Privacy Policy

This policy explains what personal data Career Forge Ltd ("we", "us") collects when you use Rolebound, why we collect it, and the choices you have. It is written to be read; if anything is unclear, contact [email protected].

What we collect

• Account data: name, email address, password hash, locale and, if you sign in with Google, the identifier and profile picture Google provides. If you tell us, how you heard about us and who referred you.
• Profile and documents: the information you enter or upload to build resumes and cover letters, including work history, education, skills, uploaded files and LinkedIn PDF exports.
• Application details, if you give them to us: the answers employers' forms ask for, such as your phone number, address, salary expectations, right to work and need for visa sponsorship, security clearance, criminal-record declaration, pronouns and driving licence.
• Your Auto Apply authorisation: the document you sign before Auto Apply runs, with your typed name, the time, your IP address and your browser.
• Job-search activity: jobs you save, applications submitted (manually or through Auto Apply), Auto Apply preferences, scan results and interview sessions, including transcripts and feedback.
• Billing data: subscription status, credit balance and transaction history. Card details are handled by Stripe and never stored on our servers.
• Technical data: IP address, browser type, device information, pages visited and request identifiers, collected through server logs and, only if you agree to it, Google Analytics. When you sign up we also record where that visit came from: the advert or site that sent you and the page you landed on. If you pair our browser extension, we record its version and your browser.

How we use it

• To provide the service: generating documents, matching and submitting applications, running interview sessions and scanning resumes.
• To operate AI features: your documents, the CVs and LinkedIn exports you upload, files you check with the free scanner, job descriptions, and an application's questions together with the details from your profile needed to answer them are sent to our AI provider, DeepSeek, which processes them in China. DeepSeek's terms for API customers do not rule out its using this data to improve its own models.
• To submit applications on your behalf when you enable Auto Apply, which involves sending your documents and contact details to the employer's application system.
• To bill you, prevent fraud, respond to support requests and send service emails. Marketing emails are sent only with consent and include an unsubscribe link.
• To improve the product using aggregated, de-identified usage statistics.

Legal bases

We process data to perform our contract with you, for legitimate interests (security, product improvement, fraud prevention), with your consent (marketing, optional features) and to comply with legal obligations.

Sharing

We share data with processors who help us run the service:

• Hetzner, whose servers in Finland run the application and hold the database and logs.
• Cloudflare: network delivery, security checks, the files you upload and backup copies of the database.
• DeepSeek, our AI provider, in China (see “How we use it”).
• Stripe for payments, Postmark for email delivery, and Google for “Sign in with Google” and, only if you accept analytics cookies, Google Analytics.

Speech in mock interviews and Interview Copilot is turned into text by your browser's own speech recognition (in Chrome, Google's), under your browser's terms; we receive only the text. Employers receive the application data you choose to send. We do not sell personal data.

The browser extension

The Rolebound extension runs in your own browser, under your own sign-ins, and fills job application forms with the profile you have already given us. It is the part of the product that touches employer websites directly, so it is worth being precise about.

• It runs only on the job boards it works with (LinkedIn, Indeed and Reed) and on the employer application systems it can fill in, such as Greenhouse, Lever and Workable. On any other website it does not run at all.
• Even there, it acts only on a tab opened for one of your applications, by the extension itself or from your queue in the app, or for a job search Auto Apply runs for you. On any other page of those sites it reads nothing and sends nothing.
• On an application form it reads the fields, their labels and the questions being asked, sends the questions to us so we can answer them from your profile, and writes the answers back into the form. It also sends us the page's address and, when it cannot finish, what stopped it, such as the text of a dialog or the label of a button.
• When it searches a job board for you, it reads the search results and sends us each job's title, company, location and link.
• It checks whether a job board's sign-in cookie exists, to know whether you are signed in there. Only a yes or no leaves your browser, never the cookie.
• It does not collect your browsing history or your bookmarks.
• It stops and hands the tab back to you for a captcha, a sign-in page, or a required question it cannot answer confidently from your profile. Questions your profile does not answer directly are drafted by our AI, and a question asking whether you are 18 or over is answered yes.
• Nothing it collects is sold or used for advertising.

Cookies

Necessary cookies keep you signed in (rb_access, rb_refresh), protect the site from abuse, remember the choice you make on the cookie banner (rb_consent), and remember your language (rb_locale) and which of our sites, UK or US, you use (rb_market). We do not ask permission for these, because the site cannot do what you came for without them. If you choose a light or dark look for the app, your browser's own storage remembers it (rb_theme); that setting stays on your device and is never sent to us.

Everything else is optional and off until you turn it on. Analytics cookies are Google Analytics 4, which tells us which pages people use and where they give up. Advertising cookies let us tell which advert brought someone here, so we stop paying for the ones that do not work. No analytics or advertising script is loaded — no request to Google Analytics, no cookie — unless and until you choose to accept it. If you refuse, or simply ignore the banner, nothing optional is set at all. If your browser sends Global Privacy Control, advertising stays off whatever you choose on the banner. With analytics on, we also keep in your browser's storage (rb_first_touch) where your first visit came from, so a later signup can be credited to it. With advertising on, if you arrived through someone's referral or affiliate link, we keep its code in your browser's storage (rb_ref) for 60 days, so a signup in that time is credited to them. The sign-in and sign-up pages load Google's own script for the “Sign in with Google” button.

You can change your mind at any time from “Cookie settings” in the footer of every page. Turning something off removes the cookies and storage it set and stops the tag loading again. We keep a record of what you chose, when, and which version of this notice was in force, because we have to be able to show that consent was asked for properly; that record is kept against a random identifier, not against your name, unless you happened to be signed in.

Anonymous free tools

A file you check with the free scanner without an account is read to produce your score and is not stored; the result (the score, the suggestions, which can quote your CV, and any job description you pasted) is kept with no link to you. Text entered into the sample cover letter generator is not stored. To prevent abuse we keep your IP address for up to an hour, and Cloudflare's security check on these tools sees it too.

Retention

Account data is kept while your account is active. You can delete resumes, cover letters and tracked applications at any time. Deleting your account deletes your account data and the files you uploaded straight away and stops any marketing email. We keep only what we must: records of your consents (to email and to Auto Apply) and of security events, which show that we acted properly, and payment records, which tax law requires. Database backups are kept for 30 days, so a deleted account leaves them within 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. You can correct your profile and delete documents or your whole account yourself in Settings; for a copy of your data, or anything else, email us. You can complain to your local data protection authority.

International transfers

Our servers are in Finland, in the EU. Stripe, Postmark, Google and Cloudflare process data in the United States, and DeepSeek processes the text our AI features send it in China.

Security

Data is encrypted in transit and at rest. Access is limited to staff who need it, and we log what staff do to accounts. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you as required by law.

Children

Rolebound is not intended for people under 16, and we do not knowingly collect their data.

Changes

We will post changes here and, for material changes, notify you by email or in the app.

Contact

Career Forge Ltd, United Kingdom. Email: [email protected].