Privacy Policy

This Privacy Policy explains how IRB (“IRB,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you visit irb.app, create an account, build a resume or cover letter, or otherwise use our website, applications, and related services (collectively, the “Service”). We built IRB to help job seekers create professional, effective resumes and cover letters quickly, and we take the privacy of the personal and career information you entrust to us seriously. Please read this Policy carefully. By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with our practices, please do not use the Service.

This Policy is designed to be read alongside our Terms of Service, which governs your use of the Service more broadly. Where this Policy uses capitalized terms that are not otherwise defined, those terms have the meaning given to them in the Terms of Service.

1. Who We Are and Scope of This Policy

IRB provides an online resume builder, cover letter builder, and related career tools, including AI-assisted content suggestions, resume templates, export tools, and account management features. This Policy applies to information we collect through the Service, through your communications with our support team, and through your interactions with our marketing pages, blog, and any emails or notifications we send you. It does not apply to third-party websites, plug-ins, or services that may be linked from within the Service, even if they are co-branded or accessible through our Service. We encourage you to review the privacy policies of any third-party sites you visit.

If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, references in this Policy to “processing” of personal data have the meaning given under the General Data Protection Regulation (“GDPR”) and the UK GDPR. If you are a California resident, certain additional rights described in Section 11 below apply to you under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”).

2. Information We Collect

We collect information in three main ways: information you provide directly to us, information we collect automatically when you use the Service, and information we receive from third parties. The categories below describe what we collect and, where relevant, why.

2.1 Account and Profile Information

When you create an account, we collect your name, email address, and a securely hashed password (or, if you sign in using a third-party identity provider, an authentication token issued by that provider). We may also ask you for your country, years of professional experience, and how you heard about IRB during onboarding, which helps us tailor the experience and templates we recommend to you. If you choose to participate in our referral program, we generate and store a unique referral code associated with your account and track which new accounts, if any, were created using your code or a code you entered.

2.2 Resume, Cover Letter, and Career Content

The core of our Service involves helping you build resumes and cover letters. In doing so, we collect and store the content you enter or upload, which may include your full name, contact details (such as phone number, email address, mailing address, and links to professional profiles such as LinkedIn), employment history, job titles, employer names, dates of employment, educational history, degrees and institutions attended, certifications, skills, languages, summaries or objective statements, references, and any other information you choose to include on a resume or cover letter. Because resumes commonly include information that could be considered sensitive in some jurisdictions — for example, information from which someone could infer your age, nationality, or other characteristics — we treat this content with particular care, and we describe the safeguards we apply in Section 6. You are solely responsible for deciding what information to include in the documents you create, and we recommend you avoid including sensitive categories of personal data (such as government identification numbers, health information, or financial account numbers) that are not necessary for a resume or cover letter.

If you upload an existing resume, cover letter, profile photo, or other document to import content or as part of a template, we process the file to extract text and, where applicable, images, and we store the file and extracted content in your account so you can continue editing it.

2.3 AI-Assisted Features

IRB offers optional AI-assisted features that can suggest bullet points, rewrite or improve existing text, summarize your experience, or generate cover letter drafts based on information you provide, such as a target job title, job description, or existing resume content. When you use these features, the relevant text you submit (for example, a paragraph you want rewritten, or a job description you paste in) is sent to our AI infrastructure provider to generate a response, which is then returned to you within the editor. We do not use the content of your resumes or cover letters to train foundational AI models operated by third parties, and we contractually require our AI infrastructure providers not to use your content to train their own models. We retain a record of AI feature usage (such as which feature was used and when) for abuse prevention, quality improvement, and billing purposes, as described further in Section 4.

2.4 Billing and Payment Information

If you subscribe to a paid plan, our payment processor (currently Stripe, Inc.) collects your payment card details, billing address, and related billing information directly. We do not store full payment card numbers on our own servers. We receive and store limited billing metadata from our payment processor, such as your subscription plan, billing cycle, invoice history, the last four digits of your payment card, card brand and expiration date, and transaction identifiers, which we use to manage your subscription, provide receipts, and respond to billing inquiries.

2.5 Communications

If you contact our support team, submit a form, respond to a survey, or otherwise communicate with us, we collect the content of your communications, your contact information, and any information you choose to provide. We also send transactional emails (such as password resets, billing receipts, and account notifications) and, if you opt in, marketing emails about new features, templates, and promotions. You can manage your marketing email preferences at any time using the unsubscribe link included in those emails or from your account settings.

2.6 Usage and Device Information

When you use the Service, we and our service providers automatically collect certain technical information, including:

• Log and device data, such as your IP address, browser type and version, operating system, device identifiers, referring and exit pages, and timestamps of your requests.
• Usage data, such as which pages and features you visit or use, how long you spend on the editor, which templates you view or select, error messages, and general interaction patterns that help us understand how the Service is used.
• Approximate location data inferred from your IP address (typically at the city or country level), which we use for purposes such as fraud prevention, localization, and understanding aggregate usage by region.

2.7 Cookies and Similar Technologies

We use cookies, local storage, and similar technologies to operate the Service, remember your preferences (such as your selected language or theme), keep you signed in, understand how the Service is used, and, where you have consented, measure the effectiveness of our marketing. Section 8 below describes the categories of cookies we use and how you can control them.

2.8 Information from Third Parties

If you choose to sign in or sign up using a third-party authentication provider, that provider will share certain profile information with us (such as your name and email address) in accordance with your settings with that provider and its own privacy policy. If someone refers you to IRB using a referral code, we associate your account with that referral for the purposes of our referral program. We may also receive information from fraud-prevention and analytics vendors to help us detect abusive or fraudulent activity.

3. How We Use Your Information

We use the information described above for the following purposes:

• To provide and maintain the Service, including creating and managing your account, saving and syncing your resumes and cover letters across sessions and devices, and enabling you to export, download, print, or share your documents.
• To operate AI-assisted features, including generating suggested content, rewriting text at your request, and improving the relevance and quality of those suggestions over time.
• To process transactions, including billing you for paid subscriptions, issuing receipts and invoices, processing refunds, and preventing fraudulent transactions.
• To communicate with you, including responding to support requests, sending transactional notifications, and, where you have opted in, sending marketing communications about new features, templates, and offers.
• To personalize your experience, including recommending templates, tailoring onboarding content based on your stated experience level and country, and remembering your preferences.
• To maintain the security and integrity of the Service, including detecting and preventing fraud, abuse, unauthorized access, and violations of our Terms of Service, and protecting the rights, property, and safety of IRB, our users, and the public.
• To analyze and improve the Service, including understanding how features are used, diagnosing technical issues, conducting research and analytics, and developing new features and templates.
• To administer our referral program, including tracking referral codes, verifying eligibility, and issuing referral credits.
• To comply with legal obligations, including responding to lawful requests from public authorities, meeting tax and accounting obligations, and enforcing our Terms of Service and other agreements.

Where required by applicable law, we rely on one or more of the following legal bases to process your personal data: performance of a contract with you (for example, to provide the Service you signed up for), our legitimate interests (for example, to secure the Service and improve our products, provided those interests are not overridden by your rights), your consent (for example, for optional marketing communications or certain cookies), and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time as described in Section 11.

4. How We Share Your Information

We do not sell your personal information for money, and we do not share the content of your resumes and cover letters with other users or the public unless you choose to share or publish them yourself (for example, by generating a shareable link or exporting a file and sending it to someone). We do share information in the following circumstances:

4.1 Service Providers

We engage third-party companies and individuals to perform services on our behalf, such as cloud hosting and database infrastructure, payment processing, transactional and marketing email delivery, AI text generation, customer support tooling, analytics, and error monitoring. These service providers are given access to only the information reasonably necessary to perform their functions and are contractually obligated to protect your information and use it solely for the purposes we specify.

4.2 Business Transfers

If IRB is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service of any change in ownership or control of your personal information, as well as any choices you may have.

4.3 Legal Requirements and Protection of Rights

We may disclose your information if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service, including investigation of potential violations; (c) detect, prevent, or otherwise address fraud, security, or technical issues; or (d) protect against harm to the rights, property, or safety of IRB, our users, or the public, as required or permitted by law.

4.4 With Your Consent or Direction

We may share your information with other parties when you direct us to do so, such as when you use a feature to share a document with another person or export data to a third-party service you have connected to your account.

We do not knowingly disclose personal information to third parties for their own independent marketing purposes without your consent.

5. International Data Transfers

We and our service providers may process and store your information in countries other than the one in which you live, including the United States and the United Kingdom, which may have data protection laws that are different from the laws of your country. Where we transfer personal data from the EEA, the UK, or Switzerland to a country that has not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms, to ensure your information continues to receive an adequate level of protection wherever it is processed.

6. How We Protect Your Information

We implement administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit using TLS, encryption of sensitive data at rest, access controls that limit which employees and contractors can access personal data based on their role, Row Level Security policies at the database layer that isolate each account’s data, regular security reviews, and secure password hashing so that we never store your password in plain text. Payment card data is handled by our PCI-DSS compliant payment processor and is never stored on our own servers in unencrypted form.

While we take reasonable steps to protect your information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk. If we become aware of a security incident that affects your personal information, we will notify you and any applicable regulator as required by law.

6.1 Data Breach Notification

In the unlikely event of a data breach that compromises your personal information, we will investigate the incident promptly, take steps to contain and remediate it, and notify you and any applicable supervisory authority without undue delay and in accordance with applicable law, which in the case of the GDPR generally means notifying the relevant supervisory authority within 72 hours of becoming aware of a breach where feasible, and notifying affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Our notification will describe, to the extent known at the time, the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures we have taken or propose to take to address the breach.

7. Data Retention

We retain your account information and the resumes, cover letters, and related content you create for as long as your account remains active, so that you can continue to access, edit, and download your documents. If you delete a specific resume or cover letter, we remove it from your active account and it becomes generally inaccessible to you within the Service, although residual copies may persist for a limited time in encrypted backups before they are purged according to our standard backup rotation schedule.

If you delete your account, we will delete or anonymize your personal information within a commercially reasonable period, except where we are required or permitted to retain certain information for longer, such as: (a) billing and tax records, which we retain for the period required by applicable tax and accounting laws; (b) information needed to resolve disputes, enforce our agreements, or comply with legal obligations; and (c) aggregated or de-identified information that no longer identifies you, which we may retain and use indefinitely for analytics and product improvement.

8. Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies:

• Strictly necessary cookies, which are required for the Service to function, such as cookies that keep you signed in and maintain the security of your session. These cannot be disabled without affecting core functionality.
• Preference cookies, which remember choices you make, such as your preferred language or light/dark theme, so you do not have to re-select them on every visit.
• Analytics cookies, which help us understand how visitors use the Service, such as which pages are viewed and how long users spend in the editor, so we can improve performance and usability.
• Marketing cookies, which, where used and where you have consented, help us measure the effectiveness of our advertising and avoid showing you repetitive ads.

You can control cookies through your browser settings, including blocking or deleting cookies. Most browsers let you refuse cookies, alert you when cookies are being sent, or delete cookies already stored on your device. Please note that blocking strictly necessary cookies may prevent you from using certain parts of the Service, such as staying signed in. Where required by applicable law, we will request your consent before setting non-essential cookies and will provide a mechanism for you to manage your preferences.

9. Children’s Privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at hello@irb.app, and we will take steps to delete such information and, where applicable, terminate the associated account.

10. Your Choices and Controls

You have a number of choices about how we collect, use, and share your information. In addition to the account-level controls described below, we also encourage you to take a few straightforward steps on your own to keep your account secure: choose a strong, unique password that you do not reuse on other websites; keep the email address on your account current so that security notifications reach you; sign out of the Service on shared or public devices; and contact us immediately if you notice any activity on your account that you do not recognize. While we are responsible for securing our systems, account security is a shared responsibility, and these practices meaningfully reduce the risk of unauthorized access to your account.

• Account information. You can review and update your account information at any time from your account settings.
• Resume and cover letter content. You can edit or permanently delete any resume or cover letter you have created at any time from your dashboard.
• Marketing communications.You can opt out of marketing emails at any time by clicking the “unsubscribe” link in any marketing email or by updating your notification preferences in account settings. You will continue to receive transactional and administrative emails necessary to operate your account, such as billing receipts and security notices.
• Cookies. You can manage cookies through your browser settings as described in Section 8.
• Account deletion. You can request deletion of your account and associated personal information at any time by contacting hello@irb.app or using the account deletion option in settings, where available. We will process your request in accordance with Section 7 above.

11. Your Privacy Rights

Depending on where you live, you may have certain legal rights regarding your personal information. We honor these rights for all users, regardless of location, to the extent practicable.

11.1 Rights for EEA, UK, and Swiss Residents

If you are located in the EEA, the UK, or Switzerland, you have the right to:

• Request access to the personal data we hold about you and receive a copy of it.
• Request that we correct or update inaccurate or incomplete personal data.
• Request that we erase your personal data, subject to certain exceptions (for example, where we are required to retain information for legal or accounting purposes).
• Request that we restrict the processing of your personal data in certain circumstances, such as while we verify its accuracy.
• Request a portable copy of the personal data you provided to us, in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.
• Object to our processing of your personal data where we rely on legitimate interests, including for direct marketing purposes.
• Withdraw your consent at any time, where we rely on consent to process your data.
• Lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data infringes applicable law.

11.2 Rights for California Residents

If you are a California resident, the CCPA gives you the right to:

• Know what categories of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.
• Request access to the specific pieces of personal information we hold about you.
• Request deletion of personal information we have collected from you, subject to certain exceptions.
• Request correction of inaccurate personal information we maintain about you.
• Opt out of the “sale” or “sharing” of your personal information, to the extent applicable. As noted above, we do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising except through cookies you have consented to as described in Section 8.
• Not receive discriminatory treatment for exercising any of your CCPA rights.

To exercise any of the rights described in this Section 11, please contact us at hello@irb.app. We may need to verify your identity before fulfilling your request, which may involve confirming information associated with your account. You may also designate an authorized agent to make a request on your behalf, subject to our ability to verify that the agent has been authorized to act on your behalf. We will respond to verifiable requests within the timeframe required by applicable law, which is generally 30 days for GDPR-based requests and 45 days for CCPA-based requests, subject to permitted extensions.

11.3 Other Jurisdictions

If you are located in a jurisdiction with its own data protection framework, such as Canada’s PIPEDA, Brazil’s LGPD, or other applicable regional privacy laws, we will honor requests consistent with the rights afforded to you under those laws. Please contact us using the details in Section 15 to make a request.

12. Third-Party Services Used to Provide IRB

To operate the Service, we rely on a limited number of carefully selected infrastructure and service providers, including cloud database and hosting infrastructure to store your account and document data, a payment processor to handle subscription billing, an AI infrastructure provider to power AI-assisted writing features, and email delivery providers to send transactional and, if you have opted in, marketing emails. Each of these providers is contractually bound to use your information only to provide services to us and in a manner consistent with this Policy, and to implement appropriate security measures to protect your information.

13. Special Notice About Resume and Career Content

Because the primary purpose of IRB is to help you build documents that you intend to share with prospective employers, recruiters, and other third parties, we want to be transparent about how this category of content is handled differently from ordinary account data.

First, we never share, sell, or otherwise disclose the substantive content of your resumes or cover letters to other users of the Service, to employers, to recruiters, or to any third party, except: (a) with service providers strictly as necessary to operate the Service (for example, our hosting provider stores the encrypted content, and our AI infrastructure provider processes text you submit to AI features, as described in Section 2.3); (b) where you affirmatively choose to export, download, print, share a link to, or otherwise transmit your document to a third party; or (c) where required by law, such as in response to a valid legal process. We do not scan your resume content to build advertising profiles, and we do not sell insights derived from your career history to data brokers, staffing agencies, or advertisers.

Second, if you use a “share” or “public link” feature to generate a URL that allows someone to view your resume without signing in, please be aware that anyone with that link can view the document until you revoke or expire the link. You are responsible for managing who you share such links with and for revoking access when it is no longer needed.

Third, template designs, layout choices, and formatting are not personal information and may be used in aggregate, de-identified form (for example, to understand which templates are most popular among users in a given industry) without identifying you individually.

14. Automated Decision-Making and Profiling

We do not use your personal information to make decisions that produce legal effects concerning you or that similarly significantly affect you through solely automated means without human involvement. Our AI-assisted writing features generate suggested text for your review and voluntary use; you always retain full control over whether to accept, edit, or discard any AI-generated suggestion, and no AI feature output is submitted on your behalf to any employer or third party without your explicit action. We may use limited automated processes for fraud detection (for example, flagging unusual sign-up patterns associated with referral abuse), but any resulting account restrictions are reviewed by a member of our team upon request.

15. Data Minimization and Accuracy

We aim to collect only the personal information reasonably necessary to provide and improve the Service, and we encourage you to keep your account information accurate and up to date. You can review and correct your account information at any time from your settings page. If you believe any information we hold about you is inaccurate, please contact us using the details in Section 16 and we will investigate and correct it where appropriate.

16. Summary Table of Processing Activities

To make this Policy easier to navigate, the summary below restates, in condensed form, the main categories of personal information we process, the purposes for each, and typical retention periods. This summary does not replace the fuller descriptions above, which control in the event of any inconsistency.

• Account credentials(name, email, hashed password) — used to create and secure your account and let you sign in — retained for the life of your account plus a limited period after deletion for security and fraud-prevention purposes.
• Onboarding profile details(country, years of experience, referral source) — used to personalize templates and onboarding — retained for the life of your account.
• Resume and cover letter content— used to provide the core editing, saving, and exporting functionality of the Service — retained until you delete the specific document or your account.
• AI feature inputs and usage logs— used to generate suggestions and prevent abuse of AI features — retained for a limited operational period, typically no longer than necessary for quality assurance and abuse prevention.
• Billing metadata(plan, invoice history, card brand and last four digits) — used to manage subscriptions and provide receipts — retained for the period required by applicable tax and accounting law, generally several years after the relevant tax year.
• Support communications— used to resolve your inquiries — retained for a reasonable period after resolution to allow for follow-up and quality review.
• Usage, device, and log data— used for security, analytics, and service improvement — typically retained for a limited rolling window before aggregation or deletion.
• Marketing preferences— used to determine whether to send promotional communications — retained until you opt out or delete your account.

17. Additional Information for International Users

IRB is operated from, and primarily hosts infrastructure in, jurisdictions that may differ from where you are located. Regardless of where our servers or personnel are located, we apply the protections described in this Policy consistently to all users, and where local law grants you stronger rights than described here, those local rights control. If you are accessing the Service from a country with its own data localization or cross-border transfer requirements, and you have concerns about how your information is transferred or stored, please contact us using the details in Section 20 before creating an account, so that we can address your questions.

We do not target the Service specifically at residents of any particular country to the exclusion of others, and the templates, currency displays, and localization features (such as language selection) are provided for convenience and do not change the substantive protections described in this Policy.

18. Do Not Track Signals

Some browsers offer a “Do Not Track” (DNT) signal that lets you indicate your preference regarding tracking across websites. Because there is not yet a common industry standard for how to interpret DNT signals, we do not currently respond to DNT signals, but we continue to monitor developments and will update this Policy if our practices change.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will notify you by email or by posting a prominent notice on the Service prior to the change becoming effective, and we will update the “Effective date” at the top of this page. We encourage you to review this Policy periodically. Your continued use of the Service after any changes to this Policy take effect constitutes your acceptance of the revised Policy.

20. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: hello@irb.app
Subject line: “Privacy Inquiry”

We aim to respond to all privacy-related inquiries within a reasonable timeframe, and no later than required by applicable law.