Privacy Policy
Effective Date: October 6, 2026 · Product of Morigrid Labs · buildairesume.com
1. Introduction & Our Privacy Commitment
At AIResume (a product of Morigrid Labs, "we," "us," or "our"), we respect your privacy and are committed to protecting the personal and professional data you entrust to us.
This Privacy Policy explains in detail how we collect, use, store, process, transfer, and safeguard your personal information when you access or use our website (buildairesume.com), our AI-assisted resume builder, job discovery engine, connected account services, Google Sign-In / OAuth integrations, and application automation features (collectively, the "Service").
By creating an account, authenticating via Google or email, or accessing the Service, you acknowledge that you have read, understood, and agreed to the practices described in this policy. We comply with international data protection standards, including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the Indian Digital Personal Data Protection Act (DPDP), and Google's API Services User Data Policy.
2. Information We Collect & Sources of Data
We only collect personal information that is strictly necessary to provide, optimize, and secure our career acceleration services. We categorize collected information as follows:
A. Information You Directly Provide to Us
- Account & Profile Details: Your name, email address, password hash (when using credentials sign-in), phone number, profile location, and account preferences.
- Resume & Professional Credentials: Work experience, job titles, employer histories, education, degrees, skills, technical proficiencies, professional certifications, portfolio/website links, summary statements, and cover letters.
- Job Search Preferences: Target job titles, preferred workplace types (Remote, Hybrid, On-site), geographic location targets, salary expectations, notice period availability, and active search intensity.
- Job Account Credentials (Optional): When you explicitly choose to connect job portals (such as Naukri, Indeed, or LinkedIn), we store encrypted portal access tokens or session credentials solely to automate job matching and submit approved applications on your behalf.
- Customer Support Communications: Inquiries, feedback, and support tickets submitted to our customer service desk.
B. Information Received from Third-Party Sign-In (Google OAuth)
When you choose to authenticate or register using Google Sign-In, we request and receive limited profile information through Google OAuth 2.0 protocols. Specifically:
- Google OAuth Scopes Requested: Basic identity scopes only:
openid,https://www.googleapis.com/auth/userinfo.profile, andhttps://www.googleapis.com/auth/userinfo.email. - Specific Data Elements Collected: Your verified Google email address, your full name, your profile avatar image URL, and your unique Google account identifier (subject ID).
- What We DO NOT Request: We never request access to, view, or store your Google Drive files, Gmail messages, Google Contacts, Google Calendar, search history, device location, or any other sensitive or restricted Google user data scopes.
C. Automatically Collected Technical & Diagnostic Information
- Usage Telemetry: Features accessed, templates selected, ATS scan scores, tailoring actions, and application tracking events.
- Device Diagnostics: Browser type and version, operating system, IP address, device type, language settings, and system error logs.
- Secure Cookies & Session Tokens: Secure HTTP-only authentication cookies and functional session identifiers required to maintain sign-in state and guard against CSRF attacks. (See our Cookie Policy for details).
3. How We Use Your Information & Purposes of Processing
We use your personal data strictly for legitimate business and service delivery purposes:
Authentication & Account Management
Verifying your identity, enabling frictionless passwordless login with Google, managing user sessions, and enforcing account security.
Resume Building & ATS Tailoring
Structuring your Master CV, generating tailored resume variants for specific job postings, computing ATS keyword match scores, and formatting exportable PDFs.
Job Matching & Discovery
Comparing your skills and career preferences against job listings from verified employers and connected boards to surface relevant opportunities.
Application Automation
Pre-filling application questions and submitting resumes to employer portals in accordance with your explicit plan limits, automation mode, and user approvals.
Essential Service Communication
Sending transactional notifications, application status updates, interview alerts, security advisories, and billing receipts.
Platform Security & Legal Compliance
Detecting fraudulent activities, preventing automated platform abuse, enforcing terms, and complying with statutory reporting requirements.
4. Google API User Data Policy & Limited Use Disclosure
Mandatory disclosure for users signing in or interacting with Google OAuth services.
Google API Limited Use Statement: AIResume's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.
When you authenticate with Google, we access and store only your Google user ID, verified email address, full name, and avatar image. We treat this data under strict safeguards:
Revocation of Google Permissions & Data Deletion
You can revoke AIResume's access to your Google account at any time by visiting Google Security & Permissions . Furthermore, you may request permanent deletion of your account and all associated Google user data at any time via your Account Settings or by emailing [email protected]. Upon receipt, all stored Google user data is completely erased from our databases within 30 days.
5. AI Processing & Generative Content Safeguards
AIResume leverages advanced artificial intelligence models to assist you in writing compelling bullet points, analyzing job descriptions, calculating ATS compatibility, and tailoring your credentials.
- Zero Public Model Training: Your private resume content, personal identifiers, Google account details, and application notes are never used to train public generative AI foundation models.
- Zero-Data-Retention Enterprise APIs: AI inference is conducted strictly via enterprise API agreements featuring zero-data-retention compliance policies, meaning models do not retain your data after fulfilling the request.
- Candidate Factual Evidence Integrity: AI tailoring operates as an editor and summarizer of your factual Master CV. It is configured never to fabricate qualifications, employment history, or work authorizations.
- Full User Ownership: You retain complete intellectual property ownership and editorial control over all resume content generated, edited, or exported through the Service.
6. Third-Party Sharing, Subprocessors & Zero-Sale Guarantee
We do not sell, rent, or trade your personal data or resume records to data brokers, recruiters, or advertisers. We share your information only in the limited circumstances described below:
- Hiring Employers & Job Boards (Upon Your Request): When you manually trigger or authorize automated job applications, your tailored resume, contact details, and application answers are submitted directly to the employers or job boards hosting that listing.
- Cloud Infrastructure & Database Hosting: Encrypted hosting providers (such as VPS hosting and MongoDB cloud infrastructure) that store data subject to strict confidentiality and security agreements.
- Certified Payment Processors: Subscription payments are processed via certified, PCI-DSS Level 1 compliant gateways (such as Stripe, Razorpay, or Polar). We do not store raw credit card numbers on our servers.
- Transactional Email Services: Encrypted delivery services used exclusively to deliver verification codes, password resets, and critical account notices.
- Legal & Regulatory Authorities: Only when strictly required by a valid court order, subpoena, or applicable statutory law.
7. Connected Job Search Accounts & External Portals
If you choose to link external job search accounts (such as Naukri, Indeed, or LinkedIn), AIResume uses these integrations solely to facilitate job discovery and perform automated application actions that you have explicitly enabled.
- Bank-Grade Encryption: All linked portal credentials and session cookies are secured using bank-grade AES-256-GCM encryption before storage.
- One-Click Disconnection: You can disconnect any linked portal account at any time through your Job Settings. Upon disconnection, stored authentication keys are permanently scrubbed from our active servers.
- No Credential Sharing: Your linked portal credentials are never shared with external recruiters, advertisers, or third parties.
8. Data Security & Cryptographic Safeguards
We employ multi-layered technical, physical, and administrative safeguards to protect your personal information against unauthorized access, loss, or alteration:
- Encryption in Transit: All web traffic, API calls, and authentication flows are protected using modern Transport Layer Security (TLS 1.3 / HTTPS).
- Encryption at Rest: Sensitive candidate tokens, resume artifacts, and database collections are encrypted at rest with AES-256 algorithms.
- Secure Cookie Handling: Authentication cookies are marked with
Secure,HttpOnly, andSameSite=Laxattributes to mitigate session hijacking and cross-site request forgery. - Principle of Least Privilege: Server access is strictly restricted to authenticated operations staff with multi-factor authentication.
9. Data Retention & Account Deletion (Right to be Forgotten)
We retain your personal information, resumes, and application records only for as long as your account remains active or as required to fulfill the purposes set out in this policy.
How to Request Permanent Account Deletion:
- Self-Service: You can initiate account deletion directly within your AIResume Dashboard under Settings > Account > Delete Account.
- Direct Request: You can submit a deletion request by emailing our privacy team at [email protected] with the subject line "Delete My Account".
What happens upon deletion: All personal data, Google account identifiers, tailored resume documents, application histories, and portal credentials are permanently wiped from our active databases within thirty (30) days. Encrypted backups are routinely overwritten in the ordinary course of business.
10. Your Rights Under Global Data Protection Laws
Depending on your location (including the European Economic Area, United Kingdom, United States, and India), you hold statutory rights regarding your personal information:
- Right of Access & Portability: Obtain a structured, machine-readable export of all your resumes, profile data, and application tracking records.
- Right of Rectification: Edit, update, or correct incomplete or inaccurate career history at any time.
- Right of Erasure: Have your account and personal identifiers permanently removed.
- Right to Restrict or Object: Pause automated job matching or revoke third-party authorizations (such as Google OAuth or job portal keys).
- Non-Discrimination: We do not discriminate against any user for exercising their privacy rights.
11. Contact Our Data Protection Officer
If you have questions, feedback, or requests regarding this Privacy Policy, our Google OAuth data practices, or would like to exercise your data rights, please contact our Data Protection Officer:
Entity: Morigrid Labs (AIResume)
Primary Website: buildairesume.com
Privacy Inquiries & DPO Email: [email protected]
Legal & Compliance Desk: [email protected]
Support Center: Support Desk