Privacy Policy

This policy explains what personal data NowToolSpace (“we”, “us”) collects, why, who we share it with, how long we keep it and the choices you have. It applies to everyone who uses the service, wherever you live. NowToolSpace is run by Joshua Basumatary, a sole proprietor based in India, who decides how your data is used and is responsible for it: the “controller” under laws such as the EU and UK General Data Protection Regulation (GDPR), and the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023. You can reach us at support@nowtoolspace.com.

The short version: we use your data to run the service for you. We never sell it, never use it for advertising and never use your resumes to train AI. Files you import or use with our browser tools stay on your device, and tools that run on our servers, such as Word to PDF, delete your document as soon as it is converted. AI tools never receive your name or contact details, and you can delete your account and resumes at any time.

1. What we collect, why, and for how long

• Account details: your name, email address and password, which you give us. Passwords are stored only as a secure one-way hash, so nobody can read them. If you sign in with Google, Google gives us your name, email address and profile picture. Why: to create and secure your account. Kept: until you delete your account.
• Your resumes: everything you type or import into a resume (such as contact details, work history, education and skills), the photo you can add, your template and page settings, and up to 20 earlier versions of each resume. A photo is optional: your browser crops and re-saves it, which removes any location data, and it is stored with that resume and deleted with it. Why: to save, show and download your resumes. Kept: until you delete the resume or your account.
• ATS check results: the score and suggestions, which resume they belong to and the optional job title you give them. We don’t store the job description you paste. Cover letters are shown to you but not stored. Why: so you can look back at your checks. Kept: until you delete the resume or your account.
• AI usage: which AI features you used and when, and what each use cost us. Why: to apply monthly limits and control costs. Kept: until you delete your account.
• Server tool use: when you used a tool that runs on our servers (such as Word to PDF) and your plan at the time, but nothing about the document itself. Why: to apply daily limits and control costs. Kept: 35 days, or until you delete your account.
• Subscriptions and payments: your plan, price, currency, status and dates, the payment reference numbers Dodo Payments sends us, the time you agreed to the subscription terms, and any refund or cancellation request you send us. We never see or store your card, UPI or bank details. Why: to provide Pro, handle refunds and meet tax, accounting and consumer law duties. Kept: for as long as those laws require (in India, usually up to 8 years), also after you delete your account, with the link to your account removed.
• Security information: the IP address and browser type of each signed-in session, and short-lived technical logs kept by our hosting provider (such as IP address, the page requested and errors). We never write resume content into logs. Why: to keep the service and your account secure. Kept: a session and its IP address are deleted when you sign out, or within a day of ending after 7 days without use; logs are deleted within 7 days.

What you have to give us. To create an account you need an email address and a password, or a Google account. To pay, you give Dodo Payments the details its checkout asks for. Everything in your resumes is up to you.

Please leave out sensitive details. A resume doesn’t need information such as health, religion, political views, caste, trade union membership, or government identity numbers such as an Aadhaar, PAN, national insurance or social security number. Please don’t put them in your resumes. If you do, we only store and show them as part of your resume, and you can delete them at any time.

Stored in your browser, not by us. If you build a resume without an account, it’s saved only in your browser until you sign in, when it moves into your account. Files you import (PDF or Word) are read inside your browser and are never uploaded. The same goes for files you use with our PDF and image tools that run in your browser: they are processed on your device, and we never receive, see or store them.

Documents you convert on our servers. A few tools, such as Word to PDF, can’t run in a browser. When you use one, the document you choose is sent over an encrypted connection to a converter we run on Cloudflare, turned into a PDF and sent straight back to you. We don’t store the document or the PDF, we don’t read or log their contents, and the converter deletes them as soon as the conversion ends. It has no internet access, so nothing in your document can be sent anywhere else.

When you delete something. Deleting a resume or your account removes it from the service straight away. Our hosting provider keeps database backups for up to 30 days so data can be restored after a failure, so deleted data can sit in a backup until it ages out. Payment and consent records are kept for as long as tax and consumer law require, as described above.

2. Our legal reasons for using your data

Where the law asks for a legal basis, as the GDPR does, these are ours:

• Contract: to provide the service you signed up for, including your account, resumes, AI features you ask for, Pro and the emails the service needs (such as email confirmation, password resets, subscription confirmations and renewal reminders).
• Legitimate interests: to keep the service secure and prevent abuse, for example by limiting repeated attempts, blocking bots, catching mistyped or disposable email addresses and warning about passwords exposed in data breaches.
• Legal obligation: to keep payment, consent and withdrawal records, and to answer lawful requests from authorities.

Under India’s law, we process your data with your consent, which you give when you create an account and use a feature, and for legitimate uses the law allows, such as keeping payment records or preventing fraud. Wherever we rely on consent, you can withdraw it at any time, for example by deleting your account. We don’t send marketing emails.

3. AI features

When you use an AI feature, we send only the parts of your resume that feature needs, and any job description you paste, to our AI provider. We never send your name, email address, phone number, location, links or your photo. We use only AI providers that don’t keep this data or train their models on it, and we don’t use your content to train AI either.

AI features only make suggestions for you to accept or ignore. We don’t make decisions about you based only on automated processing that have legal or similarly significant effects on you.

4. Who we share it with

We don’t sell your personal data, and we don’t share it for advertising. We share only what each service provider needs to do its job for us, under contracts that require them to protect it:

• Cloudflare hosts the website, the database and the document converter used by tools such as Word to PDF, turns your resume into a PDF when you download one, protects sign-up from bots (Turnstile), checks that an email address’s domain can receive mail, looking up only the part after the @, and counts visits and actions for us without cookies (see section 6).
• Dodo Payments sells Pro as our Merchant of Record and handles subscriptions, payments, taxes and refunds. It receives your name and email address from us, and the payment and billing details you enter on its checkout. As the seller of record it also uses them for its own legal duties (such as tax and fraud prevention) as an independent controller, under its privacy policy.
• OpenRouter and the AI model provider it uses (currently Google or Mistral AI) receive data only when you use an AI feature, as described in section 3.
• Resend sends our emails, so it receives your email address and the message.
• Google is involved only if you choose to sign in with Google.
• Have I Been Pwned checks whether a new password appears in known data breaches. Only the first five characters of a one-way hash of the password are sent, never the password itself.
• Authorities and advisers receive data only when the law requires it, or when needed to protect our legal rights.
• A new owner of the service, if it is ever sold or merged, would receive your data under this policy. We’ll tell you before that happens.

5. International transfers

We’re based in India, and we and our providers process data in several countries, including India, the United States and countries in Europe. Your data may therefore be handled outside the country where you live. When data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards the law recognises, such as the standard contractual clauses in our providers’ data protection terms.

6. Cookies, browser storage and analytics

We use only strictly necessary cookies: a secure session cookie that keeps you signed in, and short-lived cookies that protect sign-in with Google. Because they are strictly necessary, they don’t need your consent, and there is no cookie banner. We don’t use advertising or tracking cookies, and no advertising network. We also use your browser’s storage for guest resumes (see section 1), for your light or dark theme choice, for a flag that tells the site this browser is signed in, so the home page can open your dashboard (it holds no name or email address), and, briefly, to remember which page to show you after checkout and to carry a message such as “Resume deleted” across a page reload. This stays in your browser and never reaches us.

To learn which pages and tools people use, we measure the site in two ways, both through Cloudflare and both without cookies. Cloudflare Web Analytics counts page views on our public pages: the page address, the address you came from, your browser and device type, your country and how quickly the page loaded. Pages inside your account are left out of it completely, because their addresses can contain the id of a resume. Separately, our own server counts a small set of actions, such as a resume being started, a tool finishing its work, a checkout beginning or a payment going through; each count holds the name of the action, whether it came from a guest, a free account or Pro, sometimes which tool or plan it was, and your country.

Neither one sets a cookie, identifies you or follows you to other sites. We do not record your name, your email address, your account id, your IP address, your resume, your files or anything you typed, and the counts cannot be traced back to you or joined to your account. Because none of it is stored on your device, none of it needs your consent under cookie law.

Because we don’t sell personal data or use it for targeted advertising, there is nothing to opt out of. We still treat a Global Privacy Control signal from your browser as a request not to sell or share your data.

7. Your rights

Depending on where you live, you have the right to:

• know what personal data we hold about you, how we use it and who receives it, and get a copy of it;
• correct or update it (most of it you can edit yourself in the app);
• have it erased (deleting your account in your Profile removes your account and resumes straight away);
• receive your data in a portable format;
• object to, or ask us to restrict, some uses of it;
• withdraw your consent at any time;
• have your complaints dealt with; and
• complain to a data protection authority.

To use any of these rights, email support@nowtoolspace.com from the email address on your account, or ask someone you authorise to do it for you. We may need to confirm it’s you. We reply within 30 days, and we don’t charge for it. You won’t be treated differently for using your rights. If we can’t do what you ask, we’ll explain why, and you can appeal by replying to our answer; we’ll respond to an appeal within 45 days.

• European Economic Area, United Kingdom and Switzerland: you can complain to the data protection authority where you live or work.
• India: you can also name someone to use your rights if you die or become unable to, and complain to the Data Protection Board of India if you’re not satisfied with our answer.
• United States: residents of states with privacy laws, such as California, have rights to know, access, correct and delete their personal information, and to opt out of its sale or sharing. We don’t sell personal information or share it for targeted advertising.

8. Security

All connections use HTTPS, passwords are hashed, access to your resumes is checked on every request so that only you can see them, and our providers keep data encrypted at rest. No system is perfectly secure, so please tell us straight away if you notice anything wrong. If a personal data breach affects you, we’ll tell you and the relevant authorities as the law requires.

9. Children

NowToolSpace is for people aged 18 and over, or the age of majority where they live if that is higher. We don’t knowingly collect data from children. If you believe a child has created an account, contact us and we’ll delete it.

10. Changes to this policy

We’ll post any changes on this page with a new date. If a change is important, we’ll tell you by email or in the app before it applies.

11. Contact and grievance officer

For privacy questions, requests or complaints, contact our grievance officer, Joshua Basumatary (Owner), at support@nowtoolspace.com. More ways to reach us are on our contact page.