Resuvia — Legal

Privacy Policy

Effective Date: June 6, 2026  ·  Last Updated: June 6, 2026

1. Scope

This Privacy Policy applies to the Resuvia — Career Guide+ mobile application ("App") published by XentarAI Inc. ("we," "us," or "our"), a company incorporated in Canada. It does not apply to the xentarai.com website (covered separately at Site Privacy Policy).

This policy covers users in all regions where the App is available, including the United States, Canada, the United Kingdom, the European Union and European Economic Area, Australia, New Zealand, and South Africa. Where applicable law provides additional rights or imposes specific obligations, those are addressed in the jurisdiction-specific sections below.

By installing or using the App you agree to the practices described here. If you do not agree, please do not use the App.

Résidents du Québec : La version française complète de cette politique est disponible en cliquant sur FR ci-dessus.

2. Information We Collect

2.1 Account Information

When you create an account we collect your first name, last name, email address, and a display name. Authentication is performed via one-time passcode (OTP) sent to your email; we do not store passwords. You may also use the App as an anonymous Guest without providing any personal information.

2.2 Résumé File Name

We store the file name of your uploaded résumé on our servers (e.g., "my_resume.pdf") solely to display it back to you. The actual PDF content is never uploaded to our servers. PDF parsing and text extraction happen entirely on your device.

2.3 Résumé and Job Description Content (AI Processing)

When you run an analysis, the text extracted from your résumé and the job description you provide are transmitted to third-party AI providers to generate your ATS score, improvement suggestions, and career guidance. See Section 5 for the specific providers. This content is sent over an encrypted channel and is subject to those providers' data handling terms. We do not use your résumé or job description content to train our own models.

2.4 Locally Cached Data

Your résumé file and, for Pro subscribers, up to 20 résumé versions are stored locally on your device in the app's private storage directory, encrypted with AES-256-GCM. This data never leaves your device except as described in Section 2.3 for AI analysis. Cached résumé files are automatically deleted after 60 days.

2.5 Usage and Analytics Data

We use PostHog (product analytics) to understand how features are used. Data collected includes feature interactions, screen views, and anonymised device and platform information. This data is linked to a randomly generated UUID, not your name or email. Analytics collection is consent-gated: users in the EU, EEA, UK, Switzerland, Brazil, and Canada are asked for explicit opt-in consent before any analytics data is collected. All other users may opt out at any time via in-app settings.

2.6 Crash Reports

We use Sentry for crash reporting. If the App crashes, a report including the stack trace, device model, OS version, and App version is sent. No personally identifiable information (name, email, résumé content) is included in crash reports. Crash reporting is consent-gated in the same jurisdictions listed above.

2.7 In-App Purchases

Pro subscriptions are purchased through the Apple App Store (iOS) or Google Play Store (Android). All billing and payment processing is handled entirely by Apple or Google. We do not collect, process, or store credit or debit card numbers or billing addresses. We receive only a non-reversible transaction receipt and a randomly generated account token from the platform to verify your subscription status.

2.8 Advertising Data (Free Tier Only)

The free tier of the App displays interstitial advertisements served by Google AdMob. Google AdMob may collect your device's advertising identifier (IDFA on iOS, GAID on Android) and use it to serve personalised ads. On iOS, this collection requires your explicit consent under Apple's App Tracking Transparency (ATT) framework, and we will prompt for this before any identifier is shared. This collection constitutes sharing of personal information for cross-context behavioural advertising purposes, which may be treated as a "sale" or "sharing" under the California Consumer Privacy Act (see Section 11) and analogous state laws. Pro subscribers do not see ads and are not subject to this data collection.

Notice for Quebec residents (Law 25, s. 8.1): The App uses profiling technology (Google AdMob, free tier only) that may identify or profile you for advertising purposes. You have the right to be informed of this and to opt out at any time. To opt out: deny ATT consent on iOS, or reset your advertising ID on Android (Settings → Privacy → Ads). Upgrading to Pro also removes all advertising and profiling entirely.

2.9 Biometric Authentication

If you enable biometric login (Face ID / fingerprint), your biometric credentials are handled entirely by your device's operating system (iOS Keychain, Android Keystore). We never have access to your raw biometric data. We store only a boolean flag indicating that biometric authentication is enabled for your account.

2.10 Technical and Device Information

We collect minimal technical information necessary to operate the App, including your device's platform (iOS/Android), App version, and session identifiers. IP addresses used during network requests are processed by our backend infrastructure but are not stored long-term as part of your user record.

3. How We Use Your Information

  • To create and manage your account and authenticate your identity
  • To provide AI-powered résumé analysis, ATS scoring, and career guidance
  • To verify and fulfil your Pro subscription
  • To display your résumé history and analysis results
  • To send transactional emails (OTP codes, account notifications)
  • To diagnose crashes and fix bugs (with consent, where required)
  • To understand feature usage and improve the App (with consent, where required)
  • To serve advertisements on the free tier (iOS: only with ATT consent)
  • To comply with legal obligations and enforce our Terms of Use
  • To detect and prevent fraud, abuse, and security threats

4. Legal Bases for Processing (GDPR / UK GDPR)

For users in the EU, EEA, UK, and Switzerland, we rely on the following legal bases:

  • Contract performance — account creation, authentication, résumé analysis, subscription management
  • Consent — analytics (PostHog), crash reporting (Sentry), and personalised advertising (AdMob / ATT). You may withdraw consent at any time in Settings → Account Preferences → Privacy & Consent.
  • Legitimate interests — fraud prevention, abuse detection, improving service reliability. We have assessed that these interests are not overridden by your fundamental rights and freedoms.
  • Legal obligation — disclosures or processing required by applicable law

We have not appointed a Data Protection Officer (DPO) as we do not meet the thresholds requiring mandatory appointment under Article 37 GDPR. Privacy questions may be directed to contactus@xentarai.com.

5. Third-Party Services and Data Sharing

We do not sell your personal information to data brokers or advertising networks (other than as described in Section 2.8 regarding AdMob). We share data only with the following categories of recipients:

5.1 Backend Infrastructure

Supabase (Supabase Inc., USA) hosts our database and backend APIs. Your account information, résumé file name, analysis results, and subscription status are stored on Supabase infrastructure in the US-East region. Transfers from the EEA are governed by Standard Contractual Clauses (EU SCCs, 2021). Transfers from the UK are governed by the UK International Data Transfer Addendum (UK IDTA) to those SCCs. Transfers from Australia, New Zealand, and South Africa are subject to the cross-border transfer safeguards described in Sections 15–17.

5.2 AI Providers

Résumé text and job description text are transmitted to one or more of the following AI services depending on your subscription tier and region:

  • Anthropic (USA — Pro tier) — Claude Haiku model
  • Google (USA — Free and Pro fallback) — Gemini Flash model
  • Mistral AI (France — Free tier and fallback) — Mistral Small model

These providers process your résumé and job description content solely to generate the analysis returned to you. They do not use this content to train their models (subject to each provider's current data processing terms). API calls are routed through our own backend; AI API keys are never exposed client-side.

5.3 Job Description Scraping

When you provide a job posting URL, the App may transmit that URL to one or more of the following third-party services to retrieve the job description text: Jina AI Reader, Wayback Machine / archive.today (Internet Archive), ScrapingAnt, Apify, or Firecrawl. Only the URL is shared; your personal information and résumé content are not transmitted to these services. You can paste the job description text directly to avoid URL scraping entirely.

5.4 Email Delivery

Resend (primary, USA) and Brevo (fallback, France) deliver OTP authentication codes and account-related emails to your email address.

5.5 Analytics

PostHog (PostHog Inc., USA) — product analytics, consent-gated as described in Section 2.5.

5.6 Crash Reporting

Sentry (Functional Software, Inc., USA) — crash diagnostics, consent-gated as described in Section 2.6.

5.7 Advertising

Google AdMob (Google LLC, USA) — interstitial ads on the free tier only. See Section 2.8.

5.8 App Stores

Apple App Store and Google Play Store handle all in-app purchases. Your payment data is governed by Apple's and Google's respective privacy policies.

5.9 Legal Requirements and Business Transfers

We may disclose personal information if required by law, court order, or governmental authority. In the event of a merger, acquisition, or asset sale, your information may be transferred to the successor entity subject to the same protections described here, and we will provide notice before any such transfer.

6. Data Security

We implement the following technical and organisational measures:

  • All data in transit is encrypted using TLS 1.2 or higher
  • Locally cached résumé files are encrypted at rest using AES-256-GCM with a per-user 256-bit key stored in the device's secure element (iOS Keychain / Android Keystore) with first-unlock-only access
  • Authentication uses one-time passcodes (OTP); no passwords are stored
  • API keys for AI services are stored in our backend vault and are never embedded in the App binary
  • Row-Level Security restricts all database access to the authenticated user's own data
  • Account deletion requires OTP verification and is rate-limited
  • Sign-in attempts are rate-limited with progressive delays after repeated failures

No method of electronic transmission or storage is 100% secure. While we use commercially reasonable measures, we cannot guarantee absolute security.

7. Data Breach Notification

In the event of a personal data breach we will:

  • EU/EEA (GDPR) — notify the relevant supervisory authority within 72 hours of becoming aware of the breach if it is likely to result in a risk to your rights and freedoms, and notify affected individuals without undue delay if the breach is likely to result in a high risk.
  • UK (UK GDPR) — notify the ICO within 72 hours and notify affected individuals where required.
  • Canada — PIPEDA — notify the Office of the Privacy Commissioner and affected individuals as soon as feasible when a breach creates a real risk of significant harm.
  • Canada — Quebec Law 25 — notify the Commission d'accès à l'information (CAI) and affected individuals within 72 hours of becoming aware of a confidentiality incident presenting a risk of serious injury. We maintain a confidentiality incident register as required by Law 25.
  • Australia (NDB Scheme) — notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable where a breach is likely to result in serious harm.
  • New Zealand — notify the New Zealand Privacy Commissioner and affected individuals as soon as reasonably practicable where a breach is likely to cause serious harm.
  • South Africa (POPIA) — notify the Information Regulator and affected data subjects as soon as reasonably possible after becoming aware of a compromise.

Breach notifications will describe the nature of the breach, the data affected, likely consequences, and the steps we are taking to address it.

8. Data Retention

  • Account data — retained for the lifetime of your account, then deleted upon account deletion
  • Analysis results — retained in your account; Pro subscribers retain up to 20 résumé versions in History Vault
  • Locally cached résumé files — automatically deleted after 60 days, or immediately upon account deletion
  • Analytics data (PostHog) — retained per PostHog's default retention period; you may request erasure via in-app consent settings
  • Crash reports (Sentry) — retained per Sentry's default retention period
  • Deleted account data — account records are deleted from our servers upon confirmed account deletion; encrypted backups may retain data for up to 30 additional days
  • Anonymised billing records — a minimal, fully anonymised billing record (containing no personal information) may be retained for up to 7 years after account deletion as required by applicable tax and financial regulations. This record cannot be used to identify you.

You may request deletion of your account at any time from within the App (Settings → Profile → Delete Account), or via our web-based account deletion page at xentarai.com/products/resuvia/delete-account.html. Both options are available without needing to contact us. In-app deletion is immediate and irreversible; web-based deletion is processed within 30 days. Both methods require identity verification.

9. Children's Privacy

The App is a career tool intended for adult job seekers. Minimum age requirements by jurisdiction:

  • South Africa — minimum age 18 years (POPIA defines a "child" as a person under 18)
  • EU / EEA / UK / Switzerland — minimum age 16 years (GDPR / UK GDPR digital services threshold)
  • All other jurisdictions — minimum age 13 years

We do not knowingly collect personal information from anyone below the applicable minimum age. If you believe a minor has created an account, contact us at contactus@xentarai.com and we will promptly delete it.

10. Your Rights — EU / EEA / UK / Switzerland (GDPR & UK GDPR)

If you are in the European Union, European Economic Area, United Kingdom, or Switzerland, you have the following rights:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate or incomplete data
  • Erasure — request deletion of your personal data (subject to legal retention requirements)
  • Restriction — request that we limit how we process your data
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interests or for direct marketing
  • Withdraw consent — withdraw any consent at any time via Settings → Account Preferences → Privacy & Consent, without affecting the lawfulness of prior processing
  • Automated decision-making — the right not to be subject to solely automated decisions producing significant legal effects. Our ATS scoring uses AI but is not used to make legally binding decisions about you.

To exercise any of these rights, contact us at contactus@xentarai.com. We will respond within 30 days (one calendar month), extendable by a further two months for complex requests. You also have the right to lodge a complaint with your local supervisory authority: your national Data Protection Authority in the EU/EEA, the ICO in the UK, or the FDPIC in Switzerland.

11. Your Rights — California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides the following rights:

  • Right to Know — request disclosure of the categories and specific pieces of personal information collected, the sources, the business purpose, and the categories of third parties with whom we share it
  • Right to Delete — request deletion of personal information we have collected, subject to certain exceptions
  • Right to Correct — request correction of inaccurate personal information
  • Right to Opt-Out of Sale / Sharing — the sharing of your device advertising identifier (IDFA/GAID) with Google AdMob for personalised advertising may constitute a "sale" or "sharing" under CCPA. To opt out: on iOS, deny or revoke ATT consent in iOS Settings → Privacy & Security → Tracking. On Android, opt out of your advertising ID in Android Settings → Privacy → Ads. Pro subscribers are not subject to AdMob data collection.
  • Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information for purposes beyond what is necessary to provide the App
  • Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights

To submit a verifiable consumer request, contact us at contactus@xentarai.com. We will respond within 45 days. You may designate an authorised agent to make requests on your behalf.

CalOPPA disclosure: We will notify you of material changes to this Privacy Policy by updating the "Last Updated" date above. A link to this policy is available from within the App and on the Resuvia product page.

12. Your Rights — Other US State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), and other US states with comprehensive privacy laws have rights that broadly parallel the CCPA rights in Section 11, including the right to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt out of targeted advertising. To exercise these rights, contact us at contactus@xentarai.com. We will respond within the time period required by your state's applicable law (typically 45 days). We do not make decisions that have significant legal or similarly significant effects on consumers solely through automated means without appropriate safeguards.

13. Your Rights — Brazil (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) provides rights including access, correction, deletion, portability, information about sharing, and the right to withdraw consent. Analytics and crash reporting require your explicit consent in Brazil. To exercise your rights, contact us at contactus@xentarai.com. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

14. Your Rights — Canada (PIPEDA & Quebec Law 25)

XentarAI Inc. is a Canadian company subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Law 25 / Bill 64).

  • Consent — we collect personal information only with your knowledge and consent, or as permitted by law. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us.
  • Limiting collection — we collect only what is necessary for the purposes identified here.
  • Access and correction — you have the right to access your personal information and request correction of inaccuracies.
  • Right to de-indexing (Quebec) — Quebec residents may request that we cease disseminating personal information or de-index any hyperlinks attached to their name, where technically feasible.
  • Automated profiling (Quebec) — our ATS scoring uses AI-based automated processing. You have the right to be informed of this and to request human review of results.
  • Technology-based profiling (Quebec — Law 25, s. 8.1) — the App uses Google AdMob (free tier only) which may profile your advertising interests. We disclose this as required by Law 25. You may opt out at any time as described in Section 2.8.
  • Confidentiality incidents (Quebec — Law 25) — we maintain a register of all confidentiality incidents as required by Law 25. In the event of an incident presenting a risk of serious injury, we will notify the CAI and affected individuals within 72 hours.
  • Breach notification (PIPEDA) — we will report breaches creating real risk of significant harm to the Office of the Privacy Commissioner and notify affected individuals as required by PIPEDA.
  • Privacy Officer — XentarAI Inc. has designated Bidisha Das, Founder & Director as Privacy Officer responsible for compliance with PIPEDA and Quebec Law 25. Contact: contactus@xentarai.com (subject: "Privacy Officer — Privacy Request").

If unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (OPC) or, for Quebec residents, the Commission d'accès à l'information du Québec (CAI).

15. Your Rights — Australia (Privacy Act 1988 / Australian Privacy Principles)

We handle personal information of Australian residents in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

  • Access (APP 12) — you may request access to the personal information we hold about you by contacting us. We will respond within a reasonable period (generally 30 days). We may charge a reasonable fee for access requests in limited circumstances.
  • Correction (APP 13) — if information we hold is inaccurate, out of date, incomplete, or misleading, you may request correction. We will correct or associate a statement of disagreement with the record.
  • Anonymity (APP 2) — where lawful and practicable, you may use the App anonymously (Guest mode).
  • Cross-border disclosure (APP 8) — we disclose personal information to overseas recipients (Supabase, Anthropic, Google, Mistral AI, PostHog, Sentry, Resend, Brevo, and others listed in Section 5), all located in the United States or France. Before doing so, we take reasonable steps to ensure these recipients do not breach the APPs in relation to your information, including by relying on contractual data processing agreements with those providers. By using the App, you acknowledge that we may not be accountable under the Privacy Act if an overseas recipient handles your information in breach of the APPs, and that you may not be able to seek redress from the OAIC in respect of that overseas handling.
  • Direct marketing (APP 7) — we do not use your personal information for direct marketing beyond transactional communications (OTP, account notices). You may opt out of any non-essential communications at any time.
  • Notifiable Data Breaches (NDB Scheme) — see Section 7 for our breach notification obligations.

To exercise your rights or make a privacy complaint, contact us at contactus@xentarai.com. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

16. Your Rights — New Zealand (Privacy Act 2020)

We handle personal information of New Zealand residents in accordance with the Privacy Act 2020 and the Information Privacy Principles (IPPs).

  • Access (IPP 6) — you have the right to request access to personal information we hold about you. We will provide access within a reasonable period.
  • Correction (IPP 7) — you have the right to request correction of inaccurate personal information.
  • Transborder data flows (IPP 12) — we transfer personal information to overseas recipients in the United States and France (listed in Section 5). We take reasonable steps to ensure those recipients are subject to privacy obligations comparable to the IPPs, including through contractual data processing agreements. New Zealand does not currently maintain a list of "adequate" countries, so transfers rely on these contractual safeguards.
  • Notifiable privacy breaches — see Section 7. Where a breach is likely to cause serious harm to New Zealand individuals, we will notify both the New Zealand Privacy Commissioner and the affected individuals as soon as reasonably practicable.

To exercise your rights or raise a privacy concern, contact us at contactus@xentarai.com. If you are not satisfied with our response, you may contact the New Zealand Privacy Commissioner at privacy.org.nz.

17. Your Rights — South Africa (POPIA)

We process personal information of South African data subjects in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

Minimum age: In South Africa, the App is available only to users aged 18 years and older. POPIA defines a "child" as a person under the age of 18. We do not knowingly collect personal information from persons under 18 in South Africa.

Your rights under POPIA include:

  • Right to be notified — you have the right to be notified when your personal information is being collected (this policy serves that purpose).
  • Right of access — you may request a description of the personal information we hold about you and be told for what purpose it is held.
  • Right to correction or deletion — you may request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.
  • Right to object — you may object to the processing of your personal information on reasonable grounds. We will cease processing unless legitimate grounds override your objection or it is necessary for a legal claim.
  • Right not to be subject to automated decision-making — you have the right not to be subject to a decision based solely on automated processing if it significantly affects you. Our ATS scoring is advisory and does not make legally binding decisions about you.
  • Cross-border transfer (Section 72 POPIA) — we transfer personal information to recipients in the United States and France (Section 5). We do so on the basis that we have put in place contractual data processing agreements requiring those recipients to apply standards of protection substantially similar to the conditions for the lawful processing of personal information under POPIA.
  • Breach notification — see Section 7. We will notify the Information Regulator and affected data subjects as soon as reasonably possible upon becoming aware of a compromise of personal information.
  • Information Officer — XentarAI Inc. has designated Bidisha Das, Founder & Director as Information Officer as required by POPIA. Contact: contactus@xentarai.com.

To exercise your rights or lodge a complaint, contact us at contactus@xentarai.com. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa) at justice.gov.za/inforeg/.

18. Analytics Consent and Opt-Out

You can manage analytics and crash reporting consent at any time from within the App: Settings → Account Preferences → Privacy & Consent. Revoking consent stops all future collection and closes the active PostHog and Sentry sessions immediately. Previously collected data is subject to those providers' own retention policies.

Users in the EU, EEA, UK, Switzerland, Brazil, and Canada are presented with an explicit consent prompt during onboarding. No analytics data is collected before consent is granted. All other users may opt out at any time via the same in-app setting.

19. International Data Transfers

XentarAI Inc. is incorporated in Canada. Your personal information may be transferred to and processed in the United States (Supabase, Anthropic, Google, PostHog, Sentry, ScrapingAnt, Apify, Firecrawl, Resend, AdMob) and France (Mistral AI, Brevo) and potentially other countries where our service providers operate.

Safeguards governing these transfers:

  • From EU/EEA — Standard Contractual Clauses (EU SCCs, 2021)
  • From UK — UK International Data Transfer Addendum (IDTA) to EU SCCs, or equivalent UK-approved mechanism
  • From Switzerland — Standard Contractual Clauses as recognised by the FDPIC
  • From Canada — contractual obligations requiring comparable protection; Canada is recognised by the EU as providing adequate protection under PIPEDA
  • From Australia — contractual data processing agreements (APP 8 safeguards)
  • From New Zealand — contractual safeguards providing comparable protection to the IPPs
  • From South Africa — contractual safeguards meeting the requirements of Section 72 POPIA

20. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this page and, where required by applicable law, by providing in-app notification or direct email notice. We encourage you to review this policy periodically. Continued use of the App after changes are posted constitutes your acceptance of the updated policy.

21. Contact Us

For questions, concerns, or data rights requests related to this Privacy Policy, please contact:

XentarAI Inc.
Privacy & Legal
Email: contactus@xentarai.com
Website: https://xentarai.com
Country of incorporation: Canada

Response timelines: 30 days for GDPR / UK GDPR requests; 45 days for CCPA / US state law requests; 30 days for Australian, New Zealand, and South Africa requests; and within a reasonable period for all other jurisdictions. Complex requests may be extended with notice.

← Back to Resuvia