Privacy Policy

1. Introduction

Vimatech Ltd (Company Number 17001986), a private limited company registered in England and Wales with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“we”, “us”, “our”), is committed to protecting your privacy and personal data.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our website and SaaS platform makeresume.io (together, the “Service”). It also informs you about your data protection rights under UK GDPR and the Data Protection Act 2018.

Data Controller: Vimatech Ltd is the data controller responsible for your personal data. We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC155985. If you have questions or wish to exercise your data rights, please use our contact form.

2. Information We Collect

We collect and process the following categories of personal data:

2.1 Account Information

Identity data: Full name, email address, password (encrypted)
OAuth data: If you sign up via Google, we collect your name, email, and profile picture from your Google account
Account preferences: Language, notification settings

2.2 Resume and Cover Letter Data

Content you create using the Service, including:

Personal details (name, contact information, location, professional summary)
Work experience (job titles, companies, dates, responsibilities)
Education history (schools, degrees, dates)
Skills, certifications, languages, and other professional information
Cover letter content (recipient details, letter body)

2.3 Payment Information

Billing data: Name, billing address, email
Payment card details: We do not store your credit/debit card information. All payment data is processed securely by our Merchant of Record, Paddle.com Market Ltd.
Transaction history: Subscription plans, payment dates, amounts, invoice IDs

2.4 Usage Data

Pages visited, features used, time spent on the Service
AI feature usage (e.g., content suggestions requested)
Export activity (format, frequency)
Document creation and editing activity

2.5 Device and Technical Data

IP address, browser type and version, operating system
Device type, screen resolution, time zone
Cookies and similar tracking technologies (see Section 8)
Referral source (how you found our Service)

2.6 Communications Data

Emails, support tickets, and chat messages you send us
Feedback, survey responses, and contact form submissions

3. How We Use Your Information

We process your personal data for the following purposes, based on the legal bases specified:

3.1 To Provide the Service (Contractual Necessity)

Create and manage your account
Store, process, and enable you to edit your resumes and cover letters
Generate PDFs, DOCX, and TXT exports
Provide AI-powered writing assistance and translation services

Legal basis: Performance of our contract with you (Terms of Service).

3.2 To Process Payments (Contractual Necessity & Legal Obligation)

Process subscription payments via Paddle
Manage billing, invoices, and refunds
Detect and prevent payment fraud

Legal basis: Performance of contract and compliance with legal obligations (tax, accounting).

3.3 To Communicate with You (Contractual Necessity & Legitimate Interest)

Send transactional emails (account verification, password resets, subscription confirmations)
Trial subscription reminders: If you subscribe to a 7-day trial, we will send automated reminder emails on day 5 (“2 days remaining”) and day 6 (“last chance to cancel”) to inform you before your trial converts to a monthly subscription. These are mandatory transactional emails required for legal compliance (auto-renewal disclosure) and cannot be opted out of.
Provide customer support and respond to inquiries
Notify you of important Service updates, security alerts, or policy changes

Legal basis: Performance of contract and legitimate interest (effective communication).

3.4 To Improve the Service (Legitimate Interest)

Analyze usage patterns to enhance features and user experience
Conduct research using anonymized, aggregated data
Test new features and improvements

Legal basis: Legitimate interest (improving our Service and business operations).

3.5 For Security and Fraud Prevention (Legitimate Interest & Legal Obligation)

Monitor for suspicious activity, abuse, or violations of our Terms
Protect our systems from cyberattacks and unauthorized access
Enforce our legal rights

Legal basis: Legitimate interest (protecting our business and users) and legal obligation.

Send you promotional emails about new features, templates, or offers (only with your explicit consent)

Legal basis: Consent. You can opt out at any time via the unsubscribe link in emails or account settings.

3.7 For Legal Compliance (Legal Obligation)

Comply with tax, accounting, and financial regulations
Respond to lawful requests from authorities (e.g., court orders, subpoenas)

Legal basis: Compliance with legal obligations.

We do not sell your personal data to third parties. We only share your data in the following limited circumstances:

4.1 Service Providers (Data Processors)

We engage trusted third-party service providers to help us operate the Service. These processors act on our behalf and are contractually bound to protect your data:

Payment processing: Paddle.com Market Ltd (payments, subscriptions, invoicing — Merchant of Record)
Cloud hosting: Amazon Web Services (AWS) (data storage, infrastructure)
Email delivery: AWS SES or similar email service providers
AI services: OpenAI or similar AI providers (for content suggestions – we anonymize inputs where possible)
Analytics: Google Analytics (usage analytics – anonymized)
Security services: Google reCAPTCHA (spam and bot protection)

4.2 Legal Requirements

We may disclose your personal data if required by law, court order, or other legal process, or if necessary to:

Comply with legal obligations (e.g., tax authorities, law enforcement)
Protect our rights, property, or safety, or that of our users or the public
Enforce our Terms of Service or investigate potential violations

4.3 Business Transfers

If Vimatech Ltd is involved in a merger, acquisition, sale of assets, or bankruptcy, your personal data may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on the Service of any such change.

4.4 Aggregated or Anonymized Data

We may share aggregated or anonymized data (data that cannot identify you) for research, analytics, or marketing purposes.

5. International Data Transfers

Vimatech Ltd is based in the United Kingdom. Some of our service providers (e.g., AWS, Paddle, Google Analytics, OpenAI) may process your data outside the UK and European Economic Area (EEA), including in the United States.

When we transfer data internationally, we ensure adequate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the UK ICO and European Commission
The recipient’s participation in adequacy frameworks (e.g., EU-US Data Privacy Framework, where applicable)
Additional technical and organizational measures (encryption, access controls)

For more information about our international data transfer safeguards, please use our contact form.

6. Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, alteration, or destruction, including:

Encryption: All data is transmitted via SSL/TLS (HTTPS). Passwords are hashed and encrypted.
Access controls: Only authorized personnel have access to personal data on a need-to-know basis.
Regular audits: We conduct security reviews and vulnerability assessments.
Secure hosting: Data is hosted on secure AWS infrastructure with firewalls, intrusion detection, and DDoS protection.
Backups: Regular encrypted backups are maintained for disaster recovery.

However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of any security breach, please use our contact form immediately.

6.1. Data Breach Notification

In the event of a confirmed data breach that poses a risk to your personal data, we are committed to complying with UK GDPR Article 33 and 34:

Notification to ICO: We will notify the UK Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, unless the breach is unlikely to pose a risk to your rights and freedoms.
Notification to You: If the breach poses a high risk to your rights and freedoms, we will notify you of the following without undue delay: The nature and scope of the breach
Categories and approximate number of data subjects affected
Likely consequences of the breach
Measures we have taken or will take to mitigate the breach
Our contact point for further information
Transparency: We will document all breaches in our internal records and provide details to regulators as required.

You can contact us immediately via contact form to report any suspected security breach.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

7.1 Account Data

Active accounts: Retained as long as your account is active.
Deleted accounts: When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required for legal, tax, or regulatory purposes (e.g., financial records retained for 6 years under UK law).

7.2 Payment Data

Transaction records and invoices are retained for 6 years to comply with UK tax and accounting requirements.

7.3 Usage Data and Logs

Usage analytics and logs are typically retained for 12-24 months for operational and security purposes.

7.4 Backups

Backup copies may be retained for up to 90 days after deletion for disaster recovery purposes.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze usage, and provide essential Service functionality. For detailed information about the cookies we use, please see our Cookie Policy.

8.1 Types of Cookies We Use

Essential cookies: Required for the Service to function (e.g., authentication, session management). These do not require consent.
Analytics cookies: Help us understand how users interact with the Service (e.g., Google Analytics). These require consent.
Functional cookies: Remember your preferences (e.g., language, theme). These require consent.

8.2 Third-Party Cookies

Google reCAPTCHA: Used to prevent spam and bot activity. Google may set cookies. See Google’s Privacy Policy.
Paddle: Used for payment processing. See Paddle’s Privacy Policy.
Google Analytics: Used to analyze user behavior and improve our Service. Google acts as a Data Processor. Your data may be transferred to the USA under the EU-US Data Privacy Framework. See Google Analytics Data Processing Terms.

8.3 Managing Cookies

You can control and delete cookies through your browser settings. However, disabling essential cookies may affect the functionality of the Service. For more information, visit www.allaboutcookies.org.

9. Your Data Protection Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you (Subject Access Request).

9.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update most data directly in your account settings.

9.3 Right to Erasure (“Right to be Forgotten”)

You have the right to request deletion of your personal data in certain circumstances (e.g., when data is no longer necessary, consent is withdrawn). You can delete your account at any time from your account settings.

9.4 Right to Restrict Processing

You have the right to request that we limit how we use your data in certain situations (e.g., while you contest data accuracy).

9.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON) and to transfer it to another service provider. You can export your resumes and data from your account settings.

9.6 Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. You can opt out of marketing emails at any time.

Where we process your data based on consent, you have the right to withdraw that consent at any time (this does not affect the lawfulness of processing before withdrawal).

9.8 How to Exercise Your Rights

To exercise any of these rights, please use our contact form or write to us at:

Postal address: Vimatech Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

We will respond to your request within one month. If your request is complex, we may extend this period by two additional months and will inform you.

9.9 Right to Complain

If you believe we have not handled your data correctly or if you are unhappy with our response to your request, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

10. Automated Decision-Making

Our Service uses AI to provide content suggestions, writing assistance, and resume analysis. However, we do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you (within the meaning of Article 22 UK GDPR). All AI-generated content is advisory only — you always make the final decision on what to include in your documents.

11. Children’s Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us, and we will delete such data promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes by:

Posting a prominent notice on the Service
Sending an email to your registered email address (at least 30 days before the changes take effect)

We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes take effect constitutes your acceptance of the updated Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please use our contact form.

Data Controller: Vimatech Ltd
Company Number: 17001986
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Note: You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) via ico.org.uk.