, correction, deletion, restriction, object to processing, withdraw consent, or request complaint handling through privacy@multiresu.me. Support issues may also be sent to support@multiresu.me.

Privacy requests

Contact our privacy team for a rights request. Do not include account credentials in your email.