Privacy Policy

What we collect, and why

Name and email address: to create your account, sign you in and send the emails the service needs (verification, password reset, reminders you set).

Password: to protect your account. We store only a one-way hash, never the password itself.

If you continue with Google: your Google account ID, name and verified email address, to sign you in. Google tells us only these; we never see your Google password.

Country, time zone and language: to format resumes the way recruiters in your region expect, show local prices and send reminders at the right time.

Resumes, versions, uploaded PDF or Word files, job descriptions, cover letters, interview answers and the applications you track: to provide the features you use with them, and nothing else.

Free ATS check (no account): the file you check is read in memory to score it and then discarded; we don't store it or send it to the AI provider. Your browser keeps a copy on your own device for 24 hours so you can continue after signing up.

Career preferences you choose to give (where you are applying, career stage, target roles): to suggest the right format and tips. You can leave them blank.

Plan and payment records (plan, amount, dates, payment reference): to provide RURU Pro and meet tax law. Card, UPI and bank details go straight to our payment providers; we never see or store them.

Request logs (time, IP address, browser, page): to keep the service secure, stop abuse and fix faults.

We do not collect sensitive details such as religion, caste, health or photos. Don't add them to your resume unless you choose to.

Our legal basis

We process this data to provide the service you signed up for and to keep it secure, which Indian law treats as a use you have asked for, and which the GDPR calls performance of a contract and legitimate interests. We keep payment records because the law requires it. If we ever want to use your data for anything else, such as marketing emails or product analytics, we will ask for your consent first, and you can withdraw it at any time as easily as you gave it.

AI features

When you use an AI feature, the text it needs is sent to our AI provider, Anthropic, which processes it and returns the result. For checks and rewrites we remove your name and contact details first; reading an uploaded resume needs its full text.

Under Anthropic's commercial terms, data sent through its API is not used to train its models, and is deleted within 30 days unless a longer period is needed to enforce its usage policies or by law. AI suggestions can be wrong: always review them. RURU never adds achievements or experience you don't have.

Who helps us run RURU

Hosting: Hostinger (servers in India). DNS and network protection: Cloudflare. Email delivery: Resend. AI: Anthropic (United States). Payments: Razorpay (India) and Stripe. Sign-in (if you choose it): Google. Each receives only what it needs for its part of the service and is bound by contract to protect it.

Some of these providers are outside India. We transfer data only as Indian law allows and, for people in the EU and UK, under the safeguards the GDPR requires (such as standard contractual clauses).

We do not sell your personal data and do not share it for advertising.

Cookies

We use only the cookies RURU needs to work: one keeps you signed in and one protects your forms against forgery. We use no advertising or tracking cookies. If we add product analytics, we will ask first and update this notice.

How long we keep data

Your content stays until you delete it. Archived resumes are deleted after 30 days, uploaded original files after 180 days without use, and exported downloads after 7 days.

If you delete your account, we delete your data within 7 days, and copies in encrypted backups expire within 35 days. Request logs are kept for up to 1 year for security. Payment records are kept for as long as tax law requires (in India, generally 6 to 8 years).

Your rights

In the app you can see and correct your data at any time, download all of it (Account, then Your data) and delete your account and everything in it (Account, then Delete account).

Under India's Digital Personal Data Protection Act 2023 you have the right to information about how your data is processed, to correction, completion, updating and erasure, to withdraw consent, to nominate someone to act for you if you die or cannot act, and to grievance redressal.

People in the EU and UK have similar rights under the GDPR, including the right to object and to data portability. California residents have the right to know, correct and delete their information and not to be discriminated against for using these rights; we do not sell or share personal information.

To use any right, email support@ruru.ac from your account's address. We reply within 30 days, and sooner where the law requires.

Complaints

Contact our grievance officer, Anil Kumar Bathala, at grievance@ruru.ac. We acknowledge every complaint within 24 hours with a reference number you can quote to follow it up, and resolve it within 15 days.

If you are not satisfied, you can complain to the Data Protection Board of India. In the EU or UK you can complain to your data protection authority.

Security

Connections are encrypted (HTTPS). Passwords are hashed, staff access needs two-factor authentication, and backups are encrypted before they leave our server. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.

Children

RURU is only for people aged 18 or over. We do not knowingly collect data from children; if we learn that we have, we delete it.

Changes

If we change this notice in a way that matters, we will tell you by email or in the app before the change applies.