Skip to main content

Privacy Policy

Last updated: 2026-07-16

This Privacy Policy explains what personal data the operator of PeakResume ("we", "us", "our") processes when you use PeakResume at https://peakresu.me (the "Service"), the legal bases we rely on, and the rights available to you under the EU General Data Protection Regulation (GDPR) and other applicable law.

1. Data we collect

  • Account data — email address, name, username, and password hash (or your OAuth identity if you sign in with a third-party provider).
  • Content — the resumes and documents you create, including any personal details you choose to put in them.
  • Billing data — handled by Stripe. We store only subscription status and customer references, never card numbers.
  • Technical data — basic server logs (IP address, user agent) for security, rate limiting, and debugging.
  • Product analytics — pseudonymized funnel and event data, used in aggregate to understand and improve the Service.

2. How we use your data — legal bases

  • Contract (Art. 6(1)(b) GDPR) — creating and running your account, storing and rendering your documents, serving your public resume link if you enable one, processing payments, sending transactional email (verification, password reset, billing), and providing support.
  • Legitimate interest (Art. 6(1)(f) GDPR) — securing the Service, preventing abuse and fraud, rate limiting, debugging, and aggregate, pseudonymized product analytics to improve the Service. We balance this against your rights; you can object at any time (see "Your rights" below).
  • Consent (Art. 6(1)(a) GDPR) — used where required, for example optional non-essential cookies. You can withdraw consent at any time.

We do not sell your data. We do not use your resume content to train AI models, and we do not use it for advertising.

3. AI features and your own API key (BYOK)

If you use AI-assisted features, they run against an AI provider you connect with your own API key. Resume content you send to AI features goes to that provider under that provider's own terms and privacy policy. You choose that provider — it is not our sub-processor, and we do not control or have visibility into its processing of your data. Review your chosen AI provider's terms before connecting a key.

4. Sub-processors and hosting

  • Hetzner Online GmbH (Germany) — infrastructure hosting. Your data is hosted in the EU (Germany).
  • Stripe Payments Europe, Ltd. — payment processing, only when you make a purchase.
  • Email delivery — self-hosted. We do not use a third-party email service to send account or transactional email.
  • Storage, database, and cache — self-hosted. No third-party provider processes this data.

5. International data transfers

None by default: our infrastructure runs on EU hosting (Germany), so no transfer outside the EU/EEA occurs for our own systems by default. Stripe processes payment data under its own EU entity (Stripe Payments Europe, Ltd.), per its applicable safeguards. If you connect a non-EU AI provider under "AI features and your own API key" above, any transfer to that provider is governed by your agreement with that provider, not by us.

6. Retention periods

  • Account data — retained while your account exists; deleted when you delete your account.
  • Backups — rolling backups expire within 30 days.
  • Server logs — retained up to 90 days for security and debugging, then deleted.
  • Funnel/event analytics log — pseudonymized; the associated user identifier is cleared when you delete your account, though aggregate pseudonymized records may persist.

7. Cookies

We use essential cookies for authentication and session management — strictly necessary, and sign-in will not work without them. Optional analytics cookies, where used, are disclosed at the time consent is requested and are consent-gated; you can withdraw consent at any time.

8. Your rights

Under the GDPR you have the right to: access your data, rectification of inaccurate data, erasure ("right to be forgotten"), data portability, and objection to processing based on legitimate interest. You also have the right to lodge a complaint with the data protection supervisory authority in your country.

Self-serve deletion: you can delete your account and all associated data at any time from Settings → Danger Zone. To exercise any other right, contact us below.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the Service; continued use after changes take effect constitutes acceptance.

10. Contact

Data controller: the operator of PeakResume. Questions or requests: [email protected]

PeakResume Loading