Privacy Policy

1. Information We Collect

We collect information in the following categories to provide and improve the Guul platform:

Account Information

When you create an account, we collect your name, email address, and profile picture. If you sign in through an OAuth provider (Google, LinkedIn, GitHub, or Facebook), we receive the profile information you authorize from that provider.

Resume & Career Data

Content you provide or upload to create resumes, cover letters, and career documents, including work experience, education, skills, certifications, projects, and professional summaries.

Job Search Data

Job descriptions you paste or upload, job preferences, target roles, and any notes or criteria you provide to tailor your documents.

Payment Information

Billing details such as payment method and billing address are collected and processed by our payment processor (Stripe). We do not store full credit card numbers on our servers.

AI-Generated Headshots

If you use our AI headshot feature, you upload photos that are processed by an AI image generation service to produce professional headshots. Uploaded photos are used solely for headshot generation and are not retained beyond the processing window.

Feedback and Optional Public Quotes

Feedback you send can include a rating, a description of a problem, your message, and an optional name and reply email. We also store where you sent it from, the language and browser details. We may link feedback to your account when you send it from the signed-in app. Download feedback can include the resume ID, template and file format, but does not automatically include resume text. We use a keyed hash of your network address to limit abuse. We use feedback to investigate problems and improve the service. A quote and your display name appear publicly only with your permission and after review. Your reply email stays private.

Technical & Usage Data

Browser type, device information, IP address, operating system, pages visited, feature usage patterns, session duration, and error/crash data collected to operate, secure, and improve the platform.

2. How We Use Your Information

• Provide services: Generate resumes, cover letters, AI headshots, and career documents you request.
• AI-powered features: Analyze job descriptions, match skills, suggest improvements, and generate tailored content using AI/ML models.
• Authentication & security: Verify your identity, prevent abuse, and protect your account.
• Payment processing: Process subscriptions and manage billing through our payment provider.
• Product improvement: Analyze usage patterns (in aggregate) to improve features, fix bugs, and optimize performance.
• Error monitoring: Detect, diagnose, and resolve technical issues and errors.
• Communication: Send transactional emails (password resets, billing receipts) and, with your consent, product updates.
• Legal compliance: Meet legal obligations, respond to lawful requests, and enforce our terms.

3. AI & Machine Learning

Guul uses third-party AI models to power features such as resume content generation, cover letter writing, job description analysis, skill extraction, and professional headshot creation.

How your data is used with AI

• Your resume content, job descriptions, and related inputs are sent to AI model providers to generate or improve your career documents.
• We send only the minimum data required for each AI operation.
• AI providers process data according to their own data processing agreements. Under our agreements, they do not use your data to train their models.

AI model providers we use

• Google Gemini — content generation and analysis
• OpenAI — content generation and analysis
• Anthropic (Claude) — content generation and analysis
• fal.ai — AI headshot image generation

AI-generated content (resumes, cover letters, headshots) belongs to you. We do not claim ownership of content created using our AI features.

4. Cookies & Tracking

We use the following types of cookies and tracking technologies:

• Essential cookies: Required for authentication, session management, and core functionality. Cannot be disabled.
• Analytics: We use PostHog and Vercel Analytics to understand how the platform is used in aggregate. This includes page views, feature usage, and performance metrics.
• Error tracking: Sentry captures error and crash data to help us identify and fix bugs.

We do not use advertising cookies or sell data to advertisers. You can manage cookie preferences through your browser settings.

5. Third-Party Services

We work with the following categories of third-party service providers to operate Guul:

Each provider is bound by their own privacy policy and, where applicable, a data processing agreement with us.

6. Sharing of Information

We share your personal information only in the following circumstances:

• Service providers: With the third-party vendors listed above, solely to operate and improve the platform.
• Legal requirements: When required by law, court order, or governmental regulation.
• Safety & rights: To protect the rights, safety, or property of Guul, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

We do not sell your personal information to third parties.

7. Data Retention

• Guest checker results: The return shortcut lasts 15 minutes in the current browser tab. Clear this result removes the checker copy from that tab. Builder drafts are stored separately and do not share that expiry. Clearing a result does not remove account documents, public links or server processing records. Guest storage and deletion
• Processed import copies: Resume import results can be stored for reuse for seven days. Expired entries are no longer used and are removed by scheduled cleanup. This is separate from saved account documents and provider processing.
• Account data: Retained as long as your account is active. Deleted upon account deletion request, subject to legal retention requirements.
• Resume & career documents: Retained while your account is active. You can delete individual documents at any time.
• AI headshot photos: Source photos are deleted after processing. Generated headshots are retained with your account.
• Payment records: Transaction records retained for up to 7 years for accounting and tax compliance.
• Analytics & logs: Anonymized usage data may be retained indefinitely. Identifiable logs are retained for up to 90 days.
• Error data: Crash reports and error data are retained for up to 90 days.

8. Data Security

We implement industry-standard technical and organizational measures to protect your data:

• All data is encrypted in transit using TLS/HTTPS.
• Data at rest is encrypted in our database and storage systems.
• Authentication is handled through secure OAuth 2.0 flows.
• Access to production systems is restricted and logged.
• We conduct regular security reviews of our infrastructure and dependencies.

While we take reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

9. Your Rights & Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate information through your profile settings or by contacting us.
• Deletion: Request deletion of your account and personal data. See our Data Deletion page for instructions.
• Portability: Request your data in a portable, machine-readable format.
• Opt-out: Unsubscribe from marketing communications at any time.
• Restrict processing: Request that we limit how we use your data in certain circumstances.

To exercise any of these rights, contact us at support@guul.io. We will respond within 30 days.

10. GDPR (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis for processing: We process your data based on (a) your consent, (b) performance of a contract (providing the service), (c) legitimate interests (security, improvement), and (d) legal obligations.
• Right to object: You can object to processing based on legitimate interests.
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time.
• Right to lodge a complaint: You may file a complaint with your local data protection authority.

Data controller: Guul, support@guul.io

11. CCPA (California Users)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: You can request what personal information we collect, use, disclose, and sell.
• Right to delete: You can request deletion of your personal information.
• Right to opt-out of sale: We do not sell personal information. No opt-out is necessary.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact support@guul.io with subject line CCPA Request.

12. International Data Transfers

Guul is operated from the United States. If you access our services from outside the United States, your information may be transferred to, stored, and processed in the U.S. or other countries where our service providers operate. By using Guul, you consent to the transfer of your data to these jurisdictions. We ensure appropriate safeguards are in place, including standard contractual clauses where required.

13. Children's Privacy

Guul is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us at support@guul.io and we will promptly delete the information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the “Last updated” date at the top of this page and, for significant changes, by sending a notification to your registered email address or displaying a prominent notice within the platform. Continued use of Guul after changes take effect constitutes acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

• Email: support@guul.io
• Service: Guul

We aim to respond to all inquiries within 30 days.