Privacy Policy

Anonymous mode (no account). Everything you type into the builder — every section, every edit — is written only to this browser’s local storage. Nothing about your resume’s content is sent to our servers merely by editing it.

Account mode. Signing in does not change where your resume drafts live — they stay in this browser’s local storage exactly as before. We do not silently upload an existing local resume to your account when you sign in, and there is no background sync of resume content to our servers today. An account exists for premium ownership, purchase history, and (where you use them) the HR workspace and shared-link features below — not for storing your resume.

If cloud sync of resume drafts is ever introduced, it will be off by default and require your explicit, separate opt-in — never turned on silently for existing local drafts.

Two features are explicit exceptions, because you take a deliberate action to trigger them:

• Sharing a resume (the Share button) creates a server-side snapshot at a public link, so a recruiter can view it without an account. You choose whether to include your contact details in that snapshot, and you can revoke the link at any time.
• Importing a resume file (in the builder or the free ATS check). A DOC or DOCX file is read in your browser. A PDF is also sent to our server, which reads the text out of it and sends that text straight back; neither the file nor its text is stored. The parse itself then runs in your browser. Nothing is sent to our AI provider unless you then click “Improve with AI parsing”: only then is the extracted text (which can include your name, email, and phone) sent to it, for that one request — see the AI section below.

Seven things can happen when you use this product, and only one of them ever sends your data to an outside AI provider:

• Local editing. Typing into the builder, formatting, and template switching happen entirely in your browser. Nothing is sent anywhere.
• Job matching (the default). Pasting a job description and seeing how your resume matches it, category by category, is plain code running in your browser — the job description is not sent anywhere. Only the OPTIONAL deeper “semantic” pass described below leaves your device, and only after you acknowledge a disclosure saying so.
• ATS deterministic checks. The ATS Simulator’s score, keyword coverage, and formatting checks run as plain code in your browser against rules we ship — no AI model, no network request, for the deterministic parts of that score. (A PDF you upload to be checked is first read on our server for its text, as described under importing above.)
• Local autosave. Your draft is written to this browser’s local storage on every change (debounced), so a refresh or crash doesn’t lose your work. This never leaves the browser.
• AI-assisted processing. “Improve this bullet,” rewrite/summary suggestions, “Rewrite with AI” on a cover letter, AI-suggested tailoring edits, the job-description semantic match, and “Improve with AI parsing” on an imported resume all send the specific text involved (a bullet, a summary, one part of a cover letter with the job title and company you entered, a job description, or — for import parsing only — your full extracted resume text) to the OpenAI API, our one AI provider, for that single request. Under OpenAI’s API terms this content is not used to train their models, and we do not send it anywhere besides OpenAI. The job-description matcher builds a name/email/phone/location-stripped digest before sending anything, and shows you an explicit disclosure you must acknowledge before it runs. You can turn AI-assisted processing off entirely for your account from AI preferences — every one of these routes refuses to call OpenAI once you do, checked on our server, not just hidden in the interface.
• Cloud sync. There is no resume cloud sync today (see the section above). Nothing to disclose beyond: if that changes, it will be opt-in.
• Account metadata. Your name, email, password hash, premium/subscription status, and (if you use MB HR Documents) your company and employee records are stored on our servers — described fully in the next section. This is separate from, and does not by itself involve, any AI provider.

Account data includes your name, email address, password (stored as a one-way hash, never recoverable by us), email verification status, sign-in provider information, and purchase or subscription status. Resume templates, editing, and export are free for all users and are never watermarked; premium currently unlocks downloads from all HR document generators and the HR workspace; a 24-hour Tool Pass unlocks one HR document tool.

Signing in with Google. If you sign in with Google, Google shares your name, email address, profile picture link and Google account ID with us, and confirms that the email address is verified. We keep only your name and email address, and use them for your account: to sign you in, show who is signed in, and send account emails. We don’t store your picture or Google account ID, we never see your Google password, and we don’t keep any access to your Google account after sign-in. We don’t sell this information or use it for advertising, and our analytics never receive your name or email. You can remove our access in your Google Account settings at any time. To delete the name and email we keep, delete your account (see “Your data controls” below); if you signed up with Google, you can confirm that with Google instead of a password.

MB HR Documents is different from resume editing: it is server-side by nature. If you use the HR workspace, everything you enter there — company details, employee records (including annual CTC/salary), signatories, custom document templates, bulk-generated documents, approval workflows, and their audit trails — is stored on our servers under your account, because generating and tracking real HR documents requires it. Nothing in your HR workspace is ever visible to, or shared with, another account.

Your own resume and your HR workspace are never combined. These are two different kinds of data about two different people, and we do not join them. Your resume is not read into any employer’s employee records, an employer’s records are not read into anyone’s resume, and there is no shared identifier linking the two. That holds even when the same account does both — an HR manager who also builds their own resume here has one of each, not a merged profile. This is enforced in the code itself: the two halves of the product cannot read each other, and an automated check fails our build if that ever changes.

MB Resume Builder exposes an MCP (Model Context Protocol) server — MB Connect — so an AI assistant you already use can draft and render HR documents on your behalf. It is one shared server for every client: ChatGPT, Claude and Grok connect to the same server and receive identical tools and identical permissions. Full detail, including how to disconnect, is on our integrations page.

Without connecting your account, such a client can only list supported HR document types, see what fields a document needs, and draft one from details you type into it. None of this touches any account data. The draft is kept for 30 minutes in our short-term store (Upstash, listed under third-party services below) so the next step can use it, and is then deleted. Turning that draft into a real PDF or DOCX file is not part of the unconnected tier: it requires a connected account and an active entitlement, the same as it does on the tool’s own page.

Connecting your account requires an explicit OAuth authorization you approve, scoped to one company in your HR workspace, which you choose. Once connected, the client can read that company’s profile and employee records, and save a document it drafted into that company’s approval queue — always as a new draft only, never overwriting or sending anything, and only after a separate, explicit confirmation step for that save. This connector has no way to invent a fact about an employee: if information is missing, it reports exactly what’s missing instead.

What your assistant provider sees. This is the part worth stating plainly, because it is inherent to using an assistant rather than specific to us. When ChatGPT calls MB Connect, the request and the response pass through OpenAI as part of your conversation with it; when Claude does, they pass through Anthropic; when Grok does, they pass through xAI. So the field values you ask an assistant to put into an offer letter, and the resulting document, are seen by whichever provider you chose to use. Their handling of that data is governed by your agreement with them, not by this policy. If you would rather no third party see a document, generate it on this website instead of through a connector.

Sending and signing are never available to a connector. Delivering a document to a recipient, requesting a signature, and revoking an issued document are excluded from every AI client by design, and exist only in the MB web app where a person performs them.

Access tokens issued to a connected client expire automatically after one hour, and refresh tokens rotate on every use. You can disconnect in two independent ways: remove the connector inside ChatGPT, Claude or Grok, which stops that client using its token; or revoke the grant from our side, which invalidates the token itself so it stops working even if the client still holds a copy.

Connector activity is recorded as metadata only — which tool ran, whether it succeeded, how long it took, and a request ID. Document contents, employee names, salaries and tokens are never written to those logs, and an automated test enforces that rather than leaving it to policy. The same facts (tool name, tier, duration and error code, never the arguments) are also sent to PostHog as a usage event, as described under “Cookies, analytics, and advertising”.

We use PostHog (EU-hosted) for privacy-first product analytics: which features are used, not what you typed into them. Session recording is off, typed input and page text are masked before capture even reaches PostHog, and nothing from your browser is sent to PostHog until you choose “Analytics only” or “Accept all” in the consent banner — it is not even loaded before then. Declining, or not responding, keeps it that way. Once you allow analytics, PostHog also records how quickly each page loads and responds (Core Web Vitals timings, with the page address) so we can find slow pages; it does not record the files or requests a page makes.

What the banner does not cover. One thing reaches PostHog whatever you choose. When an AI assistant uses MB Connect, our own servers send PostHog a small usage event. A request from an assistant brings no choice from your browser, so the banner cannot govern these. For MB Connect it is the tool’s name and tier, whether an account was connected, how long it took and an error code. Every one of these events goes under the same generic label, never your account ID and never your email, and none includes resume, employee or document content or the details you gave a tool. Payments are different: when you buy a 24-hour Tool Pass or start a Premium subscription, our server sends PostHog a payment event only if you allowed analytics in that browser. For a payment it is the type, the plan or tool and the amount, tied to your internal account ID, never to your email. Renewals send none.

Our own event catalog is structurally limited to counts, booleans, and short labels — it never includes resume contents, job-description text, salary figures, employee names, or HR document body text, for any event, by design (not by a filter that could later be loosened).

We also use Google AdSense/Ads for advertising and conversion measurement, gated through Google’s own Consent Mode. Google Ads has its own choice in the banner: ad-related tracking (including the automatic pixels Google’s tag would otherwise fire on every page load) defaults to denied and only turns on if you choose “Accept all”, which also lets Google personalize the ads it shows you. “Analytics only” and “Decline” keep every Google Ads signal off. If you choose “Accept all” and then buy something, the conversion we report to Google includes the amount you paid and our payment reference number; we put no name, email or payment-method detail in it. Your choices are saved in your browser, and you can change them at any time with “Privacy choices” at the bottom of every page, which opens the banner again (clearing this site’s data does too). A changed choice stops further collection from that moment; it does not delete what was already sent. The Google AdSense script, which shows ads on our longer blog articles, is not loaded at all until you choose “Accept all”; if you change that choice later, it is not loaded from the next page you open. The Google Ads tag used for conversion measurement does load on every page, with every Google Ads signal off unless you chose “Accept all” (loading a script is not the same as it sending data about you). None of this affects Razorpay, which only runs during an actual checkout you initiate.

Advertising cookies. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet (see how Google uses information from sites that use its services). You can opt out of personalized advertising in Google’s Ads Settings, or opt out of some third-party vendors’ use of cookies for personalized advertising at www.aboutads.info. Other ad technology providers that work with Google may also serve or measure ads here; Google lists them, with links to their own sites and privacy policies, in its list of ad technology partners, and many of them offer an opt-out through www.aboutads.info. Visitors in the EEA, the UK and Switzerland are also asked by Google’s own consent message before ads use cookies. Ads appear only on our longer blog articles, never in the resume builder or the HR document tools. They appear only if you chose “Accept all” in our consent banner.

Trusted third parties that may process data on our behalf:

• OpenAI — AI-assisted rewrite, tailoring, matching, and import-parsing requests (see the AI section above).
• PostHog — product analytics (EU-hosted). Nothing is sent from your browser until you choose; a few server-side usage events are not covered by that choice (see “Cookies, analytics, and advertising”).
• Google AdSense/Ads — advertising and consent-gated conversion measurement.
• Razorpay — payment processing, transaction verification, and subscription handling.
• Google Sign-In — optional authentication.
• Upstash (through Vercel, in Mumbai, India) — our short-term store: request-rate counters keyed to your IP address or account, kept for up to an hour; MB Connect drafts, kept for 30 minutes; and a record of each document saved through MB Connect (its ID, type and title), kept for 24 hours so a repeated request does not save it twice.

Each processes data under its own privacy policy, only for the purpose listed.

Available directly from your account, no support request needed:

• Download my data — Account → Privacy & data → Download. Everything we hold about your account on our servers as one JSON file (resume drafts and Career Vault aren’t included — see below for why).
• Delete a resume — from Account → My Resumes, or directly in the builder. This is a real, immediate, permanent removal from this browser’s storage, because that’s the only place it ever lived.
• Delete Career Vault — Account → Privacy & data → Clear Career Vault data. Same reasoning: Career Vault is local-only, so clearing it locally is complete.
• Disconnect AI — AI preferences. Refuses every AI-assisted request for your account server-side.
• Delete an HR workspace — archive a company first (HR workspace → Archive), then Delete permanently once it’s archived. This two-step, type-the-name-to-confirm flow permanently deletes the company and every employee, document, batch, workflow, and verification record under it.
• Delete account — Account → Delete. Requires your password (or, instead, signing in with the Google account for your email address) and a typed confirmation phrase. Permanently deletes your account and everything listed in the section above in one action — irreversible.

MB Resume Builder is operated by MB Developer Apps from India. Our support and the terms governing your use of the service are Indian — see the governing law section of our Terms of Service.

Our database and application servers are not in India, and we would rather say so than let “operated from India” imply otherwise. Where data physically sits:

• The database — account records, HR workspaces and employee records, payments, and any resume share snapshots — is hosted on Supabase, running on AWS in Seoul, South Korea (ap-northeast-2).
• The application itself runs on Vercel. Its server functions, which build the pages and handle sign-in, payments, HR workspaces and everything else that reads or writes the database, run in Seoul, South Korea (Vercel’s icn1 region), next to the database. Scripts, styles, images and fonts are served from Vercel’s network location nearest to you, and a short step that adds security headers to each request runs there too.
• Our short-term store — request-rate counters, MB Connect drafts and records of documents saved through MB Connect, none kept longer than 24 hours — is Upstash, in Mumbai, India (Vercel’s bom1 region).
• Analytics are PostHog’s EU-hosted service, so usage events stay in the EU.
• Other processors hold only what their job needs: Razorpay for payments (India), Resend for transactional email, Cloudflare for DNS and support-email forwarding, and OpenAI for the AI-assisted features described above. None of them receives your whole account.

We have not tailored this service, or this policy, to the data-protection rules of other countries. If you are using it from outside India, that is a decision you are making, and the protections you are used to at home may not map onto what is described here.

This section is for people who are not our users — employees whose information an employer has entered into MB HR Documents. You may never have visited this site, and we would have no way to contact you.

How your details got here. An employer set up their company in the HR workspace and entered them in order to produce HR documents about you — typically your name, employee code, designation, department, location, joining date and, where a document needs it, your annual CTC. We did not collect any of it from you, and we do not obtain it from anywhere else.

What we do with it. We store it so that employer can generate and track their own documents, and we do nothing else with it. It is never used to train an AI model, never sold, never combined with anyone’s resume, and never visible to another account. It reaches an AI provider only if that employer asks an assistant to draft a document, or connects ChatGPT, Claude or Grok — both described above.

Who can change or remove it. The employer controls that workspace. They can edit or delete your record directly, and deleting their company permanently removes every employee record, document, batch, workflow and audit trail under it. Ask them first — it is their workspace, and they can act immediately.

If that is not possible, write to support@mbresumebuilder.com with the company name and your own, and we will look into it and reply. We would rather say plainly that a request from someone we cannot identify, about data we hold for someone else, takes care to handle — than promise a turnaround we have not tested.

We try to be precise here rather than reassuring, since the two aren’t always the same thing:

• Resume drafts, saved-resume entries, and Career Vault data: exist only in your browser; deleting them there is complete and immediate.
• What you type into an HR document generator: kept in that browser tab, so a reload doesn’t lose it, and never sent to our servers. Closing the tab, or Reset, removes it. If you tick “Keep it after the tab closes,” it is also kept in that browser on that device for 30 days from your last change; unticking it deletes every kept draft at once.
• Archiving a company or HR document is a status change, not a deletion — the underlying data stays until you use the separate permanent-delete action, or delete your account.
• Revoking a shared resume link makes it immediately inaccessible; the underlying snapshot is removed when you delete your account.
• Deleting your account is immediate and permanent for everything stored under it, with no recovery window — see the confirmation flow above before you use it.

We do not sell your resume or HR document content as a product database, and we do not use it to train any AI model.

We update this Privacy Policy as the product changes, and we only describe behavior the product actually has — not aspirational promises. For privacy questions, contact support@mbresumebuilder.com.