Privacy Policy

This Privacy Policy explains how Refyn (“we,” “us,” or “our”) collects, uses, discloses, and safeguards your information when you use the Refyn website and AI-powered resume-tailoring service (the “Service”). By using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

1. Who We Are

Refyn is an AI-powered platform that helps you tailor your resume to specific job descriptions. For the purposes of the EU/UK General Data Protection Regulation (“GDPR”), Refyn is the “data controller” of your personal information. You can reach us at support@refyn.live.

2. Information We Collect

Information you provide

Account information. When you create an account, we collect your name, email address, and password. Authentication is handled by Amazon Web Services (AWS) Cognito; your password is stored and managed by Cognito and is never stored in plain text by us.
Resume content. The resumes you upload or create, including their LaTeX source, extracted text, generated PDFs, and the version history of your edits.
Job descriptions. The job descriptions you submit and the metadata we parse from them (such as company name, role title, and location).
Communications. Information you provide when you contact us for support.

Payment information

If you purchase a subscription, payments are processed by Stripe, Inc. We do not collect or store your full card number. Stripe provides us with limited billing details such as your subscription status, plan, billing period, and the last four digits and brand of your card. Your payment data is handled in accordance with Stripe’s Privacy Policy.

Information collected automatically

Cookies. We use strictly necessary cookies (rf-access and rf-id) to keep you signed in and maintain your session. These are required for the Service to function.
Technical and diagnostic data. We use Sentry to capture errors and performance data, which may include your IP address, browser type, device information, and a record of the actions that led to an error. This helps us diagnose and fix problems.

We do not use third-party advertising or marketing analytics trackers.

3. How We Use Your Information

To provide, operate, and maintain the Service.
To tailor your resume to job descriptions, including analyzing fit, identifying gaps, and generating tailored content using AI.
To create and manage your account and authenticate you.
To process subscriptions, billing, and trials.
To respond to your support requests.
To monitor, debug, and improve the reliability, security, and performance of the Service.
To comply with legal obligations and enforce our terms.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

Performance of a contract — to provide the Service you have signed up for, including processing your resumes and job descriptions and managing your subscription.
Legitimate interests — to secure, debug, and improve the Service, where those interests are not overridden by your rights.
Consent — where required; you may withdraw consent at any time.
Legal obligation — to comply with applicable laws.

5. How We Share Your Information

We do not sell your personal information. We share information only with the service providers (“sub-processors”) that help us run the Service:

Amazon Web Services (AWS) — hosting, database, and Cognito authentication.
Anthropic (Claude API) — to analyze and generate tailored resume content. Your resume and job-description content is sent to Anthropic to deliver this feature.
OpenAI — to generate text embeddings used for semantic matching between your resume and job descriptions.
Stripe — to process payments and manage subscriptions.
Sentry — for error and performance monitoring.

These providers are permitted to use your information only to perform services for us. We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change in ownership.

6. AI Processing of Your Content

Tailoring is performed by sending your resume content and the relevant job description to third-party AI providers (Anthropic and OpenAI) for processing. We send only the content needed to perform the requested task. These providers act as our processors for this purpose. We encourage you not to include sensitive personal information in your resume beyond what is necessary for a job application.

7. Data Retention

We retain your account information and content for as long as your account is active. If you delete content or close your account, we delete or anonymize the associated personal information within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Diagnostic data captured by Sentry is retained according to its standard retention schedule.

8. Security

We use industry-standard measures to protect your information, including encryption in transit, managed authentication through AWS Cognito, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

EEA / UK residents (GDPR)

You have the right to:

Access the personal information we hold about you;
Request correction of inaccurate information;
Request erasure of your information (“right to be forgotten”);
Restrict or object to certain processing;
Request portability of your information;
Withdraw consent where processing is based on consent; and
Lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA)

You have the right to:

Know what personal information we collect and how we use it;
Request deletion of your personal information;
Request correction of inaccurate personal information;
Opt out of the sale or sharing of personal information; and
Not be discriminated against for exercising your rights.

We do not sell or share your personal information for cross-context behavioral advertising, and we do not knowingly process sensitive personal information for those purposes. To exercise any of these rights, contact us at support@refyn.live. We will respond within the timeframes required by applicable law and may need to verify your identity before fulfilling your request.

10. International Data Transfers

We and our service providers are based in the United States, and your information may be processed in the United States and other countries whose data-protection laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for such transfers.

11. Children’s Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at support@refyn.live.