Privacy Policy

Version 1.4 · Last updated: 22.10.2026
Effective date: 13.02.2026

Reframe is currently in a pilot phase. This policy already reflects pilot operations; if data practices change when the pilot ends, we will update this policy and its "last updated" date.

This Privacy Policy explains how Reframe (the "Service") processes personal data when you use it, in accordance with the GDPR and applicable EU/EEA laws.

1. Data controller

Controller: NG Software ApS, a Danish private limited company (anpartsselskab), CVR 46862791, registered address Angusvej 12, 5400 Bogense, Denmark.

Contact for privacy requests: ngtechnologyaps@gmail.com

2. Personal data we process

2.1 Account and authentication data (while your account is active)

  • User ID
  • Email address
  • OAuth identifiers (e.g., Google ID, LinkedIn ID) if you use OAuth
  • Password hash (if email/password login is enabled)
  • Email verification and password reset tokens and their expiry timestamps (if applicable)
  • Account role and status
  • Timestamps (created/updated/last login)

2.2 User Content (while you use the Service)

  • Resume/CV content you upload or enter (DOCX/PDF and/or structured representation)
  • Job descriptions, vacancy links, and notes you provide
  • An image of your handwritten signature, if you choose to add one to your cover letters
  • Generated outputs (tailored resumes, drafts, scoring results) if you choose to save them in the Service

2.3 Technical and security data

  • Session identifiers (cookie-based sessions)
  • Basic request/security logs necessary for operation, troubleshooting, and abuse prevention (which may include IP address, timestamps, and device/browser information)

2.4 Support and feedback data (when you contact us)

  • Your message and any replies in the conversation
  • Your contact email (unless you submit anonymously)
  • Optional attachments you provide (screenshots or files, which may themselves contain resume content)
  • Diagnostic context attached to the request (e.g., plan, browser information, and identifiers of the resume or vacancy the request relates to)
  • An optional satisfaction rating after your request is resolved

Contact form. If you write to us through the form on our Contact page, we receive your name, e-mail address and message. The form sends them by e-mail to our support mailbox; the Service does not store them. We use them only to answer you and to handle any follow-up, and we delete the correspondence from the mailbox no later than 24 months after the last message. To limit abuse, the address of the connection you write from is used as a counter key for up to one hour and is not stored with your message.

2.5 Other people named in your documents

A CV or a cover letter often names other people — a former manager, a referee, a colleague, or the person a letter is addressed to. When you upload or write such a document, those names are stored as part of it, and they are sent to our AI providers together with the rest of the text when you ask us to tailor or draft something.

We do not build any record of those people. Their names are never indexed, never searched, never combined across accounts, and never shared with an employer, a recruiter or a job board. They exist only inside your own document, and they are deleted when you delete it or close your account.

We do not write to these people to tell them that their name appears here. We hold no contact details for them; finding some would mean collecting more of their data than we hold today, and it would reveal that you are looking for work — which is yours to disclose, not ours. If you are someone named in another person's document and you want to know more, object, or ask for erasure, contact us at the address in section 1.

3. Cookies

At this stage we use only essential (strictly necessary) first-party cookies:

  • Session cookie (nuxt-session-site) — authenticates your session and secures the Service while you are signed in.
  • Sign-in status indicator (rf-auth-hint) — a functional cookie containing only a yes/no flag (no identifier and no tracking) that lets our statically cached pages display the correct signed-in navigation without delay. It is set only after you sign in, kept for up to 30 days, and removed when you sign out.
  • Sign-in security cookies (nuxt-auth-state, oauth_redirect) — set only while you sign in with Google or LinkedIn. The first holds a random one-time value that protects the sign-in against forged requests; the second holds the page of the Service to return you to afterwards. Neither contains an identifier. They expire after 10 minutes and are removed when the sign-in completes.
  • Anonymous preview limit (ak_anon) — set only if you use the anonymous resume preview (Section 6), when you confirm it. It holds a random token that counts previews against the daily limit, limits how many preview progress connections can be open at once and, in hashed form, routes the progress of your own preview to your browser; nothing else. It expires after 24 hours.
  • Invitation link (ak_join) — set only if you open an invitation link. It holds that link's code, so the invitation still applies if you register later, and nothing about you. It is removed once the invitation is applied, declined or found to be invalid, and expires after 7 days otherwise.

We do not use analytics or advertising cookies currently.

To understand product usage we use self-hosted, cookieless analytics (Umami) that we operate on our own infrastructure. It sets no cookies, stores nothing in your browser, and receives no account identifiers and none of your content — only anonymous page visits and named product steps (e.g., "a resume was exported"), together with the coarse technical context every web request carries (browser language, screen size, approximate country). Page addresses may include non-guessable internal record ids; page titles and referring sites are not collected. No third-party analytics service receives this data.

Separately from that anonymous stream, we keep a count of how our own resume design templates are used. Each time one of them is actually applied to a resume, we record a single entry against your account holding only your account identifier, which template it was, where it was applied from, and when. It contains none of your resume content and no free text. We use it so that we can order the design gallery by genuine popularity instead of our own preference (legitimate interests, GDPR Art. 6(1)(f)). The entry is included in the copy of your data you can export, and it is deleted together with your account.

Separately again, if you register a new account we record which of our own marketing channels and posts brought you to it: the utm_source, utm_medium, utm_campaign and utm_content values from the page you were on when you signed up — the campaign link you actually arrived through. We read these from that page's own address in your browser at the moment of registration; nothing is set or read on your device for this, no cookie and no local storage, and only a signup completed in that same visit is recorded this way. We use them so we can measure which of our own channels and posts actually produce accounts (legitimate interests, GDPR Art. 6(1)(f)). These four fields are included in the copy of your data you can export, and they are deleted together with your account.

We also record the date you first engage with your career profile yourself: the first time you open its page, save a record on it, or add or push a record to it from the resume editor. It is a single date, stored with your career profile and set only once. It holds none of your resume content, no free text and no record of later visits, and it is never set when we assemble the profile automatically from resumes you upload. We use it to count how many people actually use the career profile, overall and within each group we invite through our invitation links, which the anonymous analytics above cannot do because they carry no account identifier (legitimate interests, GDPR Art. 6(1)(f)). The date is included in the copy of your data you can export. It is deleted together with your career profile: when you delete your account, and also, unlike the design-usage record, when you withdraw your consent for resume content. If you later create a new career profile, it starts without one.

4. Why we process data (purposes) and legal bases

We process personal data for:

  • Providing the Service (account access, storing and displaying your data, generating and exporting documents)
    Legal basis: performance of a contract (GDPR Art. 6(1)(b)); and, for the special categories of personal data a resume can reveal, your explicit consent (GDPR Art. 9(2)(a)), which we ask for separately — either when you choose to keep a preview you made before registering (section 6.4), or after you sign in — before processing your resume content
  • Security, abuse prevention, troubleshooting, enforcing limits (including measuring how long AI operations take, to show realistic waiting times)
    Legal basis: legitimate interests (GDPR Art. 6(1)(f))
  • Service communications (verification emails, password resets, important account notices)
    Legal basis: performance of a contract (Art. 6(1)(b)) and/or legitimate interests (Art. 6(1)(f))
  • Support and feedback handling (responding to your requests, improving the Service based on feedback)
    Legal basis: performance of a contract (Art. 6(1)(b)) and/or legitimate interests (Art. 6(1)(f))
  • Legal compliance (if applicable)
    Legal basis: legal obligation (GDPR Art. 6(1)(c))

Your career profile is a single, consolidated copy of the building blocks your resumes are made of — work history, education, skills and languages. It is assembled automatically from every resume you add, and it belongs to your account rather than to any one resume: that is what lets an edit you make in one place reach every resume that uses it. Because it is not tied to a single resume, deleting one resume does not remove what that resume contributed to it — those entries stay in your career profile, where you can see and edit them, until you delete your account or withdraw the consent below, either of which deletes the profile in full.

You can withdraw the explicit consent for resume processing at any time in Settings. Because we have no other legal basis for processing the special categories a resume can contain, withdrawing it deletes, with no grace period and no way to undo it, your resumes, the tailored versions of your resume for each vacancy, cover letters, saved job/vacancy data, your career profile, every photo in your photo library and your saved signature, together with any files you attached to support requests. Your account, billing history and support conversations are not affected, and you can give consent again at any time.

5. AI/LLM processing (OpenAI, Google Gemini, Anthropic)

Some features send relevant parts of your input (e.g., resume/job description text) to third-party AI/LLM providers to produce outputs. We send only what is necessary to process your request.

Providers currently used: OpenAI and Google Gemini.

Anthropic (Claude) — added, not yet in use. We have added Anthropic PBC (USA) as a further AI/LLM provider. We will not send it any of your data until we switch it on. You will be asked to accept this updated policy in the app: if you already had an account before this change, your data is sent to Anthropic no earlier than 7 days after you accept it; for accounts created under this policy it applies from sign-up. Your data never goes to Anthropic before you have accepted this policy, and the anonymous resume preview (section 6) never uses it. Once it is on, any of the features above may be processed by an Anthropic Claude model instead of OpenAI or Google Gemini, and it then receives the same content they would. Anthropic, a US company, may process that data outside the EU/EEA, including in the United States, under the Standard Contractual Clauses (with the UK and Swiss equivalents) incorporated in its data processing agreement, and keeps the inputs and outputs for up to 30 days, or up to 2 years if its automated safety systems flag a request as violating its usage policy.

No BYOK: you do not provide your own API keys at this stage; provider access is managed server-side.

Your input and the outputs we generate are not used to train AI models or build datasets without a separate, explicit opt-in.

Provenance marking. To support EU AI Act transparency obligations, PDF files you export include document-properties metadata noting AI assistance, and text you copy carries an equivalent marker in its rich-text (HTML) clipboard format where technically feasible. This marking identifies the document's provenance; it does not add any personal data beyond what the document already contains.

6. Anonymous resume preview (before you register)

Before you create an account, Reframe offers an optional homepage feature that lets you upload a resume/CV (DOCX or PDF) and instantly preview it in our resume designs. Because this happens before you have an account, we describe it separately here.

6.1 Purpose and legal basis

The sole purpose is to parse the document you upload into structured fields and render a live design preview, so you can decide whether to register and save it. A resume can reveal special categories of personal data (for example, a photo may indicate ethnic origin, or the text may mention health or trade-union membership), so we rely on your explicit consent (GDPR Art. 9(2)(a)) as the legal basis for this preview.

Consent is obtained before anything is done with your file. When you choose a file, a confirmation window opens with a consent checkbox and a short notice that explains the purpose, the near-zero server retention, and that the content is sent to an AI/LLM processor. Until you tick the checkbox and confirm ("Generate preview"), your file is not uploaded and its contents are not read — neither on our servers nor in your browser, which at that point checks only the file's name, type and size. If you cancel or close the window instead, the file is discarded and nothing about it is sent to us. If you later register, this pre-registration consent is carried forward into your account as its own consent-log entry, separate from your acceptance of this privacy policy, so you retain a record of the consent you gave before registering. It covers the preview only and is never treated as consent to keep your resume in an account (see section 6.4).

6.2 What we retain — and do not

  • Server retention is near zero. The uploaded file and the text extracted from it are used only to produce the preview and are discarded immediately after parsing. We do not store the file, the extracted text, or the parsed result on our servers before you register.
  • The preview lives in your own browser. The parsed result is held only in your browser's local storage, under your control, so you can keep previewing or return later without re-uploading. It expires after a limited period (currently 7 days): after that it can no longer be used, and it is removed from your browser the next time you open our home page or sign in. It is also cleared as soon as you register and save it, or if you discard it.
  • Abuse prevention only. To limit automated abuse of this free feature, we keep short-lived pseudonymous counters keyed by a one-way hash of your IP address (never the raw IP, and never a copy of your resume): the count of previews is kept only for the daily rate-limit window, and the count of preview progress connections for at most one minute.
  • One timing record. If the preview reaches its AI step, we record how long the request took and whether it succeeded (see section 9, "AI operation timings"; legal basis in section 4) — no file content, no extracted text and no identifier — and delete it after 90 days.

6.3 AI/LLM sub-processor and no training reuse

To parse the document, the relevant text is sent to one of the AI/LLM sub-processors listed in section 5 — currently OpenAI — which processes it solely to return the structured result. We send only what is necessary. Your uploaded content is never used to train AI models or build datasets without a separate, explicit opt-in — consent to this preview is not bundled with any such reuse.

6.4 Keeping your preview: a separate, optional consent

When you choose to save your preview or download it as a PDF, we ask — in a separate window, with its own unticked checkbox — for your explicit consent (GDPR Art. 9(2)(a)) to store, tailor and export your resume content in an account. Your preview never depends on this consent; saving or downloading does, because storing your resume is what that step is for. If you cancel, nothing is recorded — a tick you gave earlier is withdrawn — and you return to your preview without saving it.

If you tick it, the tick and the time you gave it are held only in your browser, alongside your preview, until you register; they are not sent to us before then. We only record an anonymous, name-only count that this step was completed, as part of the product analytics described in section 3. The tick expires with your preview: after 7 days it can no longer be used, and it is removed from your browser the next time you open our home page or sign in.

When you sign in, your browser sends the tick to us and it is recorded in your account as your resume-content consent, with the time you gave it; we then do not ask for it again at sign-up, and if the sign-in window still asks you for anything else, such as accepting our terms, it shows this consent as already given. It is not carried over if your account already has a resume-content consent history — for example, if you gave or withdrew that consent before. Once recorded, it stays recorded until you withdraw it. If you sign out from the sign-in window right after it was carried over, instead of accepting our terms, we withdraw it for you — unless your account already holds resumes. Otherwise, you can withdraw it at any time in Settings, exactly like a consent given after sign-in; withdrawing deletes your resume data.

7. Sharing data with processors (service providers)

We use third-party providers to operate the Service:

  • AI/LLM providers: OpenAI, Google Gemini and, once switched on, Anthropic (Claude) — they receive the resume and job-description text needed to produce the output you asked for (see section 5)
  • Payments: Stripe and Link. If and when you buy a paid plan or pass, it is sold by Sold through Link, LLC ("Link"), a Stripe company, as merchant of record, and Stripe processes the payment. Link and Stripe receive what you enter at checkout (your name, e-mail address, billing address and country, and payment details), the purchase itself (plan or pass, price, currency, dates) and, from us, your account e-mail address and an internal account reference so that the purchase reaches your account. For selling the purchase, taking the payment, taxes, receipts, fraud prevention and payment support they decide how they use these data and act as separate controllers under their own privacy notices: Link and Stripe. We receive the status of your purchase, the amounts, the billing country and the references we need for our records; we never receive or store your full card details (see section 9)
  • Email delivery: Resend — delivers account and support emails
  • Analytics infrastructure: our usage analytics run on a server we operate ourselves in Finland (EU). No third-party analytics vendor receives your data (see section 3)
  • Cloud infrastructure: hosting, database, file storage and caching providers in the EU and the United States, which store and serve the data described in section 2 on our behalf

We share personal data only as needed to provide the Service, and each provider is bound by a data processing agreement that allows it to process the data only on our instructions. A current list naming the specific providers we use is available on request — contact us using the details in section 1.

8. International data transfers

Some providers may process data outside the EU/EEA. Where required, we rely on lawful transfer mechanisms (e.g., adequacy decisions and/or Standard Contractual Clauses) and additional safeguards as appropriate.

Anthropic, a US company, once switched on (see section 5), may process data outside the EU/EEA, including in the United States, under the Standard Contractual Clauses, with the UK and Swiss equivalents, incorporated in its data processing agreement.

Link and Stripe, which handle purchases (section 7), are part of a group based in the United States and may process purchase data there, as described in their privacy notices.

9. Data retention

We keep personal data only as long as necessary for the purposes described above.

  • Active account: we keep your account data and saved content while your account is active.
  • Deleted account (content & identifiers): when you delete your account, it closes immediately — you cannot sign back in from that moment. We email you a link to cancel the deletion; if that email does not reach you, contact us using the details in section 1 before the deadline below. If you do not cancel, your account and its data are permanently erased 14 days later. At that point:
  • Deleted account — data we delete: your résumés, cover letters, saved job/vacancy data, tailored generations and scores, profile, your photo library, your saved signature, your subscription record and Stripe customer link (not your invoices or purchase receipts — see below), wallet and usage history, plan/entitlement assignments, in-app notifications, and the rest of your account content.
  • Deleted account — data we keep, with the link to your account removed: if you made a purchase, the invoice and purchase record is kept for at least 5 years, because Danish bookkeeping law (bogføringsloven) requires 5-year retention of financial records (GDPR Art. 17(3)(b)) — the link to your account is removed from our own records, though the row still carries Stripe's payment reference, and our payment processor (Stripe) keeps its own copy of the transaction as the law requires it to. Billing-related audit-trail entries referencing you (for example, a refund) are handled the same way: the reference to you is removed from our records, and the entry is kept for our own accountability (GDPR Art. 6(1)(f)).
  • Deleted account — data we keep, anonymized: the message text of support tickets and the diagnostic details of error reports are kept as product-quality signal, no longer linked to your identity. Everything more personal tied to them is deleted outright, not just anonymized: your contact email, any note attached to the report, the technical context captured when it was submitted, your feedback rating comment, and any file attachments.
  • Deleted account (anti-abuse suppression): for security and abuse prevention, we retain a pseudonymous record derived from your email (a one-way hash, never the address itself), plus minimal metadata such as when it was created, when it expires, and the reason (GDPR Art. 6(1)(f), legitimate interests). When the record was created because you deleted your account, it is kept for 30 days; other reasons (for example, suspected abuse or a payment chargeback) are kept longer, up to 180 days. Either way it is automatically deleted once it expires.
  • Security logs: retained for a limited period (90 days) and only as needed for security and troubleshooting.
  • AI operation timings: when an AI operation runs (parsing a resume, tailoring it, writing a cover letter, and the anonymous preview in section 6), we record when it ran, how long it took, whether it succeeded, which operation it was and a fingerprint of the AI configuration used — no content and no account identifier. We use these records to show realistic waiting times and to monitor the Service's speed, and delete them after 90 days.
  • Usage history: a record of each AI operation and document export your account runs (which operation, when, which document it concerned where recorded, and for AI operations the model and configuration used, the tokens consumed and the cost), which we use to enforce your plan's usage limits and for cost and usage statistics. It is deleted after 365 days, or earlier if your account is erased.
  • Support and feedback requests: attachments are deleted 30 days after a request is closed; the conversation and your contact details are deleted or anonymized 180 days after a request is closed, and in any case no later than 24 months after the last activity on the request. Anonymous statistics (e.g., request volume and satisfaction ratings, with no personal data) may be retained thereafter.
  • Backups: may persist for a limited period (up to 30 days) before being overwritten.
  • Analytics events: anonymous, name-only usage events (see Section 3) contain no account identifiers or content and are retained while we operate the product's analytics, reviewed periodically.
  • Career profile: the consolidated copy of your work history, education, skills and languages (see section 4) is kept for the life of your account and is deleted together with it. It belongs to your account, not to any one resume, so deleting a single resume does not remove what that resume contributed to it. Withdrawing your consent for resume content deletes it in full, with no grace period. This includes the date you first engaged with your career profile (see Section 3), which has no separate expiry.
  • Photos: the photos you add are kept in your photo library, at most 20 uploaded photos, until you delete them there — even when you remove a photo from a resume or cover letter, or delete the document that showed it. Deleting your account or withdrawing your consent for resume content deletes all of them. A photo file that no document and no library entry refers to any more is removed by a nightly cleanup.
  • Signature: if you add a handwritten signature for your cover letters, we keep one image of it until you delete it in the letter editor. Deleting your account or withdrawing your consent for resume content deletes it. It is used only in your own letters and is never sent to our AI provider.
  • Design usage: the record of which resume design template you applied and when (see Section 3) is kept for the life of your account and is deleted together with it. It has no separate expiry, and it is retained if you withdraw consent for resume content, because it holds none.

10. Security

We apply reasonable technical and organizational measures (access controls, encryption in transit, secure session cookies, restricted access to secrets). No system can guarantee absolute security.

11. Your GDPR rights

You have the right to:

  • access your data
  • correct inaccurate data
  • request deletion (subject to lawful retention for security/abuse prevention)
  • restrict or object to certain processing (including processing based on legitimate interests)
  • data portability (where applicable)
  • withdraw consent (where processing is based on consent)

Self-service export. You can download a copy of most of your account data yourself, at any time, without contacting us: while signed in, request /api/profile/export and your browser downloads it as a JSON file (up to 5 times per hour). It covers your résumés, cover letters, saved job/vacancy data, tailored generations, subscription status, usage history, support tickets, and the rest of the account content this policy describes as deleted in section 9 above. Files you attached to a support ticket are listed in it with their name, type, size and a link that downloads that file while you are signed in — the file itself is not embedded in the JSON, so follow those links while your session is still active if you want to keep the files. Your photos and your saved signature are listed with their size and the address of the image file; the images themselves are not embedded in the JSON either.

Take your export before you request deletion. Requesting deletion closes your account straight away; the grace period delays the erasure, it does not keep you signed in. The export needs a signed-in session, so from the moment you request deletion it is unavailable until you cancel the deletion using the link we email you.

It does not include your credentials (password hash, verification/reset tokens) or your Google/LinkedIn account-linking identifiers (see section 2.1). If you have made a purchase, invoices and purchase receipts are not included in this file — email us and we will send them. A small number of operator-only fields (for example, who on our side resolved a support ticket) are left out too. Some rows we could not read are flagged by ID inside the file itself, but that check does not cover every table in the export, so treat a clean file as a good sign, not a guarantee — contact us if you believe something is missing.

To exercise your other rights, email ngtechnologyaps@gmail.com with subject "GDPR Request". We may ask for verification to protect your data.

You also have the right to lodge a complaint with a supervisory authority. In Denmark, the authority is the Danish Data Protection Agency (Datatilsynet).

12. Children

The Service is not intended for individuals under 16 (or the applicable digital consent age in your jurisdiction). We do not knowingly collect data from children.

13. Changes to this Policy

We may update this Policy as the Service evolves (e.g., if analytics are added). The updated version will be published with a new "Last updated" date.

We show you material changes in the app when you next sign in. A new recipient receives your data only after you have accepted the updated policy and, if you already had an account, after a notice period has passed. The dated list below says what changed.

What changed

  • 22.10.2026 (version 1.4): If and when you buy a paid plan or pass, it is sold by Link, a Stripe company, as merchant of record, with Stripe processing the payment; we describe what they receive and that they act as separate controllers for the purchase (sections 7 and 8). The new contact form on our Contact page is described in section 2.4. On the date of this change paid plans were not yet on sale; nothing else about how your data is processed has changed.
  • 22.10.2026: The controller is now NG Software ApS, CVR 46862791, Angusvej 12, 5400 Bogense, Denmark (section 1); until then the Service was run by its founder as an individual. Nothing else about how your data is processed has changed: the same purposes, recipients, transfers and retention.
  • 19.10.2026: Anthropic (Claude), a US company, added as an AI/LLM provider — processing may take place outside the EU/EEA, including in the United States, under Standard Contractual Clauses, inputs and outputs kept for up to 30 days, or up to 2 years if its automated safety systems flag a request as violating its usage policy (sections 5, 6.3, 7 and 8). It is not in use yet. Once it is, your data is sent to it only after you have accepted this policy in the app — and, if you already had an account, no earlier than 7 days after you accept it.