Privacy Policy
Your resume is personal. This page says exactly what we collect, what leaves our servers, where it goes, and how to get it back or deleted.
Last updated 2 August 2026
1. Scope
This policy explains what Ikarmic AI Services and Solution OPC Pvt. Ltd. ("we", "us") does with your personal data when you use AI Resume Maker — the website, the free tools, and the signed-in app.
We are the data fiduciary for that data under India's Digital Personal Data Protection Act, 2023. For anything in this policy, write to support@airesumemaker.online.
2. What we collect
We collect only what the service needs to work:
- Account data: your name, email address, and a hashed password. We never store your password in readable form, and there is no password at all if you signed up with Google.
- Profile and document content: everything you enter or upload: work history, education, skills, projects, uploaded resume files, and the job descriptions you paste in.
- Generated output: the resumes, CVs, cover letters, ATS scores and reviews the service produces for you.
- Interview data: the full transcript of each mock interview and the feedback generated at the end.
- Billing data: your plan, credit balance, transaction IDs and payment status. Card numbers, UPI PINs and netbanking credentials go straight to the payment gateway and never reach our servers.
- Usage data: pages viewed, features used, IP address, browser and device type, and timestamps.
3. Why we use it
Each purpose maps to something you asked the service to do:
- To generate the documents, scores, reviews and interview questions you request.
- To run your account, apply your plan's limits for each billing period, and debit and refund credits correctly.
- To take payment and to renew or cancel a subscription.
- To send service email: verification, password reset, receipts, and notices about your plan.
- To keep the service secure, investigate abuse, and meet legal and tax obligations.
- To understand which features get used, so we can improve them.
4. Signing in with Google
You can create your account with an email address and password, or with Google. Google sign-in is optional — the service works fully without it.
If you use it, Google gives us three things: your name, your email address and your profile picture. We request nothing else. We do not ask for and cannot read your Gmail, Google Drive, Calendar, Contacts or any other Google service.
We use those three things for one purpose: to create your account, recognise you when you sign in again, and send service email such as verification, receipts and password resets. We do not sell this data, share it with advertisers, or use it to train any AI model.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can revoke our access at any time from your Google Account's security settings, and deleting your account from Data & privacy under Account removes this data with it.
5. AI processing and cross-border transfer
This is the part most worth reading. To generate a resume, score it, review it, or run a mock interview, we send the relevant text — your profile and resume content, the job description you pasted, and your interview answers — to our AI provider, over an encrypted connection.
Our AI provider currently processes this outside India, which counts as a cross-border transfer under India's DPDP Act. Using the service today means that transfer takes place. If you are not comfortable with it, do not paste content into the tools.
We send only the text needed for the task you triggered. We do not send your name, email, password or payment details to the AI provider unless you have typed them into your resume content yourself.
We do not sell your data, and we do not use your resume or interview content to train our own models.
Every AI call leaves a short log entry in your account (input, output, model, timestamps) for up to 24 months. You can shorten or extend this, request a full download, or request immediate single-row erasure from /settings/data.
Anonymous free-tool submissions leave a log entry attached to a hashed IP address only, never to an account.
6. Who else sees your data
We share data with service providers only to the extent each one needs it to do its job:
- Deepseek — AI generation and scoring, as described above.
- Razorpay — payment processing, subscription renewal and refunds.
- Amazon Web Services — hosting and database.
- Brevo — transactional email (verification, receipts, password resets). Brevo is hosted in the EU, so sending you an email is a cross-border transfer under India's DPDP Act, separate from the AI processing described in section 5.
- Careerjet — job search. Your search terms, and your IP address for anonymous searches, are sent to their API; your resume is not.
- Google Analytics, Meta Pixel and Microsoft Clarity — website analytics, where enabled. Microsoft Clarity records how you interact with pages, including mouse movement and clicks. These run on the public marketing pages; you can block them with a browser setting or extension.
7. Where your data is stored
Your account, profile, documents, interview transcripts and billing records are stored in AWS's Mumbai region (ap-south-1), in India, encrypted at rest and in transit.
The exceptions are the AI processing described in section 5, the transactional email sent through Brevo (hosted in the EU), and any analytics provider you have not blocked — all of which operate outside India.
8. How long we keep it
We keep your account data and content for as long as your account is open, because that is what makes your saved documents and history available to you.
Delete a document or an interview and it is removed. Close your account and we delete your personal data within 30 days, except records we are legally required to retain — payment and tax records are kept for the period Indian law requires.
Content submitted to a free tool without an account is processed to return your result and is not attached to any profile.
9. Your rights
Under the DPDP Act you can ask us to:
- Tell you what personal data of yours we hold and who we have shared it with.
- Correct or complete data that is wrong or out of date. Most of this you can do yourself from your profile page.
- Delete your data and close your account.
- Withdraw consent for processing, understanding that this may mean we can no longer provide the service.
- Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
10. How to exercise them
Most of it is self-service: sign in and open Data & privacy under Account. From there you can see what we hold, download it as a ZIP, change or withdraw each consent, set your AI-history retention period, erase individual AI records, name a nominee, and delete your account.
If you would rather write to a person, our Grievance Officer is reachable at support@airesumemaker.online. Write from the address on your account. We will verify it is you, then respond within 30 days.
If you are not satisfied with how we handled a request, you can complain to the Data Protection Board of India.
11. Cookies and sessions
We set a session cookie when you sign in. It is required — without it we cannot keep you logged in — and it carries no advertising identifier.
Analytics and marketing cookies on the public pages are off until you accept them in the cookie banner. Your choice is stored in a consent_prefs cookie for 180 days; clear it to be asked again. Signed-in pages load no analytics scripts at all.
12. The browser extension
Our Job Clipper extension for Chrome and Edge reads the job posting on a page only when you click its icon on that page. It has no standing access to any website: the permission it uses lasts for that click and expires when you navigate away, so it cannot read pages in the background or pages you have not sent it to.
What it sends is the posting itself — title, company, location and description — to your own account on our servers in Mumbai. It sends nothing to anyone else, and it cannot read anything back out of your account. The connection uses a token stored in your browser, never your password.
You can see every browser you have connected, and disconnect any of them, under Data & privacy in your account. Disconnecting takes effect immediately: the extension asks us for permission every time you clip a posting, and a disconnected browser is refused.
13. Security
Passwords are hashed. Traffic to the site runs over HTTPS. The database is not reachable from the internet: it runs on a private network on the same machine as the application, on an encrypted disk. Payment gateway credentials are encrypted before storage, and application secrets are held in AWS Systems Manager Parameter Store rather than in code.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board as the DPDP Act requires.
14. Children
The service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.
15. Changes to this policy
We will update this page when our practices change and update the date at the top. If a change materially affects your rights, we will tell you by email or in the app before it takes effect.
16. Contact
Grievance Officer: Grievance Officer, support@airesumemaker.online. This is the person named under section 8(10) of the DPDP Act to answer questions, requests and complaints about your personal data.
Use the subject line "Privacy". We acknowledge within 48 hours and respond within 30 days.