Privacy Policy
Last updated: September 18, 2026
This policy explains what aibox collects, why we collect it, how long we keep it, who may process it, and the rights you have. It applies to the English pages under /en.
The short version: resume content you paste is used only to generate your own report. Stored resumes and generated reports are automatically deleted after 30 days. We do not sell your personal information, we do not use your resume to train models, and we do not publish it as an example.
Who is responsible for your data
aibox is operated by an individual developer. For the purposes of the EU and UK General Data Protection Regulation (GDPR), that individual is the data controller for the personal data described on this page. There is no registered company, and no postal address, phone number, or email address is published. How to make a privacy request is explained under your rights below, and the Contact page states plainly what contact options exist.
What we collect
| What | Why | How long |
|---|---|---|
| Resume text you paste | To generate the report you asked for | Deleted within 30 days |
| The job description you optionally paste | To compare your resume against that role | Deleted within 30 days |
| Generated reports and documents | To show you your own results and let you download them | Deleted within 30 days |
| Your email address and message, if you contact us | To reply to you and handle your request | Kept only as long as needed to handle the request, then deleted, except records we must keep |
| Nothing payment-related | We have no online checkout, so we never collect or store payment account, card, or billing details | — |
| Basic technical data in server logs, such as IP address, browser type, requested URL, and timestamps | To keep the site secure, prevent abuse and fraud, and diagnose faults | Short-lived; kept only as long as needed for security and troubleshooting |
| Analytics data, if Google Analytics 4 is enabled | To understand how the site is used so we can improve it | According to the retention setting in our analytics configuration |
We do not require an account, and we do not ask for your phone number.
So that you do not have to paste your resume again after using the free score tool, the score page keeps your input in the current browser tab (browser sessionStorage). It is cleared when you close the tab, is never written to long-term storage, and is not shared with any third party. You can also clear it yourself from the report page before submitting.
Resume content is used only for your own report
- We use resume content only to generate the report or documents you asked for.
- We do not use it to train AI models.
- We do not show it to other users, publish it as a sample, or sell it.
- Generated report pages are marked
noindexso that search engines do not list them.
Please do not paste government ID numbers, bank or card numbers, your home address, or other family members’ details. A resume does not need them, and including them increases the harm if anything goes wrong.
Retention: deletion after 30 days
Stored resumes and generated reports are automatically deleted after 30 days. A scheduled cleanup job removes the whole record — the pasted original, the generated report, and any downloadable files — rather than only the original. Please download anything you want to keep before it expires, because deleted content cannot be recovered.
Legal bases and purposes (GDPR)
Where the GDPR applies, we rely on the following legal bases:
- Performance of a contract — to provide the free report you ask the tool to generate.
- Consent — for optional cookies, including analytics and advertising cookies where consent is required, and for any optional communications you agree to.
- Legitimate interests — to keep the service secure, prevent abuse and fraud, and improve the site.
- Legal obligation — to keep records where the law requires it.
Who may process your data
We do not sell personal information. We share it only with service providers that help us run the site:
- Hosting — Vercel. The site is hosted on Vercel, which processes requests and may keep standard server logs.
- AI model inference — the operator’s own API gateway. Resume and job-description text is sent through the operator’s own API gateway to third-party AI model providers so that the model can generate your output. Those providers process the content to return a result and are bound by their own terms and privacy policies.
- Advertising — Google AdSense and its partners. AdSense and its advertising partners may set cookies and similar technologies to serve, cap, and measure ads. See the Cookie Policy.
- Analytics — Google Analytics 4, if enabled. Where the operator enables GA4, it is used to measure aggregate site usage. It is not loaded unless it is enabled and, where required, consented to.
International data transfers
Our providers may store or process data outside your country, including in the United States. Where personal data is transferred from the European Economic Area or the United Kingdom, we rely on the providers’ appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism, together with additional measures where required. You can ask us for more information about the safeguards used.
Your rights under the GDPR
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate personal data corrected.
- Erasure — have your personal data deleted.
- Restriction — ask us to limit how we use your personal data.
- Portability — receive the data you provided in a structured, commonly used, machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — at any time, where processing is based on your consent.
- Lodge a complaint with a supervisory authority — in the country where you live or work, or where the alleged infringement took place.
To exercise any of these rights, see the Contact page, which explains the request channels that currently exist. We respond within the time required by law whenever a request reaches us. Note that stored resumes and reports are deleted automatically after 30 days, so there is often nothing left to action.
Your rights under the CCPA/CPRA
If you are a California resident, you have the right to know what personal information is collected, used, or shared; to delete it; to correct it; and to opt out of the sale or sharing of personal information. You also have the right not to be discriminated against for exercising these rights.
We do not sell personal information. Advertising cookies set by Google and its partners may involve the “sharing” of identifiers for cross-context behavioural advertising as defined by the CPRA. You can opt out of that sharing immediately using the consent controls described in the Cookie Policy, or through Google Ads Settings — those controls work without needing to contact us. To make any other CCPA/CPRA request, see the Contact page for the channels that currently exist.
Children
aibox is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child under 16 has provided personal data to us, see the Contact page for the request channels that exist and we will delete it. In practice, any record that is stored is deleted automatically after 30 days.
Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections and access-controlled storage. No system is completely secure, so we cannot guarantee absolute security. Please avoid submitting sensitive information that a resume does not need.
Do Not Track
We do not currently respond to browser “Do Not Track” signals. Optional analytics and advertising cookies are controlled through the consent choices described in the Cookie Policy and through your browser settings.
Changes to this policy
We may update this policy to reflect changes in the service or the law. The “Last updated” date at the top of this page shows when it last changed. Material changes will be reflected on this page.
How to contact us
Questions or requests about privacy: see the Contact page, which states honestly which contact options do and do not exist.