Security & data

What is stored

• Your account: email, name, avatar and account identifier from sign-in. Google sign-in does not give Volition AI your Google password or access to your Gmail or Drive.
• Your explicit Terms agreement, including the version, text presented, and server-recorded date and time. This record does not include an IP address or identity documents.
• Your record: the resume text you imported, the job descriptions you pasted, and the facts, accomplishments, work history, and target roles you approved.
• Eligibility facts you choose to provide — work authorization, citizenship, visa or sponsorship status, security clearance — used only to surface a posting’s eligibility requirements as warnings; they never affect your fit score.
• Generated documents, their validation results, and the application tracker that ties them to each job.
• Product activity, request and usage information, technical and security diagnostics, support messages you send, and billing records for any purchase. Routine monitoring is designed to limit exposure of resume content.

Where it lives

Records are held in a Supabase Postgres database and finished files in a private Supabase storage bucket; the production project is hosted in Canada (ca-central-1). The application servers run on Render in Oregon, United States. Traffic between your browser, the servers, and these providers is encrypted in transit. Volition AI Inc operates the service from the United States for adults aged 18 or older in the United States and Canada. Other providers' processing, support and retention locations depend on their service arrangements, not just our database region. Processing outside your country may be subject to that country's laws.

Who processes your text

Your resume text, job description, approved record and draft wording may be sent to these AI providers under their API terms, including when a fallback is used. Volition AI never trains models on your data. Provider use and retention depend on their policies and settings, including security, abuse-monitoring and legal exceptions. See the AI disclosure and provider policies for details.

• DeepInfra — runs the models that read your resume into facts, score fit, and draft resume, cover-letter and answer wording — the default for every step
• Anthropic (Claude) — drafts wording, and takes over automatically if the primary provider is unavailable
• Google (Gemini) — an alternative model Volition AI can switch to from its console; not used by default, but able to receive the same content if switched

Other providers see only what their job requires: Supabase (sign-in, database, storage), Render (servers), Sentry (error monitoring), Stripe (payments when enabled; full card details are entered with Stripe), and Resend (transactional email when enabled). Authorized personnel may review relevant stored content to support you or investigate a failed generation.

Access controls

• Requests for private account records require a verified sign-in token and ownership checks. Public pages and limited public endpoints do not require sign-in.
• Application tables use row-level security and restricted direct client access as defense in depth. The API remains responsible for checking account ownership.
• Per-account and per-address rate limits, request-size ceilings, and upload bounds limit abuse.

Resume checks flag possible wording, number, date, credential, and employer or project attribution problems. Volition AI may ask the model for one final targeted correction. Remaining concerns are highlighted in the resume preview; they do not, by themselves, prevent download. The PDF and Word files contain the same final text without warning highlights. A successful download does not mean every statement has been verified. Review and correct the document before using it. Security, source-reference integrity, and usable-file checks can still stop a download.

Volition AI is in beta and has not yet completed a third-party security audit or certification.

Retention and erasure

• In-progress applications are discarded after a period of inactivity, shown in the product: the job description, fit result, plan, and any evidence added only for that job. Your saved record is unaffected.
• Your record and finished documents are kept until you delete them.
• Export everything as one ZIP from your account at any time.
• Delete a document without deleting your record.
• Delete your account to remove active account records and files and your sign-in identity. An unfinished refund must first be withdrawn or completed. A later sign-in creates a new account, not a restored profile.

Deletion from the active application is not instant erasure of every copy. A failed file deletion is queued for retry. Backups, diagnostic logs, and copies held by service providers may remain under their retention schedules or legal obligations. Hashed billing references are retained to prevent delayed payment events from recreating deleted records; these are not copies of your resume. Payment providers may separately retain transaction records. Contact us for questions about retention or deletion of your information.

Reporting a problem

Contact Volition AI Inc at [email protected] for privacy questions, access or correction requests, or a complaint. You can also write to 201 Gailardio St, Savoy IL 61874 USA. We may ask for information needed to verify that a request concerns your account. Do not email identity documents or a full resume unless we request them through an appropriate channel.

Please do not access data that is not yours while investigating a security issue.