Your career data, explained plainly.

What I Collect

Account Stuff

• Email & password (so you can log in)
• Name (for receipts)

Anonymous Free Tools

• Browser-only writing tools do not send the text you enter to Vivid.
• Resume Score and Basic Job Match send your resume and job description to Vivid for one-time processing. Those document contents are handled in memory and are not saved to an account by the anonymous tools.
• Your IP address, or a one-way derived key, may be retained for up to one hour to enforce free-tool rate limits. Normal infrastructure security logs may also contain request metadata, but not the uploaded document contents.

Your Resume Data

• Master resume you upload
• Job descriptions you paste
• Generated resumes & cover letters
• Applications you track (if you use that feature)

Payment Info

• Processed by Stripe (I never see your full card number)
• Transaction history

Usage Data

• What features you use
• When you use them
• Browser and device info
• Errors that happen

What I DON'T Collect

• Your browsing history
• Social media activity
• Anything not related to Vivid

What I Do With Your Data

Primary Use: Generate Resumes

Obviously - that's why you're here.

Secondary Uses:

What I DON'T Do

• I never sell your data. Ever. To anyone.
• I don't share your resume content with third parties
• I don't spam you
• I don't use your data for anything sketchy

Who Sees Your Data

Just Me & My Tools

Me - Gabriel, co-founder (when providing support or fixing bugs)

Tools I use:

All these companies are required to protect your data and can't use it for their own purposes.

When Required by Law

If I get a subpoena or court order, I might have to share data. I'll notify you if legally allowed.

If I Sell Vivid

If someone acquires Vivid, your data transfers to them. You'd get 30 days notice and could delete your account first.

How I Protect Your Data

Encryption:

• HTTPS for all connections (that lock icon in your browser)
• AES-256 encryption for stored data
• Even if someone stole the database, they couldn't read it

Access control:

• Only I can access your data (for support/debugging)
• Two-factor auth on my admin accounts
• Backend infrastructure and private file storage use Cloudflare

Your password:

• Encrypted with bcrypt (I can't see it)
• If you forget it, I send a reset link (never email the password)

What I can't protect:

• Your weak password
• You sharing your login
• Malware on your device
• Phishing emails pretending to be me

Your job: Use a strong password. Don't click suspicious links.

Your Rights

Access Your Data

Email gabriel@imvivid.com or privacy@imvivid.com

I'll send you everything:

• All your resumes
• Account info
• Payment history

Timeline: Within 7 days (usually 48 hours)

Delete Your Data

Account settings → Delete Account

Or email privacy@imvivid.com

What gets deleted:

• Your account
• All resumes and applications
• Personal information

What stays (required by law):

• Transaction records (7 years for taxes)
• Anonymized analytics (can't be traced to you)

Timeline: Deleted within 30 days

Fix Your Data

Just log in and edit. Or email me.

Stop Marketing Emails

Click "unsubscribe" in any email.

You'll still get receipts and critical updates.

How Long I Keep Data

• Active accounts: As long as you keep your account
• Deleted accounts: Data deleted within 30 days (backups within 90 days)
• Transaction records: 7 years (required by law for taxes)
• Identifiable product analytics: Up to 13 months, then deleted or irreversibly aggregated

Cookies & Tracking

Essential cookies (required for site to work):

• Keep you logged in
• Session management
• Security

Independently of optional browser analytics, Vivid records a minimal set of server-side account, payment, and resume-generation lifecycle events needed for service reliability, fraud prevention, accounting, and product operations. These records are not sent to Google or used for advertising, and direct or pseudonymous identifiers are removed after 13 months.

Analytics cookies (optional):

• First-party product analytics and Google Analytics 4 help measure how consented visitors use Vivid
• They remain off unless you accept analytics and can be disabled later through the Privacy preferences control

I don't use:

• Advertising cookies
• Advertising or retargeting pixels
• Retargeting
• Creepy surveillance stuff

Your choice: Accept or reject analytics in the consent prompt. Rejecting analytics does not affect the product. GA4 receives only restricted event properties, uses no advertising storage or personalization, and retains event-level data for Google’s nearest supported bounded period. Vivid may use aggregated audience segments for product analysis only—not for advertising or retargeting.

International Users

Vivid is US-based. Our service providers may process or store data in regions outside your country.

If you're outside the US:

• You consent to data transfer to the US
• I comply with GDPR (EU) and CCPA (California)

GDPR (EU Users)

You have rights:

• Access your data
• Delete your data
• Export your data
• Correct your data

Email privacy@imvivid.com

Legal basis: You need the service (contract) + you consented to this policy

CCPA (California Users)

You have rights:

• Know what I collect
• Delete your data
• I don't sell your data

Email privacy@imvivid.com

Children

Vivid is not for anyone under 18.

If I learn someone under 18 made an account, I'll delete it immediately.

Parents: Email gabriel@imvivid.com if your kid made an account.

Changes to This Policy

I might update this as I learn and grow. I'll email you 30 days before changes.

Don't like changes? Delete your account before they take effect.

Contact

Response time: 48 hours max, usually faster