Privacy Policy

Wackywow.com LLC, doing business as Resume.win ("we," "us," or "our"), respects your privacy. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit https://resume.win, create an account, or use our job search and career tools (the "Service").

For purposes of applicable data protection laws, Wackywow.com LLC (Resume.win) is the controller of personal information processed through the Service, except where we process data solely on behalf of an enterprise customer under a separate agreement.

Contact: [email protected] · Website: https://resume.win

3.1 Information you provide

• Account data: name, email address, password (stored hashed), profile photo, preferences
• Career data: resumes, work history, education, skills, cover letters, job applications, notes, statuses, and Apply Kit history
• Shared content you choose to publish via Apply Pack links (and related view metadata)
• Optional employer-interest preferences and leads when you enable the Recruit.win bridge
• Contact data: recruiters, hiring managers, and networking contacts you add
• Communications: support requests, feedback, and survey responses
• Billing data: subscription plan, billing history (payment card details are handled by Stripe, not stored by us)
• Interview data: mock interview responses, scores, feedback, and optional video/audio recordings
• AI interactions: prompts and outputs when you use AI toolbox, resume review, matching, or writing features
• Uploaded files: resume PDFs/images and company logos stored in private object storage when configured

3.2 Information collected automatically

• Device and browser type, operating system, language, and screen resolution
• IP address, approximate location derived from IP, and referral URLs
• Log data: pages viewed, features used, timestamps, crash reports, and performance metrics
• Cookies and similar technologies (see Section 8)
• Usage limits and credit consumption for AI and premium features

3.3 Information from third parties

• Authentication providers if you sign in with a linked account
• Payment status and customer IDs from Stripe
• Service providers that help deliver email, video interviews, or AI inference

We use personal information to:

• Provide, maintain, and personalize the Service
• Process subscriptions, invoices, and account changes
• Generate AI-assisted content you request (resume feedback, cover letters, interview questions, etc.)
• Send transactional emails (verification, password reset, billing receipts)
• Respond to support requests and improve documentation
• Monitor usage, debug issues, and protect against fraud and abuse
• Enforce our Terms of Service and comply with legal obligations
• Send marketing communications where permitted and with your consent
• Deliver optional employer-interest messages only when you have opted in
• Conduct aggregated, anonymized analytics that do not identify you personally (for example public proof stats)

Where GDPR or similar laws apply, we rely on:

• Contract: to provide the Service you signed up for
• Legitimate interests: security, product improvement, and analytics (balanced against your rights)
• Consent: marketing emails, non-essential cookies, and certain optional features
• Legal obligation: tax, accounting, and lawful requests from authorities

When you use AI features, relevant portions of your User Content may be transmitted to AI providers (such as OpenAI) to generate responses. Providers process data under their terms and security practices.

• We instruct providers to use data for inference to serve your request, not for public model training unless disclosed otherwise
• Automated outputs may influence suggestions shown to you but do not make legally significant decisions about employment by themselves
• You may contact us to request human review of automated decisions where required by law

We do not sell your personal information for money. We may share data with:

• Service providers under contract (hosting, database, private file storage, email, payments, AI, video, analytics)
• Professional advisers (lawyers, accountants) under confidentiality duties
• Authorities when required by law or to protect rights, safety, and security
• Successors in connection with a merger, acquisition, or asset sale (with notice where required)
• Others with your explicit direction (e.g., exporting your resume, creating an Apply Pack link, or enabling employer interest)

Recruit.win is a sister B2B brand operated separately from the seeker product. The optional bridge between them is designed to protect your trust:

• Employer interest / Recruit search is off by default and requires account opt-in (Settings → Privacy) plus per-pack Recruit.win visible (Brand OS); Refer me stays aligned with Recruit visibility
• Sharing an Apply Pack does not make it Recruit-searchable until both toggles are on
• When enabled, employers may leave a work email and short message; we notify you — we do not auto-reply or share your resume bytes
• Supply metadata exposed to Recruit (if configured) is limited to safe pack fields (titles, scores, pack URL) via GET /api/recruit-bridge/supply only — public profiles (/u/…) are not a Recruit index
• Turning on Do Not Sell/Share disables the bridge, clears pack Recruit visibility, and blocks re-enable until you clear that preference
• You remain free to ignore, decline, or follow up on any interest lead

Examples of categories of processors we use (actual providers may change; see also the DPA subprocessor list):

• Cloud hosting and database (e.g., Microsoft Azure App Service, MongoDB Atlas)
• Private object storage for resume and logo binaries (e.g., Azure Blob Storage) when configured
• Payments: Stripe
• AI inference: OpenAI and related tooling
• Email delivery: SMTP or transactional email providers
• Video interviews: Daily.co or comparable real-time communication services
• Optional OAuth identity providers (Google / Microsoft)

Each provider is selected for security and reliability and is bound by data processing terms appropriate to their role.

• Essential cookies: authentication, security, and load balancing
• Preference cookies: theme, language, and UI settings
• Analytics cookies: understand how the Service is used (where enabled)

You can control cookies through browser settings. Blocking essential cookies may prevent login or core features from working.

We may process data in the United States and other countries where we or our providers operate. When transferring data from the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms where required.

We implement administrative, technical, and organizational measures designed to protect personal information, including:

• Encryption in transit (HTTPS/TLS)
• Hashed password storage for credentials accounts
• Session authentication and role-based access for admin tools
• Private file storage for resume/logo binaries (not publicly listable containers) with ownership checks on download APIs
• Rate limiting on sensitive endpoints (auth, privacy, billing, bridge APIs)
• Security contact via /.well-known/security.txt for responsible disclosure

No method of transmission or storage is 100% secure; we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by law.

• Account data: retained while your account is active and for a reasonable period after deletion to resolve disputes and comply with law
• Billing records: retained as required for tax and accounting (typically 7 years where applicable)
• AI logs: retained for safety, abuse prevention, and quality improvement for a limited period
• Interview recordings: retained according to your plan settings and until you delete them or your account
• Backups: may persist for a limited time after deletion before being overwritten

Depending on your location, you may have the right to:

• Access a copy of personal information we hold about you
• Correct inaccurate or incomplete data
• Delete personal information (subject to legal exceptions)
• Restrict or object to certain processing
• Data portability in a structured, machine-readable format
• Withdraw consent where processing is consent-based
• Lodge a complaint with your local data protection authority

Submit requests to [email protected]. We may verify your identity before fulfilling requests.

California residents may request to know, delete, or correct personal information, and to opt out of "sale" or "sharing" as defined by California law. We do not sell personal information for money. You may designate an authorized agent with written permission.

Self-service controls: Dashboard → Settings includes Do Not Sell or Share, marketing preferences, Recruit.win bridge opt-in, data export, and account deletion. Enabling Do Not Sell or Share also turns off the employer-interest bridge. Global Privacy Control (GPC) is treated as an opt-out of sale/sharing.

We will not discriminate against you for exercising privacy rights.

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided data, contact [email protected] and we will delete it promptly.

You may receive product updates or tips if you opt in. You can unsubscribe using the link in any marketing email or by contacting us. Transactional messages (security alerts, billing) are not marketing and may still be sent.

Some browsers send "Do Not Track" (DNT) signals. Because there is no consistent industry standard for DNT, we do not treat DNT alone as a binding instruction.

We honor Global Privacy Control (GPC) signals as a request to opt out of "sale" or "sharing" under California law and to keep optional analytics/marketing cookies off. You can also set Do Not Sell or Share in Dashboard → Settings.

You may delete your account from Dashboard → Settings (password confirmation required, or email confirmation for OAuth-only accounts) or by emailing [email protected]. You can also export a machine-readable copy of your data from Settings. Deletion removes personal data from active systems (including associated files where practicable); residual copies may remain in backups for a limited period.

We may update this Privacy Policy periodically. We will post the revised version on this page and update the "Last updated" date. Material changes may be communicated by email or in-app notice.

Privacy questions or requests: [email protected]. See also our Trust Center at https://resume.win/trust. We aim to respond within 30 days, or sooner where required by law.