Privacy Policy

Ruubu is operated by Papel Espresso LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Papel Espresso LLC is the data controller for the personal data described in this policy, and "we", "us" and "our" in this policy mean Papel Espresso LLC. For any privacy question or request, write to support@ruubu.com.

When you run an analysis, we fetch the public content of the LinkedIn profile URL you provide, with your explicit consent. This retrieval happens only at your instruction and on your behalf: you initiate each analysis and direct us to fetch the data for the profile you submit, confirming it is your own or one you are authorized to analyze. When you use the free resume checker, we store the resume text you paste or upload and any job description you add, so we can score it and open it in the editor for you. We also store your account email, the resumes you create, and your job-matching targets. We do not collect passwords: you sign in with a code sent by email or with a sign-in provider (Google, LinkedIn or Apple).

If you sign in with Google, LinkedIn or Apple, that provider confirms who you are and sends us only basic account details; your password for that service never reaches us. From Google and LinkedIn we receive your name, your email address (and whether the provider has verified it) and the web address of your profile picture. From Apple we receive your email address, or a private relay address if you choose Hide My Email (our emails then reach you through Apple's relay), and your name only if you share it the first time you sign in. We use these details only to create your account and sign you in. We do not ask these providers for your contacts, posts or connections, and we never post anything on your behalf. If the provider confirms an email address that already belongs to a Ruubu account, you are signed in to that account.

If you choose to import your profile directly from LinkedIn, LinkedIn asks for your permission and then gives us, once, the profile sections you see listed (such as positions, education, skills, certifications, languages, projects, volunteering, honors, publications and courses). We use them only to build the resume you asked for, which is saved to your account. We do not keep LinkedIn's access token: it is used for that one import and then revoked.

If you use AI headshots, we also process the photos of your face that you upload, the styles and optional description you choose, the portraits generated from them, and a record of your consent. The AI headshots sections below explain how.

If you start a free trial, our payment processor Stripe gives us a card fingerprint, a code that identifies the card without revealing its number. We keep it together with a one-way hash of your email address so that each person and card gets only one free trial. We never see or store your full card details.

If you use the free writing tools (the resume bullet point, resume summary, cover letter and resignation letter generators), the text you type is sent through OpenRouter to an AI model to write the result. We do not save what you type or the result. To enforce the daily limits we keep a temporary count of uses per network address for up to 24 hours, and we log each use without its text (which tool, how much text was processed and when), linked to your account if you are signed in.

We also keep pseudonymous usage and diagnostic records on our own servers: the pages you open (without query parameters), the features you use, and technical error reports (a shortened error message with personal details removed, your browser and operating system family and version, and your device type). We never record what you type or the content of your resume. Page views and error reports are deleted after 60 days and other usage records after 13 months; only daily totals without any identifier are kept longer. Usage records also note the country your connection comes from, as a two-letter code; we don't store your IP address for this.

• Resume text you paste or upload into the free resume checker, and any job description you paste with it, is automatically deleted after 7 days. If you open the result in the editor, the resume and job description are saved to your account instead.
• Raw profile data is kept only while your plan is active so your job matches stay current, and is automatically deleted within 30 days after your access ends.
• Your resume content stays as long as your account exists, so you can return to it.
• If you delete your account, it is deleted right away, together with your resumes, cover letters, analyses, job matches, interview kits, AI headshots, the photos on your resumes and everything else you saved. Copies in our backups, and cached copies of photos, can remain for up to 30 days. We keep only: messages you sent us through the contact or feedback form, as our support history; your email address if you unsubscribed or an email to you bounced, so we never email you again; resume checker scores and results, without your resume text or any link to you; billing, refund and free-trial records (for a trial, the card fingerprint and email hash described above, so each person gets only one trial); a record of the emails we sent you, stored under a one-way hash of your address; logs of consent, export and deletion; usage statistics without your content; and AI headshot consent records, as described below. Photos you replaced or removed from a resume are deleted automatically after 30 days.
• Photos you upload for AI headshots and the portraits generated from them are deleted automatically 30 days after the session starts, or earlier if you delete them. A portrait you add to a resume stays with that resume.
• Messages you send to Ask Ruubu, the in-app assistant, and its replies are sent through OpenRouter to an AI model to write the answer, and are deleted automatically 30 days after they are written. You can delete the whole chat earlier from the chat panel.

We never sell or share your data for advertising. These processors handle it strictly to provide the service: OpenRouter, Inc. (USA), which routes requests to AI model providers such as OpenAI and Google (text generation), Apify (profile and job data retrieval), Stripe (payments), Resend (transactional email), Cloudflare (infrastructure and storage), and Google Analytics (anonymized usage measurement).

For AI headshots only, OpenRouter, Inc. (request routing), Google LLC and OpenAI, L.L.C. (image generation) also process your photos, as described in the AI headshots section.

Besides account emails (sign-in codes, receipts, free-trial confirmations and the alerts you turn on), we may send account holders two kinds of short emails. After a resume check: up to three follow-ups with tips for improving the resume and our plan offers. And now and then: a short email about one feature you haven't used yet, at most four in all, at least three days apart and only within 45 days of signing up or of your last check; if you are on a trial or a paid plan, these only cover features your plan already includes. If you email yourself a checker report without an account, we send follow-ups only if you tick the box for them and then confirm by email; an unconfirmed address is deleted after 7 days, and such an address never gets feature emails. Every one of these emails has a one-click unsubscribe link, and you can also turn them off on the email preferences page linked in each email. We stop as soon as you unsubscribe or an email to you bounces, and the resume-check follow-ups also stop once you start a plan. These emails are sent through Resend.

The extension is optional. It runs on the job boards and application systems listed on our extension page, and on another site's tab only after you click its icon or press its shortcut. There it looks for a job posting, the job cards of a result list, an application form or your own LinkedIn profile. It does not read other pages, your browsing history or your other tabs, and it never reads other people's LinkedIn profiles.

On result lists the extension sends us each card's company, location and link, to show H-1B sponsor data and whether the job is in your tracker; the Quick fit estimate is computed in your browser. When you open a job (automatic scoring, on by default and switchable off in the extension's settings), or save, score or tailor it, the extension sends that job's title, company, location, description and link with the resume you chose. To analyse a job, its text goes to our AI provider once; we keep that analysis for 30 days and reuse it only for people whose copy of the same job has the same text. We use it to compute the match score and to create the saved job and its application package in your account.

Autofill runs in your browser. The extension downloads the fields of the resume you chose (contact details, links, work history, education) and its PDF from us, and types them into the form only after you confirm the preview. What you type into application forms is never sent to us. When you ask for an answer draft, the question's label is sent with the job and your resume; the draft comes back for you to edit. Questions about visas, salary, demographics or disability are filled only from the answers you saved in My application answers (downloaded from us when you open autofill, never drafted by AI); citizenship, visa type, date of birth and consent are never answered. It sends a form only when you click Confirm and submit (Greenhouse, Lever, Ashby and SmartRecruiters single-page forms, every required field filled, no CAPTCHA on the page), and then presses the form's own submit button once; on LinkedIn and Workday it never clicks Next or Submit. An answer you choose to save for later is sent to us and kept in your account. On Greenhouse forms, our server reads the employer's public question list from Greenhouse so each answer goes into the right field. After you submit, when the site's confirmation page appears, it marks the job as applied in your tracker and offers Undo (with only one of the two signals it asks first). On your LinkedIn Applied list and on employers' candidate portals you open, it sends the job titles, employers, links and status labels shown there, so your tracker can follow them; a rejection is never applied without your click. You can turn this off in Settings (“Track applications automatically”). To measure and fix autofill, the extension also sends fill statistics for each form it fills: the site's application system (for example Greenhouse or Workday) and, for each field, only its type (such as email or phone), whether it was required and what happened to it (filled, left empty, changed by you, unticked, or a sensitive question it skipped), plus whether the form was submitted and confirmed. Never the values, what you typed, the field's wording or the page address. These statistics are linked to your account so that they are deleted with it, and are kept for 90 days.

On your own LinkedIn profile you can import the sections shown on that page (headline, About, experience, education, skills, certifications, languages, projects, volunteering) as a new Ruubu resume after a preview, compare them with your resume, fill LinkedIn's own edit dialogs from your resume and ask for profile suggestions; for suggestions and rewrites those sections go to our AI provider. Ruubu never saves anything on LinkedIn: you click Save, and your phone, email and address are never copied to LinkedIn.

On LinkedIn's My Jobs page, when you open Ruubu there, it reads the jobs listed on that page (title, company, location, date, link) and adds the ones you pick to your tracker. It moves to the next page only when you click.

The extension never sees your password. When you click Connect on ruubu.com we give it a token that can only save jobs, score them, read your resumes for autofill and write with Ruubu for you within your plan. It is kept in the extension's storage on your device; we store only a fingerprint (hash) of it. A token is valid for 14 days, renews while you use the extension and ends 90 days after you connected. You can disconnect in the extension or on the connect page at any time, and removing the extension deletes it.

Saved jobs stay in your account until you delete them or your account. Expired or disconnected tokens are deleted after 30 days. We do not sell this data, use it for advertising or share it beyond the processors listed above. The extension contains no third-party analytics or advertising code; the fill statistics described above are the only usage statistics it sends. Our use of the data the extension handles complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

AI headshots turns 1 to 5 photos of yourself into professional portraits for your resume and LinkedIn profile. It is available on paid plans, only to people aged 18 or older and only for their own photos. We process the photos you upload, which show your face; the styles and optional description you choose; the generated portraits; an automated quality verdict for each image; and a record of your consent (version, date, IP address, browser, country and, for US residents, your typed name). Photo metadata such as EXIF (camera, location, date) is removed when you upload.

We use these images only to create the headshots you ask for. Our legal bases are our contract with you (GDPR Art. 6(1)(b)) and, because images of your face are sensitive, your explicit consent, which you give on a separate screen before any photo is uploaded (the standard of GDPR Art. 9(2)(a)). You can withdraw consent at any time by deleting your photos. This stops all further processing and does not affect processing that already took place.

What we never do with your photos:

• We do not create face templates, face geometry, embeddings or any other biometric identifier, and we do not identify you, compare you with other people or estimate your age. An automated check reviews each photo for quality (one face, no sunglasses, sharpness) and each result for defects and resemblance to your upload. It is a visual review: we keep only the verdict (such as one face, in focus), never a face template.
• Neither we nor our providers use your photos or portraits to train AI models. Requests are sent with zero data retention, so providers do not keep them after returning a result.
• We do not sell, rent or share your photos or portraits, or use them for advertising.
• We do not show your photos or portraits to other users or publish them. A portrait becomes visible to others only if you add it to a resume and share that resume.

Your photos are stored on Ruubu's own server, not in public storage. To generate portraits, they are sent to OpenRouter, Inc. (USA), which routes each request, with zero data retention, to Google LLC (Gemini image models) or, as a fallback, OpenAI, L.L.C. The automated quality check runs the same way. These companies act as our processors. Transfers of personal data from the EEA, the UK or Switzerland to the USA rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, and otherwise on Standard Contractual Clauses. Transfers from Türkiye and Brazil are described in their own section below.

The portraits are AI-generated. Every file you download or add to a resume carries a machine-readable AI-generated label in its metadata (IPTC/XMP; C2PA content credentials will follow), and we show a notice when you download. Some formats, such as the PDF export of your resume, may not keep that metadata. The portraits are not official ID, passport or biometric photos.

You can view, download and delete your headshot sessions in the app and delete all of them at once in Settings → Data, and headshot details are included in your data export. The rights described in the sections below apply to these images too.

• Uploaded photos and generated portraits: deleted automatically 30 days after the session starts, or as soon as you delete the session (Delete now), delete all headshots in Settings → Data, or delete your account.
• A portrait you add to a resume: becomes that resume's photo. It is stored like any other resume photo, at an unlisted web address, and stays while a resume uses it. Once you remove it from the resume, delete the resume or delete your account, it is deleted (within 30 days).
• Consent records: kept for 3 years after you give consent, so we can prove it. If you delete your account, we remove your user ID from them.
• Session records without images (dates, plan, styles, number of images, cost): kept while your account exists, for billing and abuse prevention.

Deleting removes the files from our server and the related records from our database. Our providers do not keep copies, because every request is sent with zero data retention.

If you are in the EEA or UK, you have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. You can export all your data as JSON or delete your account and its data at any time from Settings → Data. Consent, export and deletion events are logged for compliance. To exercise any of these rights, email support@ruubu.com from your account address and we will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

If you are a California resident, you have the right to know what personal information we collect, to request access to or deletion of it, and to correct inaccurate information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. We will not discriminate against you for exercising any of these rights. To make a request, email support@ruubu.com from your account address.

We do not create biometric identifiers such as scans of face geometry. Because some US state laws set strict rules for images of faces and data derived from them, we handle headshot photos as if those laws applied: US residents sign a written release before any photo is uploaded, and we follow the public retention and destruction schedule below.

• Illinois (Biometric Information Privacy Act) — retention and destruction schedule: we collect images of your face only after you sign the written release on the consent screen, which states the purpose and how long we keep them. We keep them no longer than 30 days after the session starts and permanently destroy them when that purpose is fulfilled, when you delete them, or when you close your account, whichever comes first, and in every case within 3 years of your last interaction with us. We do not sell, lease, trade or otherwise profit from them, and we disclose them only to the providers named above to perform the service you asked for, or when the law requires it.
• Texas and Washington: we do not capture or enroll biometric identifiers for a commercial purpose. We ask for your consent before processing images of your face, never sell them, and destroy them on the schedule above. Under Washington's My Health My Data Act, we use them only to provide the service you request.
• California (CCPA/CPRA): images of your face may be sensitive personal information. We use them only to create the headshots you ask for, which is a permitted purpose, so we do not use or disclose them for anything that would give you a right to limit that use. The California rights described above apply.
• Other states: where a state consumer-privacy law (for example in Colorado, Connecticut, Virginia or Texas) treats images of your face as sensitive data, we process them only with your consent, and you can withdraw it at any time by deleting them.

Questions or deletion requests: email support@ruubu.com.

Türkiye — Personal Data Protection Law No. 6698 (KVKK): Ruubu (Wyoming, USA) is the data controller. We process your account and resume data to perform our contract with you, and images of your face for AI headshots only with your explicit consent, which you give separately from this notice. Your data is stored and processed outside Türkiye (on our server and by the providers named above) under the safeguards of Article 9 of the law. You have the rights listed in Article 11, including to learn whether your data is processed, ask for correction or deletion, and object to a result that goes against you; send requests to support@ruubu.com. If we do not answer or you disagree with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Brazil — General Data Protection Law (LGPD, Law No. 13,709/2018): we process images of your face, which may be sensitive personal data, only with your specific and prominent consent (Art. 11, I), and your other data to perform our contract with you. International transfers rely on the safeguards in Art. 33. You have the rights in Art. 18, including confirmation, access, correction, deletion, portability and withdrawal of consent; send requests to support@ruubu.com. You can also complain to the National Data Protection Authority (ANPD).

Ruubu uses strictly necessary cookies to keep you signed in and the service working. It also uses Google Analytics to measure how the site is used (page views and feature use), so we can improve the product, and the Google Ads tag to measure whether our ads lead to sign-ups and purchases. Both set first-party cookies and send pseudonymous usage data to Google. We never sell your data. These tags run only on the live site, and blocking them with a cookie or tracker blocker does not affect any feature. Visitors from the European Economic Area, the United Kingdom and Switzerland are asked first, as explained below.

Google Analytics and Google Ads tags also measure how our ads perform, for example whether a visit from an ad led to a sign-up or a purchase. If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask first: these cookies are set only if you accept, and you can decline. Until you choose, or if you decline, Google may still receive cookieless signals (such as a page view without a cookie or advertising ID), which it uses for aggregate modelling. Your choice is stored in a cookie on this site for 12 months, and you can change it with the button below. The essential cookies that keep you signed in are always used.

Ruubu also sets a few first-party cookies of its own, which are not shared with Google or anyone else. rb_aid is a random visitor ID (no name or email in it) that our own analytics use to count visits and see where people drop off in our sign-up and checkout steps; when you are signed in, those events are also linked to your account. It lasts 12 months, but in the European Economic Area, the United Kingdom and Switzerland it is deleted when you close your browser unless you accept analytics cookies. rb_consent stores your cookie choice for 12 months, and rb_region remembers for one day that we need to ask you. rb_si only notes that you are signed in (no name, email or account ID in it), so the top menu shows the right button straight away; it lasts 30 days and is removed once you are no longer signed in.

We maintain reasonable technical and organizational measures to protect your data. In the unlikely event of a personal-data breach that is likely to result in a risk to your rights, we will notify affected users and, where required, the relevant supervisory authority without undue delay and in accordance with applicable law.

This Privacy Policy and any dispute relating to it are governed by the laws of the State of Wyoming, USA, without regard to its conflict-of-laws rules, except where a mandatory local data-protection law applies to you. If we make material changes to this policy, we will update the "last updated" date above and, where appropriate, notify you.