Privacy Policy

Information you provide

We collect account details, career history, resumes, job descriptions, notes, cover letters, skills, learning plans, practice conversations, search preferences, support messages and reports that you submit or create in the Service. Reports include a snapshot of the reported content and the reporter's account. Support correspondence is kept in our support mailbox for as long as needed to resolve the matter and for our records; it is not deleted automatically when an account is deleted. Please do not put government ID numbers, health information or financial account numbers in resumes, notes or practice messages.

Resume files are parsed in the browser or on upload; we store the extracted content as structured data, not the original uploaded file. Generated PDF previews are cached temporarily in our database. Each preview uses an unguessable random link, but anyone with that link can open it. Preview links stop working after one hour, and expired copies are removed during later cleanup. Avoid sharing preview links publicly.

During the private beta, the waitlist collects your email address and signup time. We use the address only to notify you when access opens.

Information collected automatically

We process IP addresses, device information, request paths, response status and usage data for security, rate limiting, diagnostics and operation of the Service. Rate-limiting records use keys derived from raw IP addresses and the action being limited. Our published site uses platform-level analytics for pages visited, approximate visitor counts, referring sites, approximate location derived from network data, and browser and device type. We use product analytics to understand how people navigate and use the Service, measure engagement, and improve functionality and usability. These custom events do not include resume text, job text, search terms, filenames, private notes, or personal identifiers.

Information from third-party sources

Our sign-in provider (Clerk) supplies account identifiers and sign-in details. If you sign in with Google, we receive your name, email address and, where provided by Google, your profile image through our sign-in provider; we do not request or access other Google account data. Rolebase's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We receive subscription and transaction information from our payment processor, and listings from third-party job boards and aggregators. Search terms, including keywords, location and supported filters, are sent to third-party job-search providers when you search. A job page imported from a URL is fetched once to extract its content; we do not store the fetched page itself. If you save the extracted information, it becomes part of your workspace. Saved search preferences are matched against our own catalog on a schedule without sending those preferences to third-party job-search providers.

Summary of categories

• Provide accounts, maintain the career workspace, deliver search results and match saved preferences.
• Generate requested documents, learning materials and text-based practice feedback; administer purchases and subscriptions.
• Protect accounts, detect abuse, enforce our terms, respond to support requests and content reports, and comply with legal obligations.
• Measure use and improve the Service using the analytics described above.

We send service emails about billing, accounts, security and policy notices. We do not send marketing email today. If that changes, we will provide an opt-out method for marketing messages.

Requested features send the content needed for the request, such as resume content, job descriptions, notes and practice messages, to text-generation providers OpenAI and the Google Gemini API. Gemini features use a paid API account. Under the API terms each provider publishes as of the effective date of this Policy, content submitted through its API is not used to train or improve that provider's general models. Each provider may retain submitted content for a limited period to monitor for abuse and misuse, as described in its published terms. We do not use your content to train models of our own.

Interview practice is text-only. We save practice messages and feedback with the conversation. We do not record or store microphone audio. Outputs are suggestions for you to review, not automated decisions with legal or similarly significant effects. Employers never receive your data or ratings from Rolebase.

We disclose information to providers acting on our behalf to deliver the Service: Clerk for authentication; Stripe for hosted checkout and billing; OpenAI and Google Gemini for requested generation; a managed database and cloud infrastructure provider for hosting; transactional email providers including Resend for service notices; analytics services for site and product measurement; job-search providers for search requests; and Google's YouTube API Services for public learning video information. Sign-in may load Cloudflare Turnstile for bot protection. Google Fonts delivers fonts and receives your browser's IP address and request details.

Hosted checkout takes place on Stripe's pages. Card details are entered there and never touch Rolebase pages. We store a payment customer identifier, plan, subscription status, billing period and synced subscription and invoice records. The billing screen may display the card brand and last four digits retrieved on demand from Stripe; we do not store those card details.

We may also disclose information to comply with law, protect rights and safety, or in connection with a corporate transaction, subject to appropriate safeguards. We do not sell or share personal information for targeted advertising, and we do not use targeted advertising. Employers never receive user information or ratings from us.

Our sign-in provider uses session cookies to maintain authentication. Sign-in may load a Cloudflare Turnstile bot-protection check. After an account-deletion request, a browser credential remains for 30 days so you can check deletion status or retry cleanup.

While the private beta is running, an access-code check sets a signed private-beta access cookie containing an access flag, not your email address. It permits entry to the Service and expires after 90 days.

The Service makes substantial use of browser local storage for resumes, jobs, workspace and learning data, onboarding information, preferences and interface state; some content also syncs to our database. Session storage may hold temporary interface state. On a shared or public device, sign out and clear site data after use. We do not use advertising, cross-site tracking or affiliate cookies.

Because we do not sell or share personal information, there is no sale or sharing opt-out preference to apply from Global Privacy Control signals. We do not currently change our behavior in response to Do Not Track signals.

We keep account and workspace information while your account is active or until you remove it, subject to operational and legal needs. Content reports are retained with the account. Support correspondence is kept in our support mailbox for as long as needed to resolve the matter and for our records; it is not deleted automatically when an account is deleted. Security and usage records are retained as needed to operate and protect the Service; information held by providers may follow their own retention schedules.

We keep waitlist addresses while the private beta operates, remove an address when the person asks us to, and delete the waitlist when the private beta ends. The current waitlist has no automated deletion; contact us to request removal.

When an account is deleted, we preserve a restricted evidence record of the signup notice actually recorded, the corresponding legal document versions, minimal account linkage, and the deletion request and completion. We retain this account evidence for three years after deletion completes. Missing signup evidence is not treated as acceptance. The archive does not retain resumes, private notes, interview materials or other ordinary workspace content.

A separate billing reference is retained for seven years after the financial year in which deletion completes. Invoices, payments and refunds remain primarily in payment and accounting systems, subject to applicable accounting obligations and provider retention practices. Archive access is restricted and audited. These records are not used for marketing, personalization or AI training.

We may retain specific relevant evidence longer under a documented legal hold where necessary and permitted by law to establish, exercise or defend legal claims, or to meet a preservation obligation. We review holds periodically. Releasing a hold does not restart the ordinary retention period. Limited audit records are retained for three years from the recorded action, subject to an applicable hold.

Select "Delete account" in Settings to start deletion immediately. This action cannot be undone. Workspace data and linked records are removed from active systems, the sign-in identity is deleted, and paid subscriptions are cancelled without an automatic refund. Billing records and a minimal hashed deletion record remain for legal, accounting and abuse-prevention purposes. Aggregated search-demand records are kept with the account association removed; they may still contain the search terms and filters that were used. Deletion may require further cleanup steps; the 30-day browser credential lets you check status or retry cleanup.

Backup copies are retained for a limited period and expire on our infrastructure provider's schedule. Browser local storage persists independently until you clear site data.

We use technical and organizational measures designed to protect information, including TLS encryption in transit and encryption at rest in our managed database. Access is limited to personnel who need information for their work. Authentication, access checks, validation and rate limits protect relevant functions. No method of transmission or storage is completely secure; we address incidents and provide notices as required by law. See the Data security section of our Terms of Service for more information.

We operate the Service from the United States and offer it to people in the United States. Our infrastructure providers host our application and managed database in data centers they operate, and our service providers (sign-in, payments, artificial intelligence, email delivery, analytics) may process information in the United States or in other countries where they operate. When you use the Service, your information may be transferred to and processed in those locations.

All users in the United States may request access to, correction or deletion of their personal information, a portable copy, and appeal a decision on a privacy request. You can edit some information in your workspace and use the "Delete account" control in Settings. For other requests, including a portable copy or appeal, use the email address in Section 14. We may verify your identity before acting, and authorized agents may submit requests on your behalf subject to verification of their authority.

We respond within the time required by applicable law, and in any event we aim to respond within 45 days. Certain information may be exempt from a request or retained where permitted by law. We do not discriminate against anyone for exercising privacy rights.

US state privacy rights

State laws may provide additional rights or appeal procedures. We do not sell or share personal information, engage in targeted advertising, or use sensitive information beyond providing the Service, so no opt-out is required for those activities. Contact us for requests under applicable state law.

If you include another person's information in career materials, notes, a job description or a report, submit only information you have a right to provide. Avoid unnecessary personal details about references, colleagues or other people.

Job listings originate with third-party job boards and aggregators. Links to employer pages and other third-party sites are governed by those sites' practices, not this Policy. Review their notices before sharing information with them.

Rolebase uses YouTube API Services to look up public video information and embed learning videos. Your use of those services is subject to the YouTube Terms of Service and the Google Privacy Policy.

The Service is intended only for people aged 18 or older. If you believe a person under 18 has provided information, contact us so we can review and take appropriate action.

We may change this Policy and will update the date above. We will give notice of material changes by email to the address on your account.

To exercise a privacy right or ask a question about this Policy, contact Rolebase Inc., a Delaware corporation, by email at support@rolebase.com.