Privacy Policy

This policy explains what information we collect, how we use it, and what choices you have. Short version: we collect what we need to run the Service, we don't sell your data, and your resume content is yours.

onepage.bio is operated by 1232216 B.C. Ltd., 101-1388 Continental St, Vancouver, BC V6Z 0C9, Canada. Our Privacy Officer is responsible for how we handle personal information and answers every question, request and complaint sent to hi@onepage.bio.

Data we collect

Account data. Email address, display name, and either a hashed password or your Google sign-in (which gives us your name and profile picture link). Handled by our auth provider (Supabase).

Resume content. The text, dates, bullets, and metadata you type into the builder, stored in our database and attached to your account. Documents you upload for import are read to extract their text and are not stored.

Usage data. Page views and basic device/browser information through Vercel Analytics, which does not use cookies, and a count of how often you use AI features (for rate limits).

Billing data. If you buy Pro, our payment processor (Stripe) handles your card details directly; we only see billing metadata such as the purchase date and status. We never see or store full card numbers.

How we use it

• To run the Service — show your resumes, enable public sharing, generate PDFs.
• To send emails your account needs, such as password resets. We are not sending product or marketing emails at the moment; if we start, each one will have an unsubscribe link.
• To enforce rate limits and prevent abuse of AI features.
• To support, debug, secure, and improve the Service — including reviewing usage and content where needed (see "Access by our team").

Access by our team

To run, support, secure, and improve the Service, authorized members of our team may access your account email and resume content. This includes:

• Providing and operating the Service — including resolving account issues, debugging errors, and reviewing usage and content to improve product quality.
• Responding when you contact us for support.
• Preventing fraud, abuse, or violations of our Terms.
• Complying with law, subpoena, or other valid legal process.

We don't sell your data and we don't use your resume content to train AI models. We may use anonymized, aggregate patterns across many resumes (for example, what skills are common in a job category) to improve the Service.

Service providers we share with

• Supabase — database and authentication.
• Google (Gemini API) — the AI provider for bullet rewriting and resume import. The relevant resume text is sent to Google only when you use those features, and Google processes it under its Gemini API terms.
• Vercel — hosts the site and provides cookie-free page analytics.
• Stripe — payment processing, if you buy Pro.
• Resend — delivers our emails.

These providers store and process data in the United States, so your information is processed there and may be accessible to authorities under US law. We do not sell or rent your data.

Public resume links

When you toggle a resume to "public," its content becomes accessible to anyone who has the generated URL. Public resume pages ask search engines not to index them, though we can't control what others do with a link you share. You can revoke public access at any time from the resume's share menu.

Cookies and browser storage

We use only what the Service needs to work: browser storage and cookies that keep you signed in and remember your preferences. We do not use advertising or cross-site tracking cookies.

How long we keep data

We keep your account and resumes while you use the Service. Accounts that never create a resume or use a feature are deleted 30 days after sign-up. If you don't sign in or edit anything for 12 months, we delete your account and everything in it; accounts with a Pro purchase are not deleted for inactivity. Deleted data can stay in our encrypted database backups until they expire, about 7 days later. Stripe keeps its own payment records (such as receipts) for as long as tax law requires.

Your rights

You can see, correct, export, or delete your resumes at any time. You can delete your entire account from Account settings or by emailing hi@onepage.bio. That removes your profile, resumes, AI-usage history, and any success story or survey answer tied to your account; Stripe keeps payment records as described above. You can also ask what personal information we hold about you and who we've shared it with. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or the privacy regulator where you live. If you're in the EU, UK, or California, you have additional rights under GDPR, UK GDPR, and CCPA; contact us to exercise them.

Children

The Service is not meant for anyone under 16, and we don't knowingly collect their data.

Security

Data is encrypted in transit (TLS) and at rest. Production access is restricted to a small number of authorized team members, used only for the purposes listed under "Access by our team." No internet service can guarantee perfect security, but we use industry standards.

Changes to this policy

If we change this policy in a way that materially affects you, we will email you or show a notice in the Service before the change takes effect. The date at the top shows when it last changed.

Contact

Privacy questions and requests: hi@onepage.bio, or by mail to Privacy Officer, 1232216 B.C. Ltd., 101-1388 Continental St, Vancouver, BC V6Z 0C9, Canada.