Resume Banger — Privacy Notice
Last updated · 2026-06-18
This Privacy Notice explains how Resume Banger ("we", "us") collects and processes personal data when you use Resume Banger, available at resumebanger.com (the "Service"). We are the data controller in respect of that processing under the EU General Data Protection Regulation ("GDPR"), the United Kingdom GDPR ("UK GDPR") and equivalent regimes.
Resume Banger is anonymous: you do not create an account and we do not ask for your name, email, or password. We have tried to keep this Notice short and concrete. If anything is unclear, write to us at [email protected].
1. Categories of personal data we process
| Category | Examples | Source |
|---|---|---|
| Browser visitor identifier | A stable ID derived from browser characteristics by FingerprintJS, plus a first-party rb-anon-id cookie, used to apply the free daily limits and to show you your own recent clips on the device you used. | Computed in your browser; sent with each generation request. |
| Hashed IP address | A salted SHA-256 of your IP address, stored alongside each generation record as an abuse-prevention backstop. We never store your raw IP. | Inferred from request headers. |
| User Inputs | The CV text, LinkedIn "About", or other text you paste, drop, or upload to the Service (truncated to at most 60,000 characters). | You. |
| Generated Outputs | Lyrics drafted by the language model and any clip you generate or choose to publish. | Produced by the Service from your User Inputs. |
| Purchase records | Creem order/transaction IDs, the item purchased, amount, currency, status, and how many unlocks remain. | Creem's webhook events. |
| Operational logs | Application error messages, request paths and HTTP status codes, and abuse signals. We design these to contain no personal data. | Generated automatically by our application. |
We do not collect a name, email address, or password from you, because the Service has no user accounts.
2. Purposes and legal bases
| Purpose | Categories | Legal basis (GDPR Article 6) |
|---|---|---|
| Operating the free tier and generating your clip (lyrics, preview, render) | Browser visitor identifier, hashed IP, User Inputs, Outputs | Performance of a contract (Art. 6(1)(b)) and our legitimate interest in providing the Service (Art. 6(1)(f)) |
| Processing and delivering a one-time purchase | Purchase records, Outputs | Performance of a contract (Art. 6(1)(b)); compliance with tax law (Art. 6(1)(c)) |
| Screening the text you submit for prohibited content before generation | User Inputs | Compliance with a legal/contractual obligation and our legitimate interest in preventing unlawful or harmful use (Art. 6(1)(c) / (f)) |
| Rate-limit enforcement and abuse prevention | Browser visitor identifier, hashed IP, operational logs | Our legitimate interest in protecting the Service from abuse and bearing reasonable infrastructure costs (Art. 6(1)(f)) |
3. How long we keep your data
- Browser visitor identifier and hashed IP: retained alongside the generation record they belong to (see below). The hashed IP cannot be reversed to your IP address.
- User Inputs, Outputs, and generation history: we currently retain these so you can see your recent clips on your device and so we can investigate abuse. We do not run automatic deletion. You can ask us to delete the history tied to your browser identifier at any time by emailing
[email protected], and we will do so. - Purchase records: kept for as long as required to comply with tax and accounting law (typically several years). The underlying payment record is held by Creem as Merchant of Record.
- Published (shared) clips: kept while the share URL exists. You can request take-down by email and we will remove the file and the database row.
- Operational logs: short-lived — retained only as long as needed for security and debugging.
4. Recipients and sub-processors
We rely on the following processors to operate the Service. Each is engaged on data-processing terms intended to satisfy GDPR Article 28.
| Processor | Role | Reference |
|---|---|---|
| Google LLC (Gemini API) | Receives your User Input text to draft lyrics; the output is returned to us. Per the Gemini API terms, Google does not use API inputs to train its models. | Gemini Terms |
| Replicate, Inc. | Receives the lyrics and a style prompt to generate the rapped audio for a free-AI or PRO track, and hosts the resulting audio file. | Replicate Privacy |
| Creem.io | Our Merchant of Record. At checkout it receives the name, email, and payment details you enter directly (we never see card numbers). It also screens the text you submit through its Content Moderation API before generation. | Creem Privacy · Buyer Terms |
| Cloudflare, Inc. | Content delivery, TLS termination, bot mitigation (Turnstile), and security. | Cloudflare Privacy |
| Our hosting infrastructure | Runs the application server and database for Resume Banger. | — |
We do not sell personal data to third parties. We will update this table when we add or remove a sub-processor.
5. International data transfers
Several of our sub-processors operate from the United States. Where personal data is transferred outside the EEA or the UK, the transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum. We rely on the EU–US Data Privacy Framework for participating recipients where applicable. You may request more detail by writing to [email protected].
6. Your rights
Subject to local law you have the following rights with respect to your personal data:
- Access — confirm whether we process your personal data and receive a copy.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data where there is no longer a lawful reason to keep it.
- Restriction — limit how we process your data while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format where technically feasible.
- Object — object to processing based on our legitimate interests.
- Withdraw consent — for any processing based on consent (e.g. analytics cookies), at any time, without affecting prior lawful processing.
To exercise any of these rights, email [email protected]. Because the Service is anonymous and we do not hold your name or email, please include the detail we need to locate your data — for example your browser's visitor identifier or the URL of a clip you published. We respond within 30 days. If you believe we have not handled your data lawfully you can also lodge a complaint with your local supervisory authority (EU/EEA) or the UK Information Commissioner's Office.
7. Automated processing and AI
Lyrics are drafted by an automated language model, and the rapped vocal is produced by an automated music model. The text you submit is also screened by an automated content-moderation system before generation. These are creative and safety processes, not decisions that produce legal or similarly significant effects concerning you, so the rules on solely automated decision-making under GDPR Article 22 do not apply. We do not use the outputs to evaluate, profile, or score you.
The models we use do not learn from your inputs at our request; we do not opt your inputs into model-training programmes operated by our sub-processors.
8. Cookies
We keep cookies to the minimum and ask for opt-in consent before any non-essential ones are set. A full, itemised list — names, purposes, lifetimes — is on our Cookie Policy, where you can also change or withdraw your choices at any time.
Strictly necessary (no consent needed):
rb-anon-id— a first-party, HttpOnly identifier so a returning visitor can see their own past clips. It cannot track you across other sites.cc_cookie— records your cookie-consent choices so we don't ask on every visit.- Auth.js session cookie — HttpOnly, SameSite=Lax, set only on the operator administration sign-in area, which ordinary visitors never use.
- The Cloudflare delivery edge may set its own essential security cookies, described in Cloudflare's policy.
Analytics (only with your consent):
- Google Analytics (
_ga,_gid, …) — set by Google LLC to measure aggregate usage. These are blocked until you accept the analytics category in our cookie banner, and removed if you withdraw. See how Google uses data from sites that use its services.
9. Security
- All data in transit is encrypted via TLS.
- We do not collect passwords from you; the Service has no user accounts. The separate operator administration area uses its own authenticated sign-in.
- The application database runs on access-controlled infrastructure.
- Shared clip files are served from an internal volume; the pipeline validates file size and type (magic-byte sniffing) before anything is written.
- Access to the production database is limited to the operator.
10. Data breach notification
If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and we will notify affected users without undue delay where the breach is likely to result in a high risk, as required by GDPR Articles 33 and 34.
11. Children
The Service is not directed to children under 16. If we learn that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it.
12. Changes to this Notice
We will revise this Notice when our processing changes. The "Last updated" date at the top always reflects the current version, and material changes are posted on this page.
13. Contact
Controller: Resume Banger. Contact for all privacy matters, including rights requests and data-portability exports: [email protected]. We do not have a designated Data Protection Officer because we do not meet the GDPR Article 37 thresholds; you can address all queries to the controller email above.