Privacy Policy

Information you provide

We process the resume text, target role, optional job description, answers and notes you submit, together with the topics, questions and feedback generated from them. When you sign in with Google, we receive account details such as your name, email address and profile image to identify your account and save your progress.

Files and AI processing

Resume files are read in your browser. The extracted or pasted text you submit is sent to ResumeDrill and to OpenAI for AI processing. We also use relevant saved context and practice answers to personalise later questions and feedback. Review the text before submitting it: remove your name, email, phone number, home address and confidential details you do not want processed. Keep the experience and achievements you want to practise. This is manual review; ResumeDrill does not guarantee that identifying information has been removed. If you choose Speak, your microphone recording is sent to ResumeDrill and OpenAI to create a transcript. ResumeDrill does not save the raw recording. The transcript is processed and stored like an answer you type. We do not create voiceprints or other biometric identifiers from recordings.

Questions, feedback and scores are generated automatically by AI. They are practice aids and are not used to make decisions that have legal or similarly significant effects on you. OpenAI processes submitted text through its API as our service provider; under its API terms it does not use that data to train its models and may keep it for up to 30 days to monitor abuse. Resumes often mention other people, such as referees or colleagues; remove their details unless you need them for practice.

Storage and service providers

Cloudflare hosts the app and database and provides Turnstile security checks. Google provides sign-in, OpenAI provides AI processing, and Stripe processes payments. Sign-in and security systems can process technical information such as IP addresses, browser information, session identifiers and authentication tokens. We use these services to run the app, protect it from abuse and provide your practice experience. When you start checkout, we share your account email and an internal account identifier with Stripe. Card details go directly to Stripe; ResumeDrill never receives or stores them. Stripe keeps payment and tax records as the law requires, even after you delete your account. Deleting your account also asks Stripe to delete the customer profile we created.

These providers may process information outside Malaysia. We do not promise that processing or storage takes place only in Malaysia.

How long information is kept

An anonymous preview is available for seven days. Expired preview records are removed by scheduled cleanup. Saving a preview to your account copies your resume and practice results into account storage. Account history, including previous resumes and practice, currently has no automatic expiry; replacing your resume does not delete that history. Service-provider logs and recovery copies may have separate retention periods, so expiry or deletion from the live app does not mean every copy disappears immediately.

Rejected AI-generated questions are retained for up to 14 days to diagnose generation-quality problems. These records contain the complete generated question, which may repeat details from your submitted experience, and rejection diagnostics; a topic identifier is retained with the record. Your resume, training context, answers and notes are used to generate questions but those source fields are not stored separately in these diagnostic records; neither are your email address or direct account identifier.

Product measurement

We count fixed activities, such as onboarding steps, page views, active screen time and saved feedback, to understand how ResumeDrill is used. These events do not contain your resume, answers, notes, file name or email address. Random first-party cookies identify a browser for up to 90 days and a visit after 30 minutes of inactivity. We link that browser’s unassigned activity to your account when you sign in, using pseudonymous identifiers to measure onboarding and return usage. Shared browsers and deleted cookies can affect these estimates. We do not record session replay. Pseudonymous activity is not the same as anonymous data. Events older than 90 days are removed by scheduled cleanup.

We do not use measurement cookies for visitors in the EEA, UK or Switzerland. Everywhere, we honour a Global Privacy Control signal as a refusal, and you can refuse measurement here. Sign-in and security cookies are needed for the service and are always used. Refuse measurement cookies

Why we may process your information

Where the EU or UK GDPR applies, we rely on: contract to provide the practice features, account and purchases you ask for; consent for sending the resume text, answers and recordings you choose to submit to OpenAI, which you can withdraw at any time; legitimate interests in securing the service, preventing abuse, diagnosing generation quality and understanding usage; and legal obligation for payment, tax and accounting records. Under Malaysia’s Personal Data Protection Act 2010, we process your information with your consent for these purposes.

International transfers

Our providers may process information in the United States and other countries. Where the EU or UK GDPR applies, transfers rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) or an adequacy decision, as offered in each provider’s data processing terms. Where the Malaysian PDPA applies, transfers are made under the conditions it permits, including your consent and contracts that require equivalent protection.

Children

ResumeDrill is for people aged 16 or older. We do not knowingly collect information from children under 13, or from anyone below the age of digital consent where they live. If you believe a child has given us information, contact us and we will delete it.

Security and breaches

We use access controls, encryption in transit and provider security measures to protect information. If a personal data breach is likely to cause significant harm, we will notify the relevant regulator within 72 hours of becoming aware of it where required and tell affected users without undue delay.

Your choices and requests

You choose what to submit. Resume text and a target role are needed for personalised practice; a job description is optional. Without the required information or permission to process it, we cannot provide those features. You can permanently delete your account from Profile. You can also email hello@moriyaworks.com to request access, correction or deletion of your information, withdraw consent to processing, or raise a privacy concern. We may need to verify that the information belongs to you. Where a legal requirement limits a request, we will explain the applicable restriction. Depending on where you live, you may also ask for a portable copy of your information, object to or restrict processing based on legitimate interests, and complain to your data protection regulator (in Malaysia, the Personal Data Protection Commissioner; in the EU or UK, your local supervisory authority). We respond within the time the applicable law requires. Our data protection contact is hello@moriyaworks.com.

US state privacy rights

In the past 12 months we collected identifiers (name, email, IP address), commercial information (purchases), internet activity (in-app usage events), audio (voice answers, not stored) and professional information (resume content and answers), from you and your browser, for the purposes above. We disclose them only to the service providers named above to run ResumeDrill. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive information to infer characteristics about you. Residents of California and other US states with privacy laws may request to know, access, correct or delete their information, and to opt out of sale or sharing, by emailing us or through an authorised agent. We will not discriminate against you for exercising these rights.

Maklumat yang anda berikan

Kami memproses teks resume, jawatan sasaran, huraian kerja pilihan, jawapan dan nota yang anda hantar, serta topik, soalan dan maklum balas yang dijana daripadanya. Apabila anda log masuk melalui Google, kami menerima butiran akaun seperti nama, alamat e-mel dan gambar profil untuk mengenal pasti akaun serta menyimpan kemajuan anda.

Fail dan pemprosesan AI

Fail resume dibaca dalam pelayar anda. Teks yang diekstrak atau ditampal dan dihantar akan diterima oleh ResumeDrill dan OpenAI untuk pemprosesan AI. Konteks dan jawapan latihan yang disimpan juga digunakan untuk memperibadikan soalan serta maklum balas seterusnya. Semak teks sebelum menghantarnya. Buang nama, alamat e-mel, nombor telefon, alamat rumah dan maklumat sulit yang anda tidak mahu diproses. Kekalkan pengalaman serta pencapaian yang ingin anda latih. Semakan ini dilakukan secara manual; ResumeDrill tidak menjamin bahawa semua maklumat yang boleh mengenal pasti seseorang telah dibuang. Jika anda memilih Speak, rakaman mikrofon anda dihantar kepada ResumeDrill dan OpenAI untuk menghasilkan transkrip. ResumeDrill tidak menyimpan rakaman mentah tersebut. Transkrip diproses dan disimpan seperti jawapan yang anda taip.

Penyimpanan dan penyedia perkhidmatan

Cloudflare menyediakan pengehosan aplikasi, pangkalan data dan semakan keselamatan Turnstile. Google menyediakan log masuk, OpenAI menyediakan pemprosesan AI, manakala Stripe memproses pembayaran. Sistem log masuk dan keselamatan boleh memproses alamat IP, maklumat pelayar, pengecam sesi dan token pengesahan. Perkhidmatan ini digunakan untuk mengendalikan aplikasi, mencegah penyalahgunaan dan menyediakan latihan anda. Apabila anda memulakan pembayaran, kami berkongsi alamat e-mel akaun dan pengecam akaun dalaman dengan Stripe. Butiran kad dihantar terus kepada Stripe; ResumeDrill tidak menerima atau menyimpannya. Stripe menyimpan rekod pembayaran dan cukai seperti yang dikehendaki oleh undang-undang, walaupun selepas anda memadam akaun. Memadam akaun anda juga meminta Stripe memadam profil pelanggan yang kami cipta. Penyedia ini mungkin memproses maklumat di luar Malaysia; kami tidak menjanjikan pemprosesan atau penyimpanan hanya di Malaysia.

Tempoh penyimpanan

Pratonton tanpa akaun tersedia selama tujuh hari. Rekod pratonton yang tamat tempoh dipadam melalui pembersihan berjadual. Apabila pratonton disimpan ke akaun, resume dan hasil latihan disalin ke penyimpanan akaun. Sejarah akaun, termasuk resume terdahulu dan latihan, tidak mempunyai tarikh luput automatik pada masa ini. Menggantikan resume tidak memadam sejarah tersebut. Log dan salinan pemulihan penyedia perkhidmatan mungkin mempunyai tempoh penyimpanan berasingan; pemadaman daripada aplikasi tidak bermakna setiap salinan hilang serta-merta.

Soalan janaan AI yang ditolak disimpan sehingga 14 hari untuk mendiagnosis masalah kualiti penjanaan. Rekod ini mengandungi teks penuh soalan yang dijana, yang mungkin mengulangi butiran pengalaman yang anda hantar, diagnostik penolakan, dan pengecam topik disimpan bersama rekod tersebut. Resume, konteks latihan, jawapan dan nota anda digunakan untuk menjana soalan tetapi medan sumber tersebut tidak disimpan secara berasingan dalam rekod diagnostik ini; alamat e-mel dan pengecam akaun langsung anda juga tidak disimpan.

Pengukuran penggunaan

Kami mengira aktiviti tertentu seperti langkah pengenalan, paparan halaman, tempoh skrin aktif dan maklum balas yang disimpan untuk memahami penggunaan ResumeDrill. Rekod ini tidak mengandungi resume, jawapan, nota, nama fail atau alamat e-mel anda. Kuki pihak pertama rawak mengenal pasti pelayar sehingga 90 hari dan lawatan selepas 30 minit tidak aktif. Apabila anda log masuk, aktiviti pelayar yang belum dipautkan akan dikaitkan dengan akaun menggunakan pengecam samaran untuk mengukur pengenalan dan penggunaan semula. Pelayar yang dikongsi dan kuki yang dipadam boleh mempengaruhi anggaran ini. Kami tidak merakam ulang tayang sesi. Data berpseudonim tidak sama dengan data tanpa identiti. Rekod aktiviti yang berusia lebih daripada 90 hari dipadam melalui pembersihan berjadual.

Asas pemprosesan dan pemindahan

Di bawah Akta Perlindungan Data Peribadi 2010, kami memproses maklumat anda dengan persetujuan anda bagi tujuan yang diterangkan. Soalan, maklum balas dan skor dijana secara automatik oleh AI sebagai alat latihan dan tidak digunakan untuk membuat keputusan yang memberi kesan undang-undang kepada anda. OpenAI tidak menggunakan data API untuk melatih modelnya dan boleh menyimpannya sehingga 30 hari untuk memantau penyalahgunaan. Kami tidak mencipta cap suara atau pengecam biometrik daripada rakaman. Pemindahan ke luar Malaysia dibuat mengikut syarat yang dibenarkan oleh Akta, termasuk persetujuan anda dan kontrak yang mewajibkan perlindungan setara.

Kanak-kanak dan keselamatan

ResumeDrill untuk pengguna berumur 16 tahun ke atas. Kami tidak sengaja mengumpul maklumat kanak-kanak. Jika berlaku pelanggaran data peribadi yang mungkin menyebabkan kemudaratan ketara, kami akan memaklumkan Pesuruhjaya dalam tempoh 72 jam selepas mengetahuinya dan memaklumkan pengguna yang terjejas tanpa kelewatan yang tidak wajar.

Pilihan dan permintaan anda

Anda memilih maklumat yang dihantar. Teks resume dan jawatan sasaran diperlukan untuk latihan diperibadikan; huraian kerja adalah pilihan. Tanpa maklumat yang diperlukan atau kebenaran untuk memprosesnya, kami tidak dapat menyediakan ciri tersebut. Anda boleh memadam akaun anda secara kekal melalui Profil. Anda juga boleh menghantar e-mel kepada hello@moriyaworks.com untuk meminta akses, pembetulan atau pemadaman maklumat anda, menarik balik persetujuan pemprosesan, atau mengemukakan pertanyaan privasi. Kami mungkin perlu mengesahkan bahawa maklumat itu milik anda. Jika undang-undang mengehadkan sesuatu permintaan, kami akan menerangkan sekatan yang berkenaan. Anda juga boleh meminta salinan mudah alih maklumat anda dan membuat aduan kepada Pesuruhjaya Perlindungan Data Peribadi. Kami akan membalas dalam tempoh yang ditetapkan oleh undang-undang.