Privacy Policy

Version 2026-10-01

MBCSOFT LLC, 8 The Grn, Dover, DE 19901, United States is the controller of personal data processed through ResumeRun. Contact: info@mbc-soft.com.

What we process and why

• Account data (email address, sign-in codes, session information): to let you sign in, keep your documents and send account notices. Legal basis: contract.
• Document content (everything you type or import into resumes and cover letters, photos you upload, job postings you add): to provide the Service. Legal basis: contract. Content is processed only to render, export, analyse (ATS feedback) and — when you ask — to generate suggestions.
• AI processing: when you use writing assistance, the relevant facts from your document and the job posting are sent to our AI provider (Anthropic) to produce the suggestion. We send only what the feature needs, never your email, phone or payment data, and provider data is not used to train models under our agreement. Legal basis: contract / your request.
• Billing data (Stripe customer id, invoices, subscription status): to charge you and keep legally required records. Card numbers are handled by Stripe, not stored by us. Legal basis: contract and legal obligation.
• Share links: when someone opens a link you created, we record a hashed IP address and user agent to count views and filter bots. Counts are shown only to you.
• Support: messages you send us and, if you grant it, time-limited access to your documents. Every staff access is logged.
• Usage analytics: pseudonymous product events (page views, steps completed, exports) without document content, email addresses or phone numbers. Session replay is not used. Legal basis: legitimate interest in improving the Service.
• Marketing email: only with your consent, which you can withdraw at any time from the account page or the unsubscribe link.

Retention

• Raw imported files: 24 hours after processing.
• Temporary export files: 7 days (documents themselves stay in your account).
• Anonymous, never-paid drafts: 30 days after last activity.
• Accounts: until you delete them. Deletion removes documents, files, share links and cached exports; invoice records required by law are kept separately.
• Technical logs without personal data: 30 days.

Recipients

Supabase (database, authentication, storage), Vercel (hosting), Stripe (payments), Anthropic (AI suggestions, on request), our email delivery provider (account notices) and, with consent, our marketing email provider. Each acts under a data processing agreement. Transfers outside your region rely on standard contractual clauses or equivalent safeguards.

Your rights

You can access, export (account page → "Your data"), correct, delete and restrict processing of your data, object to processing based on legitimate interest and withdraw consent. Write to info@mbc-soft.com; you may also complain to your supervisory authority.

Security

Data is encrypted in transit and at rest, stored in a private database with per-user access rules, and files are kept in private storage with short-lived download links. Staff access to document content requires your grant and is audited.

Children

The Service is not directed at children under 16.

Changes

We will announce material changes on this page and, for account holders, by email.