Privacy Policy

This notice explains what personal data Career Forge Ltd ("we", "us") collects when you use Rolebound in the United States, why we collect it, who receives it, and the rights you have under US state privacy laws. It describes the same service and the same practices as our UK privacy policy, with what US law asks us to tell you added. If anything is unclear, contact [email protected].

What we collect

• Account data: name, email address, password hash, locale and, if you sign in with Google, the identifier and profile picture Google provides. If you tell us, how you heard about us and who referred you.
• Profile and documents: the information you enter or upload to build resumes and cover letters, including work history, education, skills, uploaded files and LinkedIn PDF exports.
• Application details, if you give them to us: the answers employers' forms ask for, such as your phone number, address, salary expectations, security clearance, criminal-record declaration, pronouns and driver's license.
• Your Auto Apply authorization: the document you sign before Auto Apply runs, with your typed name, the time, your IP address and your browser.
• Work authorization and visa status, if you give it to us: whether you are authorized to work in the US, whether you will need visa sponsorship now or in the future, and your status (for example US citizen, green card holder, H-1B, F-1 OPT or STEM OPT).
• Job-search activity: jobs you save, applications submitted (manually or through Auto Apply), Auto Apply preferences, scan results and interview sessions, including transcripts and feedback.
• Billing data: subscription status, credit balance and transaction history. Card details are handled by Stripe and never stored on our servers.
• Technical data: IP address, browser type, device information, pages visited and request identifiers, collected through server logs and, only if you agree to it, Google Analytics. When you sign up we also record where that visit came from: the advert or site that sent you and the page you landed on. If you pair our browser extension, we record its version and your browser.

How we use it

• To provide the service: generating documents, matching and submitting applications, running interview sessions and scanning resumes.
• To operate AI features: your documents, the CVs and LinkedIn exports you upload, files you check with the free scanner, job descriptions, and an application's questions together with the details from your profile needed to answer them are sent to our AI provider, DeepSeek, which processes them in China. DeepSeek's terms for API customers do not rule out its using this data to improve its own models.
• To submit applications on your behalf when you enable Auto Apply, which involves sending your documents and contact details to the employer's application system.
• To answer the work-authorization and sponsorship questions on the applications you send, and, if you tell us you need sponsorship, to match you only to employers with certified H-1B LCAs on record. Your visa status also reaches our AI provider when it answers an application's questions. We use it for nothing else: not for advertising, and not to infer anything about you.
• To bill you, prevent fraud, respond to support requests and send service emails. Marketing emails are sent only with consent and include an unsubscribe link.
• To improve the product using aggregated, de-identified usage statistics.

Legal bases

We are a UK company, so UK data protection law applies to everything we do with your data wherever you live. Under it we process data to perform our contract with you, for legitimate interests (security, product improvement, fraud prevention), with your consent (marketing, optional features) and to comply with legal obligations.

Categories of personal information

In the categories US state laws use, in the last 12 months we have collected: identifiers (name, email address, IP address, account identifiers); professional or employment-related information (work history, resumes, cover letters and applications); education information (the education history you enter); commercial information (purchases, subscriptions and credits); internet or other electronic network activity (pages visited, device and browser data, how you use the service); inferences (the match scores we compute between your profile and a job); and sensitive personal information (your account login, and your citizenship or immigration status if you give it to us).

We collect it from you, from your use of the service, from the files and LinkedIn exports you upload, and from Google if you sign in with Google. We use each category for the purposes listed under “How we use it” and disclose it only as described under “Sharing”.

Sharing

We share data with service providers (processors) who help us run the service, under contracts that allow them to use it only to provide their service to us:

• Hetzner, whose servers run the application and hold the database and logs: Finland.
• Cloudflare (network delivery, security checks, the files you upload and backup copies of the database): United States, and Cloudflare's global network.
• DeepSeek (the AI that drafts resumes and cover letters, matches jobs and gives interview feedback): People's Republic of China.
• Stripe (payments): United States.
• Postmark (email delivery): United States.
• Google (sign-in with Google, and Google Analytics only if you accept analytics cookies): United States.

Speech in mock interviews and Interview Copilot is turned into text by your browser's own speech recognition (in Chrome, Google's), under your browser's terms; we receive only the text. Employers receive the application data you choose to send, through their own application systems, at your direction. We do not disclose personal information to third parties for their own direct marketing.

Where your data is processed

We are a UK company. Our servers are in Finland, and your data is also processed in the countries named above: the United States, and the People's Republic of China whenever an AI feature runs. What our AI provider receives — your resume, the job description, your interview answers, and an application's questions with the details from your profile needed to answer them, which can include your work authorization and visa status — is processed on DeepSeek's servers in China. The law in those countries may not protect personal data in the same way as the law where you live.

Selling and sharing

We do not sell personal data. We do not share it for cross-context behavioral advertising or use it for targeted advertising, with one exception that stays off unless you turn it on: if you accept advertising cookies on our cookie banner, Google receives information about your visit and the advert that brought you here, and may use it for advertising. Refusing advertising cookies, or turning them off at any time from “Cookie settings” in the footer, is your opt-out, and a browser that sends Global Privacy Control opts out automatically.

We use sensitive personal information, including your immigration status, only to provide the service you asked for, and never to infer characteristics about you.

The browser extension

The Rolebound extension runs in your own browser, under your own sign-ins, and fills job application forms with the profile you have already given us. It is the part of the product that touches employer websites directly, so it is worth being precise about.

• It runs only on the job boards it works with (LinkedIn, Indeed and Reed) and on the employer application systems it can fill in, such as Greenhouse, Lever and Workable. On any other website it does not run at all.
• Even there, it acts only on a tab opened for one of your applications, by the extension itself or from your queue in the app, or for a job search Auto Apply runs for you. On any other page of those sites it reads nothing and sends nothing.
• On an application form it reads the fields, their labels and the questions being asked, sends the questions to us so we can answer them from your profile, and writes the answers back into the form. It also sends us the page's address and, when it cannot finish, what stopped it, such as the text of a dialog or the label of a button.
• When it searches a job board for you, it reads the search results and sends us each job's title, company, location and link.
• It checks whether a job board's sign-in cookie exists, to know whether you are signed in there. Only a yes or no leaves your browser, never the cookie.
• It does not collect your browsing history or your bookmarks.
• It stops and hands the tab back to you for a captcha, a sign-in page, or a required question it cannot answer confidently from your profile. Questions your profile does not answer directly are drafted by our AI, and a question asking whether you are 18 or over is answered yes.
• Nothing it collects is sold or used for advertising.

Cookies

Necessary cookies keep you signed in (rb_access, rb_refresh), protect the site from abuse, remember the choice you make on the cookie banner (rb_consent), and remember your language (rb_locale) and which of our sites, UK or US, you use (rb_market). We do not ask permission for these, because the site cannot do what you came for without them. If you choose a light or dark look for the app, your browser's own storage remembers it (rb_theme); that setting stays on your device and is never sent to us.

Everything else is optional and off until you turn it on. Analytics cookies are Google Analytics 4, which tells us which pages people use and where they give up. Advertising cookies let us tell which advert brought someone here, so we stop paying for the ones that do not work. No analytics or advertising script is loaded — no request to Google Analytics, no cookie — unless and until you choose to accept it. If you refuse, or simply ignore the banner, nothing optional is set at all. If your browser sends Global Privacy Control, advertising stays off whatever you choose on the banner. With analytics on, we also keep in your browser's storage (rb_first_touch) where your first visit came from, so a later signup can be credited to it. With advertising on, if you arrived through someone's referral or affiliate link, we keep its code in your browser's storage (rb_ref) for 60 days, so a signup in that time is credited to them. The sign-in and sign-up pages load Google's own script for the “Sign in with Google” button.

You can change your mind at any time from “Cookie settings” in the footer of every page. Turning something off removes the cookies and storage it set and stops the tag loading again. We do not respond differently to a browser's Do Not Track signal, because nothing optional runs unless you accept it on the banner.

Anonymous free tools

A file you check with the free scanner without an account is read to produce your score and is not stored; the result (the score, the suggestions, which can quote your CV, and any job description you pasted) is kept with no link to you. Text entered into the sample cover letter generator is not stored. To prevent abuse we keep your IP address for up to an hour, and Cloudflare's security check on these tools sees it too.

Retention

Account data, including your visa status, is kept while your account is active. You can delete resumes, cover letters and tracked applications at any time. Deleting your account deletes your account data and the files you uploaded straight away and stops any marketing email. We keep only what we must: records of your consents (to email and to Auto Apply) and of security events, which show that we acted properly, and payment records, which tax law requires. Database backups are kept for 30 days, so a deleted account leaves them within 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. You can correct your profile and delete documents or your whole account yourself in Settings; for a copy of your data, or anything else, email us. You can complain to your local data protection authority.

Your US state privacy rights

Depending on the state you live in — California, Colorado, Connecticut, Virginia, Texas, Oregon and the other states with a consumer privacy law — you have some or all of these rights:

• To know: what personal data we hold about you, where it came from, why we use it and to whom we disclose it, and to receive a copy of it in a portable format.
• To delete personal data we hold about you, subject to the exceptions the law allows, such as records we must keep for tax.
• To correct personal data that is inaccurate.
• To opt out of the sale of personal data, of sharing it for cross-context behavioral advertising and of targeted advertising. We do not sell personal data, and the only advertising use is the optional cookie described under “Selling and sharing”.
• To limit the use of sensitive personal information. We already use it only to provide the service you asked for.
• Not to be treated differently for using any of these rights: the service and its prices are the same either way.

How to make a request

You can correct your profile, delete documents and delete your account yourself in Settings. For anything else, email [email protected] with “Privacy request” in the subject, from the address on your account so we can confirm it is you. Someone else can make a request for you as your authorized agent; we will ask for proof that you authorized them and may ask you to confirm your identity with us directly.

We will confirm that we received your request within 10 business days and answer within 45 days. If we need longer, we will tell you why; the law allows one further 45 days. If we decline a request, we will explain why, and you can appeal by replying to our answer. We will respond to an appeal within 45 days, and if we deny it you can contact your state's attorney general.

Security

Data is encrypted in transit and at rest. Access is limited to staff who need it, and we log what staff do to accounts. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you as required by law.

Children

Rolebound is not intended for people under 16, and we do not knowingly collect their data.

Changes

We will post changes here and, for material changes, notify you by email or in the app.

Contact

Career Forge Ltd. US mailing address: c/o XLNCEE Solutions LLC, 313 Lariat Loop, Liberty Hill, TX 78642, USA. Email: [email protected].