Privacy Policy

Gradlume (“we”, “us”) operates this website. We are an independent project. We are not affiliated with, endorsed by, or acting on behalf of U.S. Citizenship and Immigration Services (USCIS), the Department of Homeland Security, any university, or any employer named on the site. Contact: ypadesta@gmail.com.

• Resumes you analyze — when you use the resume analyzer, the full text of your resume (including your name and contact details), any job description and target role you paste, and the generated report are saved to our database and kept. If you are signed in, they are linked to your account; otherwise they are stored with the request. We keep them to run Gradlume and to improve it — for example, to see which resume patterns score well in each field. We do not publish them, sell them, or share them with employers.
• Email address and resume text, if you request an emailed report — when AI capacity is full you may leave an email to receive the full report later. We store the email, the resume text, any job description, and the finished report until it is sent, then delete the record within 30 days.
• Account details, if you create an account — email, password (hashed, never visible to us), and the profile fields you choose to fill in (name, field of study, work-authorization status). Accounts are optional; every feature works without one.
• Technical data — our hosting provider records standard web-server logs (IP address, user agent, requested URL, timestamp) for security and debugging. We rate-limit the analyzer per IP address using an in-memory counter that is not persisted.

We do not use advertising trackers, analytics pixels, or fingerprinting, and we do not sell or rent personal data.

• To provide the feature you asked for — analyzing a resume, matching it to a posting, emailing a report, signing you in. (Performance of a contract / your request.)
• To keep the service running and abuse-free — rate limiting, error logs. (Legitimate interest.)
• Where consent is the basis — the emailed-report queue and the music player — we ask first, and you can withdraw by deleting the data or not using the feature.

We use a small number of service providers. Each receives only what its job requires.

• AI providers — for the AI-assisted parts of a resume report (summary, bullet rewrites, keyword suggestions), the resume text, any job description and target role are sent to one of the following, chosen by availability at the time: Groq, Cerebras, Google (Gemini API), Mistral, SambaNova, OpenRouter, Cohere, Hugging Face. They process the text to generate the response and, per their API terms, do not use it to train models. The rule-based part of the report never leaves our server.
• Supabase — database and authentication (accounts, the emailed-report queue, the AI rate counter). Hosted in the United States.
• Resend — sends the emailed report and account emails (confirmation, password reset).
• Vercel — hosts the site and keeps the web-server logs described above.
• Job and employer data sources — when you search openings we query public job APIs (employer career boards on Greenhouse, Lever and Ashby; The Muse; Jobicy; and, if configured, Adzuna and JSearch) with your search terms only. No personal data is sent.
• YouTube (Google) — the optional music player embeds YouTube's privacy-enhanced player (youtube-nocookie.com). Nothing loads until you tap the player; once you play a song, Google's Privacy Policy and YouTube Terms of Service apply to that embed.

We set cookies only for signed-in sessions (Supabase authentication tokens). They are strictly necessary to keep you signed in and are not used for tracking. If you never create an account, we set no cookies at all. The YouTube embed may set its own cookies after you start playback, as described above. Your browser's local storage may remember interface preferences on your own device; that data never reaches us.

• Analyzed resumes, job descriptions and reports: kept indefinitely, including after you delete your account (deletion removes the link to your account, not the resume).
• Emailed-report requests: deleted automatically 30 days after they are created, whether sent or not.
• Account data: until you delete the account.
• Hosting logs: per Vercel's retention (typically days, not months).

Wherever you are, you can ask us to access, correct, export or delete personal data we hold, object to or restrict processing, and complain to your local data-protection authority. In the EU/UK this is under the GDPR/UK GDPR; in California under the CCPA/CPRA (we do not “sell” or “share” personal information as those laws define it).

• Delete an account — signed in, open Account and use “Delete account”. It removes your profile, sign-in and any queued report requests immediately. It does not delete resumes you analyzed.
• Have a resume removed — email ypadesta@gmail.com from the address you used (or describe the upload if you weren't signed in). We remove it and confirm.
• Delete a queued report without an account — email ypadesta@gmail.com from the address you used; we delete it and confirm.
• Anything else — same address. We respond within 30 days.

The site and its providers are operated from the United States. If you use it from elsewhere, your data is transferred to and processed in the US under the providers' standard contractual terms.

Gradlume is intended for people aged 16 and over. We do not knowingly collect data from anyone younger; if you believe we have, contact us and we will delete it.

Traffic is encrypted in transit (HTTPS). Passwords are hashed by Supabase and never visible to us. Service keys are held server-side only. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

When this policy changes we update the date at the top. Material changes to what we collect will be announced on the site before they take effect.