Built for career data you can trust
Resume.win handles resumes and personal career information. We publish clear policies, consent controls, and self-service data rights — without overclaiming certifications we have not completed.
Current posture (honest)
In place: Privacy & Terms, Cookie Policy + consent banner, DPA/subprocessors page, accessibility statement, security contact (`/.well-known/security.txt`), data export & account deletion (including OAuth), CCPA Do Not Sell/Share + GPC, marketing unsubscribe, security headers, and rate limits on sensitive APIs.
Not claimed: We do not currently advertise SOC 2, ISO 27001, or HIPAA certification. When completed, we will publish evidence here.
Processors: See the DPA & subprocessors list. We do not sell your personal information.
Recruit.win sister brand: Recruit search requires account opt-in (Settings → Privacy) plus a per-pack “Recruit.win visible” toggle (Brand OS). Sharing a pack alone is not enough. Public profiles (/u/…) are not a Recruit index. We do not auto-share resumes. Do Not Sell/Share disables the bridge and clears pack visibility.
How we protect Resume.win user data
- You own your content — resumes and career materials remain yours; we license them only to operate the Service.
- Private files — resume/logo binaries use private storage with ownership checks; company logo downloads are authenticated.
- Sharing is intentional — Apply Packs are links you create; Recruit searchability requires account opt-in and a per-pack Recruit-visible setting.
- Self-service rights — export, delete, marketing opt-out, and Do Not Sell/Share in Settings.
- Abuse controls — rate limits, acceptable-use rules, and a public security contact for responsible disclosure.
Report security issues via security.txt or [email protected].
Company details
- Operated by
- Wackywow.com LLC, doing business as Resume.win
- Mailing address
- Resume.win, Attn: Legal, United States
- Support
- [email protected]
- Privacy
- [email protected]
- Legal inquiries
- [email protected]. We aim to respond within 5–10 business days.
Security practices
Privacy Policy
Terms of Service
DPA & subprocessors
Cookie Policy
Accessibility
Privacy controls
Privacy requests
A trust center, not a wall of fake certifications
This URL is for how Resume.win handles career data: resumes, Apply Packs, billing, and account rights. It is not the proof page. Proof is logged outcomes after Applied. Trust is policies, processors, and what we refuse to claim.
People searching for Resume.win privacy or security should land here. We publish what exists: encryption in transit, access controls, consent, export, deletion, security headers, and rate limits. We do not advertise SOC 2, ISO 27001, or HIPAA. When those exist, evidence will appear on this page — not a badge we rented.
We do not sell personal information. Recruit.win search needs an account opt-in and a per-pack toggle. Sharing a pack is not enough. Public /u/ profiles are not a Recruit index.
If you wanted interview rates, go to /proof. If you wanted Apply Kit, go to /apply-kit. This page stays boring on purpose.
What we publish about processors and your rights
The DPA lists hosting, storage, AI, email, and payments under contract. Cookie policy explains essential vs optional plus GPC. Accessibility states the WCAG 2.1 AA goal and how to report a barrier.
You own the files you upload. We license them only to run the service. Resume binaries use private storage with ownership checks. Apply Packs are links you create. You can revoke a pack. You can export or delete the account from Settings.
Locked out? Contact support from the email on the account. Do not paste passwords. Do not send five resumes “for a security review.”
Career centers and coaches still use packs and cohort links. That does not turn this page into a workshop landing. Those intents stay on /career-centers and /coaches.
How Trust differs from proof, contact, and the catalog
Proof answers “do you invent reply rates?” Trust answers “what happens to my PDF?” Contact is leftover human questions. Features is a catalog of product URLs. Mixing those intents is how a Trust Center becomes a keyword dump.
A vulnerability report belongs in security.txt. A billing question belongs in contact or the FAQ. A “can you get me hired” note belongs nowhere on this site.
We will update this page when a control changes — a new subprocessor, a completed audit, a new self-serve toggle. We will not pad it with resume-builder adjectives.
Start with the cards below. Then Settings if you have an account. Then contact if Settings cannot do the job.
How to use this page
- Read the current posture. See what is in place (policies, consent, export, deletion) and what we do not claim (SOC 2, ISO, HIPAA).
- Open the matching legal page. Privacy, terms, DPA/subprocessors, cookies, or accessibility — each is its own URL.
- Use Settings for your data. Export, delete, marketing opt-out, and Do Not Sell/Share are self-serve after you sign in.
- Report a security issue the right way. Use /.well-known/security.txt or the support email. Do not file a job listing or a resume review here.
FAQ
- Does Resume.win have SOC 2 or ISO 27001?
- Not today. We do not advertise those certifications. This page lists controls that exist. Evidence will appear here if we complete an audit.
- Do you sell career or resume data?
- No. Do Not Sell/Share is in Settings. Recruit.win visibility is opt-in plus a per-pack toggle. Pack share alone is not a sale.
- Where do I export or delete my Resume.win account?
- Settings after you sign in. If you cannot sign in, use /contact from the account email. The privacy policy and DPA have the legal detail.
- Is the Trust Center the same as the proof page?
- No. Trust is privacy, security, and data rights. Proof is how we measure Apply Kit outcomes and when public totals stay hidden.