Privacy Policy

Last updated: 2026-10-08 · Resume ATS Optimizer (atsfitcheck.com), operated by KunStudio.

1. What we collect

Your resume text and the job description that you paste into the tool. A resume usually contains personal information (name, contact details, work history, education).
Payment data: handled by PayPal. We never see or store your card or bank details. We keep the PayPal order number and amount so we can deliver your report and answer support or refund requests.
Analytics (Google Analytics 4): device and browser type, pages visited, approximate region (Google Analytics 4 does not log or store IP addresses), and interaction events, collected with cookies and similar identifiers.
Information you send us, if you email us or submit a feedback form.

2. How your resume text is processed by AI providers

To produce the match report and the rewritten resume, the text you paste is sent over HTTPS to third-party AI providers:

Google Gemini API (Google LLC) — our main provider.
OpenAI API (OpenAI) — used only as a last-resort fallback when Gemini does not return a usable answer.

Important, as of 2026-10-03: we use the Gemini API under Google's paid service terms (Paid Services); before 2026-10-03 we used Google's free tier. Under Google's terms for Paid Services, Google does not use your prompts or responses to improve its products and processes them under its Data Processing Addendum for Products Where Google is a Data Processor. Google logs prompts and responses for a limited period of time, solely to detect and prevent violations of its Prohibited Use Policy and to meet legal or regulatory disclosure requirements, and this data may be stored transiently or cached in any country where Google or its agents maintain facilities, so it can leave your own country (see Gemini API Additional Terms of Service). Even so, please leave out anything you do not need to share: an ATS-optimized resume does not need a home address, date of birth, national ID number or photo, and our analysis works without them.

We do not keep the resume and job description you paste on our servers: they are not written to a database and are used only while your report is being made (the one copy that stays is in your own browser, see below). Request bodies are not logged by our code. The finished report (match analysis and the rewritten resume text) is the one exception: it is stored in our database for 48 hours after it is made, only so that we can hand you the same report again if your connection drops or you press Retry (so you are not charged twice, and not left without what you paid for). After 48 hours the report text is no longer served and is deleted from the database: expired reports are cleared automatically as the site handles requests, and a daily cleanup job on our server removes any that are left. The downloadable PDFs are created inside your browser and are not uploaded to us.

Saved in your own browser. From the moment you approve the payment, your browser (localStorage on your device) keeps your PayPal order number and the resume and job-description text you pasted. This lets the page pick your order up again if the tab closes or the connection drops before your report arrives, without charging you twice. The copy stays on your device; it is sent to us only when the page asks for your report, and it is deleted as soon as the report arrives, or after 48 hours at the latest. You can also remove it at any time by clearing this site's data in your browser.

3. What we do keep

A delivery record per order: PayPal order number, plan, amount, time, whether the report was delivered, which AI model answered, and (if something failed) a short technical error message. It contains no resume text. Kept up to 400 days for support, refunds and accounting.
A report copy for 48 hours, as described in section 2, plus a one-way hash (SHA-256) of the resume you pasted, used only to confirm that a re-delivery request comes from the same resume. The hash stays with the order record; the report text is deleted after 48 hours.
Database backups held by Cloudflare. Our order records are in Cloudflare D1, which keeps point-in-time backups for up to 30 days (Cloudflare D1 Time Travel). A report we delete after 48 hours can therefore still exist in those backups for up to 30 days, after which it is gone.
Standard server logs kept by our hosting provider Cloudflare (IP address, request path, status).
Free-preview rate-limit counters (an IP address with a request count), kept for abuse prevention.

4. Cookies & tracking

We use analytics cookies (Google Analytics 4) to understand usage. They are non-essential, and we do not use advertising cookies. Event-level analytics data is retained for 2 months, the period currently set on our Google Analytics property. You can block cookies in your browser settings.

Cookie choice (EEA, UK and Switzerland). If you visit from the European Economic Area, the United Kingdom or Switzerland, a banner at the bottom of the page asks for your choice. Google Analytics storage stays off (Google Consent Mode “denied”) until you press Accept; Decline keeps it off. Visitors elsewhere are not shown the banner and Google Analytics runs as described above. Your choice is saved in your browser’s local storage (ks_cc) and in the ks_consent cookie (one year), so every page of the site uses the same choice. You can change it at any time with Change cookie choice. If you decline or withdraw, we delete the Google Analytics cookies (_ga and _ga_*) already set in your browser. While Google Analytics storage is off, Google may still receive cookieless pings about page views and events (no analytics cookies are set and no persistent identifier is stored in your browser).

5. How we use data

To generate your report, process your payment, provide support and refunds, prevent abuse, and understand aggregate usage. We do not sell your personal information and do not share it for cross-context behavioral advertising.

6. Third parties

Google (Gemini API) — AI processing. Google Privacy Policy.
OpenAI — AI processing (fallback). OpenAI Privacy Policy.
PayPal — payments. PayPal Privacy Statement.
Google Analytics — usage analytics.
Cloudflare — hosting and security.

7. Your rights

EU/UK (GDPR): you can ask to access, correct, delete or restrict processing of your data and withdraw consent at any time. California (CCPA/CPRA): you can ask to know, delete and correct personal information; we do not sell it and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We apply these protections to all visitors regardless of location. Because we keep your report text for only 48 hours (up to 30 days in Cloudflare backups) and never store the original resume on our servers, the main data we can look up or delete is the order record described above (and a report that is still inside its 48 hours); the copy in your browser is yours to clear; for text already sent to an AI provider, deletion requests follow that provider's process.

Result copy email (after purchase)

After you pay, we email you one copy of your results and your order details (payment confirmation, PayPal order number and the full text of your rewritten resume). The recipient is the address you type in the optional email field next to the PayPal buttons or, if you leave it empty, the email address of your PayPal account as returned to us by PayPal. We use the address only to send this message and do not keep it in our order records. To enforce a daily limit and avoid duplicate sends we keep, for 90 days, a marker that a copy was sent for the order (it holds a shortened one-way hash of the address, not the address) and, for 2 days, a list of order numbers per address hash. The message is sent through our Gmail account (Google), so a copy stays in that mailbox's sent folder until we delete it; email us to have it deleted. Because the copy contains your resume text, it is sensitive: it is not stored on our servers beyond the 48-hour result copy described above, but the sent email remains in the mailbox noted here until deleted. If a copy cannot be delivered (for example during a Gmail outage, or when one address has already received copies of several other orders today), the address and the composed message are kept for up to 7 days so we can resend it by hand, then deleted automatically; nothing is resent automatically. Because this message contains your resume text, in that rare case the resume text is held too.

Feedback, referral and share buttons

Feedback button. If you use it, the message you write, the optional email address you type, the feedback type, the page you were on, the first 160 characters of your browser’s identification text (User-Agent) and your country are sent to KunStudio’s own feedback endpoint (sajuapp.app, run by us). They are saved in a file in a GitHub Gist controlled by us (GitHub, Inc., United States) that keeps the most recent 500 entries with no other time limit, and the message, page and email are forwarded to the operator in a Telegram message. Do not put anything confidential in the message. To have an entry deleted, email us.

8. Contact

For any privacy request or question: [email protected] (KunStudio). We respond within a reasonable timeframe.

← Back to Resume ATS Optimizer

Operator alerts and international transfers (added 2026-10-07)

Operator alerts. When a paid order succeeds, fails or needs attention (for example a failed delivery, a payment check flag or a failed result email), our server sends the operator a Telegram message (Telegram) with the PayPal order ID, the product code, the amount and a short reason. It contains no photo and no text you typed. Telegram processes it on servers in various countries.

Korea (PIPA Articles 26 and 28-8). The providers named in this policy (our image provider, PayPal, Google, Telegram and Cloudflare) process data on our behalf outside Korea, mainly in the United States, over the internet at the moment you use the feature that needs them (upload, preview, payment, generation, email). The items sent, the purpose and the retention are the ones described in this policy; you may refuse by not using that feature, but the service cannot be provided without it. Privacy officer (개인정보 보호책임자): Hong Deokhun (홍덕훈), 070-8018-7832, [email protected]. You may ask to view, correct, delete or suspend processing of your personal information, or withdraw consent, at any time.

KunStudio (쿤스튜디오) · Representative: Hong Deokhun (홍덕훈) · Business Registration No. 552-59-00848 · Mail-order business report No. 제2026-경북경주-0237호 (경주시장, reported 2026-05-20) · 25-52, Jenaemosan-gil, Oedong-eup, Gyeongju-si, Gyeongsangbuk-do, Republic of Korea · Tel 070-8018-7832 · [email protected]