ResumeJeHow ResumeJe collects, protects, and handles personal data under the Malaysian Personal Data Protection Act 2010 (PDPA).
ResumeJe (resumeje.my) is operated in Malaysia. This notice details the nature of personal data collected, processing justifications, and your legal rights under the Personal Data Protection Act 2010 (PDPA).
Name, email address, profile photo URL, and Google OAuth unique identifier when using social login.
Work history, education, certifications, contact info, and skills explicitly input into builder forms.
PDF and DOCX files uploaded for parsing are processed in-memory. The source file is immediately deleted upon completion; we never retain a permanent copy.
Company names, target positions, job descriptions, interview stages, and custom notes you record.
Share token IDs, view and download counters, plus viewer IP address and timestamp for audit verification.
Sign-in timestamps, session identifiers, client IP, browser user agent, and administrative actions.
We process your information exclusively to provide the services you request: compiling and rendering your résumés, executing ATS algorithms, synthesizing AI suggestions and tailored cover letters, organizing job applications, and securing your account against unauthorized access.
When activating AI features (Upload & Rewrite, ATS Score, Cover Letter, Section Enhancement, Summary Generation), relevant excerpts are sent via secure API to configured model providers. To guarantee high service availability, we maintain a resilient multi-provider fallback pipeline across HuggingFace, Groq, Mistral, OpenRouter, Google, and Ollama Cloud.
Scanned Document OCR: When uploading scanned or image-based PDFs lacking selectable text, the rendered page image is processed through Groq's multimodal vision model solely to extract text, after which the image buffer is purged.
We collaborate with vetted technical service providers under strict data handling boundaries:
| Service Provider | Operational Function |
|---|---|
| Neon Tech | Relational Database User accounts, structured résumés, application logs |
| Vercel Inc. | Edge Hosting & Application Servers HTTP requests, serverless execution, aggregate analytics |
| AI Model Providers (Groq, Mistral, Google, HuggingFace, OpenRouter, Ollama) | Generative AI & ATS Processing Résumé excerpts, job descriptions (ephemeral processing) |
| Upstash Inc. | Serverless Redis Rate-limiting counters, temporary AI cache keys |
| SMTP Gateway | Transactional Email Email address, password reset & verification tokens |
| Telegram Messenger | Admin Payment Verification Top-up receipt image / bank transfer ref (deleted post-review) |
ResumeJe does not process credit or debit card transactions. AI credit top-ups are completed manually through direct online banking transfer / DuitNow to our Touch 'n Go account. When submitting top-up requests at /topup, we record your chosen package, payment amount, bank reference number, and review status.
Payment receipts uploaded are forwarded to an administrative Telegram channel for verification and are removed upon approval/rejection. Receipts are never stored in our permanent PostgreSQL database.
All traffic is enforced over HTTPS with TLS 1.3 encryption across all client and backend endpoints.
Passwords are cryptographic salted and hashed with modern adaptive algorithms; plain-text is never saved.
HttpOnly, Secure, and SameSite cookie attributes protect your session from XSS and CSRF vectors.
Strict role-based isolation ensures user data is only readable by its authenticated owner.
Your account details and résumés persist as long as your account remains active. When you request account deletion, all personal data, share links, and résumés are permanently expunged, excluding records legally mandated for compliance (such as approved financial top-up transactions).
Under the Malaysian Personal Data Protection Act 2010 (PDPA), you possess fundamental statutory rights:
Request a complete portable copy of your account profile and stored résumé data.
Rectify outdated or inaccurate personal details in your profile settings or upon written notice.
Revoke consent for non-essential processing activities not mandatory for core application functionality.
Permanently purge your account, résumés, and shared links via Account Settings or verified support email.
To exercise your PDPA rights or submit inquiries regarding our privacy standards: