Privacy notice

Last updated: September 20, 2026. This notice covers ResumeUpShift’s website, resume and cover-letter tools, optional AI assistance and job research.

Who operates this service

ResumeUpShift is operated by SecurePath Technologies. For privacy questions or requests, contact info@securepath.tech.

What stays on your device

Resume and letter editing, keyword comparison, PDF/text export and ordinary PDF, DOCX and TXT text extraction run in your browser. Selecting a file for local import does not upload the original file. We do not receive locally entered application content unless you choose a feature that sends it, such as AI organization, coaching or OCR.

Downloaded PDFs, text files and project files stay wherever you save them. Project files contain your application data in readable JSON. Keep them somewhere appropriate for personal information.

What optional AI receives

• Coaching, bullet rewrites and letter drafts: selected resume content, the pasted job description or selected public job excerpts, and answers you provide. Structured name, email, phone, website and location fields are omitted from these requests. Free-text sections can still contain personal information.
• AI import organization: the extracted text you approve. This can include names, contact details, employers, dates and other information in the original document. Review and redact that text before sending it.
• Scanned PDF OCR: locally rendered page images, up to six pages, sent after separate OCR consent to the SecurePath GLM-4-OCR endpoint. Images can contain all the personal information visible on the page. Optional AI organization of the recognized text requires a separate choice.

These requests pass through our backend to the SecurePath model gateway. The gateway retains prompts and responses for 90 days. Submitted transcripts, including text extracted by OCR, may be used by SecurePath Technologies to improve and train models. Do not send content you do not want used for those purposes. You can use the local tools without AI. The 90-day log policy does not promise that any trained model will forget information learned from a transcript. Its documentation says inline image payloads are stripped from logs, but recognized text and other prompt content may remain. Do not send government identifiers, passwords, bank information or other unnecessary sensitive information. We do not promise that model responses are accurate or that stopping a browser request stops work already running upstream.

Job research and external websites

Research sends the role and location you enter to our private SearXNG service and its configured search engines. Do not put personal information into those search fields. The research service fetches a limited sample of public employer postings; it does not send your resume to those employers. Selected excerpts are sent to the model only when you request coaching with consent. Clicking a source link visits that external website, whose privacy practices apply independently.

Browser storage and cookies

“Save on this device” is optional. It stores an unencrypted recovery copy in this browser’s localStorage until you clear it, browser storage is cleared or the browser evicts it. Turning saving off stops future saves; use “Clear saved copy” to remove the stored copy. That action does not remove downloaded files, the application still open in memory or information already sent to AI. The previous-application restore copy lasts only in the current page session.

Other people with access to your browser profile may be able to read saved work. Avoid local saving on shared devices. This release does not use advertising cookies, analytics cookies or an account/session cookie for resume AI access. Hosting or security infrastructure may process ordinary request information as described below.

Technical information and abuse prevention

Web requests necessarily expose technical information to the hosting infrastructure, such as IP address, requested URL, time, browser information and error status. Infrastructure access/security logs may retain this information. Do not put resume text or other personal information in URLs.

The production API uses a keyed hash of the client IP for shared request limits. This is pseudonymous information, not proof of anonymity. Temporary queue and active-request records support capacity controls. The application does not intentionally store resumes, letters, OCR images or model conversations in Redis; gateway logs are separate from Redis.

How long information is kept

• Local copies: until you delete the download or clear browser storage; in-memory drafts last for the page session.
• Public job results and evidence: about one hour in the shared server cache.
• Request controls: pending/active leases last a few minutes; hourly counter keys expire about two hours after their last update. Expired sorted-set records may remain until later request cleanup. Infrastructure backups can have separate retention.
• Gateway text logs: 90 days.
• Hosting/security logs: 90 days.

These periods describe log retention, not a guarantee that prior model training can be reversed. Contact us about deletion requests or questions about model-improvement use.

Access and sharing

Information sent to server-side features is processed by the operator’s hosting, search and AI infrastructure to provide those features and protect availability. Authorized administrators or service providers may be able to access operational logs. Search engines receive research queries, and websites you open receive ordinary visit data. The current application has no advertising or analytics integration that sends your resume to an advertiser.

Our infrastructure may process information outside your country. Contact us if you need processing-location details before using AI. No regional data-residency commitment is offered by this service.

Your choices and privacy requests

You can use the local tools without AI, decline OCR, redact extracted text, leave browser saving off and download your own project copy. Choosing not to send future requests does not retract information already processed. To request access, correction or deletion of server-held information, or ask about other rights available where you live, contact the operator using the address above. Include the approximate time and feature involved; do not send a full resume unless it is necessary. There is no user account, and we may need proportionate information to locate a record or verify a request. Some local-only information is not available to us.

Advertising: prepared, not active

There are no ad requests or third-party advertising scripts in this release. Planned ads will be clearly labeled on public information pages, away from document-editing controls. We will update this notice with the actual vendors, data uses, consent controls and retention links before activating advertising. Resume content, uploaded files and AI conversations must not be included in ad targeting or analytics events.

If Google AdSense is enabled later, Google and participating vendors may use cookies or similar technology, and prior visits to this or other sites, to deliver or measure ads, subject to the consent choices and settings that apply. You can read how Google uses information from partner sites and manage personalization through Google My Ad Center. These links describe a possible future provider; they do not mean Google ads are currently running here.

Document and AI limitations

AI can invent details and OCR can misread text. Review every claim, name, date and number. Keyword comparison is not an ATS score or assessment of your ability. PDF templates use selectable text, but compatibility with every hiring system is not guaranteed. Current PDF fonts support Western European text; plain-text export preserves broader Unicode. Review exported files before submitting them. Sample resumes and illustrations are fictional.

Updates

We will revise this notice when the service’s data practices change and update the date above. New optional features will describe their data use before you choose to send content.