1. Scope of This Policy
This policy explains how SayBuff collects, uses, stores, and protects your personal information when you use the Service, and what rights you have over it. By using the Service you confirm that you have read this policy.
2. What We Collect
We collect only what is strictly necessary to run the Service and safeguard transaction security:
- Account information: email address, display name, avatar; if you register with email, also a password stored in irreversible hashed form, which we cannot reverse into your original password.
- Sign-in and device environment: authentication methods, IP addresses, browser User-Agent device fingerprints, and anonymous identifiers generated for guest device recognition, utilized for security protection and fraud prevention.
- Resume content: resumes and related files you create, upload, or edit.
- Interview records: the dialogue from mock interviews and the evaluation reports generated from them.
- ATS scan records: scores and report structure, plus the resume text read in order to run the scan.
- Job information and photos: job text you paste, and headshots you upload or generate.
- Transactions and security records: top-up orders, external transaction references, credit consumption ledger, balance changes, and network access records retained for payment dispute defense. We never collect or store full credit card numbers.
3. How We Use It
Use is limited to the following:
- Providing the Service: generating resumes, running mock interviews, completing ATS scans, and exporting files.
- Accounts and security: authentication, abuse prevention, rate limiting, and risk control.
- Service notices: sending verification, password-reset, and service-change emails.
- Improving the product: compiling aggregated, de-identified usage statistics.
- We do not sell your personal information, and we do not use it for third-party advertising.
4. Who Else Sees Your Information
We use a small number of third-party services to process data. They act only on our instructions and do not use the data for their own purposes:
- Payments and compliance: Waffo Pancake, operating as our Merchant of Record (MoR) to process checkout billing details and payment commands in compliance with tax and merchant rules. Payment card data is processed exclusively by PCI-DSS compliant Waffo Pancake and is never stored on our servers.
- AI model providers: resume and dialogue content you submit is sent to the model provider to generate results.
- Email delivery: Resend, used only to send verification, reset, and notification emails.
- File export: Amazon Web Services (Lambda, servers located in the United States).
- Bot checks: Cloudflare Turnstile, which receives your IP address and browser characteristics to determine whether a request is automated.
- Image generation compliance & prompt moderation: our authorized payment and content-safety partners (e.g., Waffo Pancake), which screen text prompts submitted solely for AI headshot/image generation against acceptable use policies; core text-based features (resume rewriting, ATS diagnosis, interview simulation) are not sent for this review, and the review never includes your source photos.
5. Cookies and Analytics
We use two kinds of cookies:
- Essential cookies: keeping you signed in, remembering your language preference, and security checks. The Service cannot work without them.
- Analytics cookies (Google Analytics): understanding page visits and feature usage so we can improve the product.
- Google Analytics sets identifiers such as _ga and records your IP address and browsing behaviour; that data is processed by Google LLC (United States).
- Apart from essential cookies, we set analytics cookies only after you consent, and you can withdraw that consent at any time.
6. Data Retention
We keep data only as long as necessary:
- Raw resume text read during an ATS scan: expires 24 hours after the scan and is then physically deleted from the database by a cleanup job, leaving only scores and report structure.
- Guest (unregistered) data: automatically cleaned up after 24 hours.
- Account data: kept until you delete it, or until a reasonable period after your account ends.
- Transaction records: kept for the period required by applicable tax law.
7. Your Rights
You have the following rights over your personal information, most of which you can exercise directly in the app:
- Access and correction: view and edit your profile in account settings.
- Deletion: delete specific items such as resumes, interview records, scan history, job information, headshots, and AI conversations.
- Withdrawal of consent: turn analytics cookies off at any time.
- Account closure: email [email protected] and we will act once we have verified your identity.
- If you object to how your information is handled, contact us and we will respond within 30 days.
8. Minors
The Service is intended only for users aged 18 or over. We do not offer the Service to minors and do not knowingly collect their personal information; if we learn we have, we will delete it promptly.
9. Security
We use reasonable technical and organisational measures to protect your information, including encryption in transit, irreversible password storage, access controls, and rate limiting. No system can be guaranteed absolutely secure, so please keep your credentials safe.
10. Changes to This Policy
When this policy changes we update the effective date at the top; we will announce material changes in-app or by email. Continued use means you are aware of the updated policy.
11. Contact Us
If you have privacy questions, or want to exercise the rights above, contact us at [email protected].