Privacy Policy
Last updated on 2026-06-30. Questions: support@tucaken.com.
This policy explains how Tucaken Resumes handles your personal data when you use Tucaken. It covers both the EU GDPR and the UK GDPR.
Who controls your data
Tucaken Resumes is the data controller for the personal data you provide to Tucaken. For any privacy request, contact support@tucaken.com.
Data we process
- Account and sign-in details, managed through Amazon Cognito.
- Data you connect from GitHub, used to generate your resume.
- Profile and professional information you add.
- Billing details handled by Stripe - Stripe holds your card data, not us.
- Please avoid placing sensitive information (for example, health or political details) in free-text fields, as it is not needed.
Why we are allowed to process it
We process the data needed to generate your resume on the basis of our contract with you. We use analytics and marketing cookies only with your consent, which you can change at any time on the Cookie Policy page.
Sub-processors and international transfers
We share data with service providers that help us run Tucaken: Amazon Web Services and Amazon Bedrock (hosting and AI processing), GitHub (the connection you authorise), Stripe (payments), and Amazon Cognito (authentication). Where data is transferred outside the EU or UK, we rely on the relevant safeguards, such as Standard Contractual Clauses and the UK Addendum.
Automated processing
Tucaken uses automated steps to extract skills and structure your evidence into a resume. This supports you; it does not make an automated decision with legal or similarly significant effect. You decide whether and how to use the resume Tucaken produces.
Your rights and how long we keep data
You can ask us to access, correct, delete, or export your data, or object to certain processing. To exercise any right, contact support@tucaken.com. We keep your data for as long as your account is active and delete it on request, unless we must keep it to meet a legal obligation.
You can also complain to a supervisory authority: the Data Protection Commission (Ireland) in the EU, or the Information Commissioner's Office (UK) in the UK.