Privacy Policy

To turn your resume into a verified, designable career profile, we collect:

• Account info — your name, email, profile photo (from Google / Apple / Microsoft sign-in, or directly from you).
• Resume files you upload — PDF, DOCX, image, or LinkedIn data export ZIP.
• Extracted resume content — work history, education, skills, projects, contact info (we OCR and structure this into JSON).
• Photos you upload — your profile portrait, resized to 300×300 and stored in our blob storage.
• Operational data — IP address, browser type, timestamps for security and abuse prevention.

• Render your resume into different templates and formats (PDF, share PNG, ATS-clean DOCX).
• Serve your public profile at vetty.me/{your-slug} if you choose to publish it.
• Show extraction provenance so you can verify every field traces back to your source document.
• Send transactional emails (sign-in links, important account notices). We don't send marketing email unless you opt in.

• We do not sell your data to advertisers or data brokers — ever.
• We do not train public AI models on your resume content. Your data is yours.
• We do not auto-rewrite your resume. Our quality engine surfaces suggestions; nothing gets changed without your explicit approval.
• We do not scrape LinkedIn via browser extensions or unauthorized APIs. The only LinkedIn import path is your own data-export ZIP that you provide.

• Original uploaded files — deleted automatically after extraction unless you opt in to retain them (Settings → Storage).
• Extracted resume JSON — kept as long as you have an account. Event-sourced; you can roll back any edit.
• Renders (PDFs, PNGs) — kept indefinitely while they're referenced by an active resume. Garbage-collected when the source resume is deleted.
• Account data — kept until you delete your account. Account deletion is permanent and covers all linked resumes, renders, uploads, and avatars.

• You — always.
• Anyone with your published profile URL — only the content you choose to display (controlled in Settings → Privacy: show/hide email, phone, location precision).
• Our subprocessors (essential infrastructure we use to operate):
  • Microsoft Azure (compute, database, blob storage, OCR via Document Intelligence, language models via Azure OpenAI)
  • Google, Apple, Microsoft (when you sign in with their identity providers)
  • Stripe (only when you upgrade to a paid plan — V1.5+)
• Law enforcement or government requests — only when legally compelled, and we'll notify you unless prohibited.

Regardless of where you live, you can:

• Access — download all your data as JSON from Settings → Export.
• Correct — edit any extracted field in the editor.
• Delete — purge your account and all associated data (Settings → Delete account).
• Opt out of retention — delete original upload files immediately after extraction.

If you're in the EU/UK, you have additional rights under the GDPR (data portability, right to object, right to lodge a complaint with a supervisory authority). If you're in California, you have rights under the CCPA/CPRA. Email privacy@vetty.me and we'll honor any of these within 30 days.

• All data in transit is encrypted via TLS 1.2+.
• Data at rest in Azure Blob Storage and Cosmos DB for PostgreSQL is encrypted (AES-256, managed keys).
• Public share-page URLs are private by default; you opt in to publish.
• Photo and resume blob URLs are short-lived signed URLs unless you publish them publicly.
• We follow least-privilege access internally and log every data access for audit.

Currently, all data is stored in Microsoft Azure in the United States (Central US region) and processed via Azure OpenAI endpoints in the same region. We may add EU regions in the future for EU users — we'll notify you and update this policy when that happens.

When we make material changes, we'll update the "Last updated" date at the top and notify you by email if you have an account. Continued use of vetty.me after the change means you accept the updated policy.

Questions, requests, or concerns: privacy@vetty.me