Privacy Policy

Last updated: 7 September 2026

This policy explains what RexxuLabs collects when you use the site, why, and who else sees it. It describes what the service actually does today.

Resume reviewer, AI keys and optional public sharing

The Hiring Agent Resume Reviewer requires sign-in. You supply your own Google Gemini, OpenAI or Anthropic Claude API key, stored separately for each provider. With your explicit choice we encrypt and save that key in your account for future use; otherwise it is encrypted temporarily for the submitted job. Keys are never returned in full by the service. You can replace or remove a saved key from the tool.

For this tool we send the PDF you authorize and optional public GitHub repository metadata only to your selected provider (Google Gemini, OpenAI or Anthropic Claude), with no automatic fallback. That provider's terms, data practices, API charges and quotas apply. GitHub receives a lookup for the optional public username. Do not upload another person's resume without permission.

Uploads are private by default and removed from active storage after processing. With a separate explicit opt-in, your display name, role, experience level, model and score appear on a public leaderboard. An additional opt-in makes the complete resume PDF publicly downloadable, including contact details in the document. Public entries and shared PDF access expire with the report after seven days. You can withdraw sharing or delete the report to disable downloads earlier. Copies already downloaded by others cannot be recalled. Storage cleanup may take longer than access expiry. Unprocessed uploads have a one-day storage expiry. Reports are available for seven days, then expire; physical expiry cleanup may take longer. You can delete a report earlier. Deletion cannot recall a request already sent to your chosen AI provider. Encrypted database recovery backups may retain earlier records for up to 35 days.

Reports provide illustrative feedback, not hiring decisions. Resume contents, detailed reports and API keys are not intentionally sent to analytics or advertising services. We use AWS hosting, private storage and managed key encryption to operate this feature.

Who runs this site

RexxuLabs is operated by @rexxu.ai. You can reach us through the contact page.

What we collect

We collect only what the features need:

• Account details — if you create an account: your email address, your name, and a bcrypt hash of your password. We never store your password itself. If you sign in with Google, we receive your email, name and profile picture from Google instead.
• Usage records — which tools you used and when, your credit balance and credit history, so the account works and you can see your own history.
• Billing — checkout uses Dodo Payments. We send your account name and email to create a billing customer and retain order, payment and subscription references to deliver credits and support purchases. Dodo handles card and billing details; RexxuLabs does not store card numbers. Test purchases use a separate test credit balance.
• Things you upload — images you upload to tools such as the collage maker are stored in our Amazon S3 storage.
• Your IP address — if you use the free tier without signing in, we store your IP address against a usage counter. That is the only way to enforce the free limit without an account.
• Messages you send us — the name, email and message you submit through the contact form.
• Guide discussions — if you post a question, comment, reply or highlight, we store the post, the guide section you selected, your account email and your public profile details. Your email stays private; the name, username and profile picture from your public profile can appear next to the post.

Your tool inputs are sent to AI providers

This is the part worth reading. When you use an AI tool on this site — the caption generator, bio generator, hashtag generator and the rest — the text and any image you submit are sent to a third-party AI provider to generate the result. We use Google Gemini, and fall back to other providers (OpenRouter, Groq, Mistral, Cerebras) if it is unavailable.

Those providers process your input under their own terms and privacy policies. Do not paste anything confidential, and do not upload images of other people without their permission.

What we do not do

• We do not sell your personal data.
• We do not share your account details with advertisers.
• We do not post anything to your Instagram or any other account. We have no access to them.

Public guide discussions

Guide discussions are public. Do not include passwords, API keys, private links, personal contact details or anything you would not want other visitors to see. Signed-in readers can report a post; reports and reporter identities are private to RexxuLabs.

We may remove public discussion content that is spam, abusive, unlawful, deceptive, or includes private information. Removing a post does not erase the private moderation record immediately.

Analytics, cookies and advertising

We use browser storage to keep you signed in and to remember preferences. That is functional, not tracking.

We use Google Analytics 4 to understand how visitors find and use RexxuLabs, including pages viewed, approximate location, device and browser information, and interaction timing. Google may set analytics cookies and process technical identifiers for this purpose. We use this information to improve guides, performance and navigation; we do not send your account name, email address, guide drafts or tool inputs to Analytics.

This site is registered with Google AdSense. Google display advertising is not currently enabled. If we turn ads on, Google and its partners may use cookies to serve ads based on your visits to this and other sites. You can opt out of personalised advertising in Google's Ads Settings, and opt out of third-party vendors' cookies at aboutads.info. Visitors in the EEA, UK and Switzerland will be asked for consent before any advertising cookies are set.

Who else handles your data

• Amazon Web Services — hosting, database and file storage.
• Cloudflare — serves the site and filters abusive traffic.
• Google — Analytics, Sign-In (if you use it), the Gemini API for generating results, and AdSense.
• OpenAI and Anthropic — process resumes only when you select their API in the Hiring Agent tool.
• Other AI providers — OpenRouter, Groq, Mistral and Cerebras, used only as fallbacks when the primary provider fails.

How long we keep it

Account details and usage history are kept while your account exists. Free-tier IP counters are short-lived and exist only to enforce the limit. Uploaded images stay until deleted.

Want your account and its data deleted? Ask via the contact page and we will remove it.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Contact us and we will action it. If you are in the EEA or UK, these rights come from the GDPR.

Children

This site is not intended for children under 13, and we do not knowingly collect their data.

Changes

If this policy changes we will update the date at the top of this page.