Privacy Policy

We collect only the minimum data necessary to provide the service.

We do not collect: sensitive personal data (race, religion, health, political opinions, biometric data), financial information beyond salary range preferences you enter voluntarily, or precise geolocation.

• To provide, operate, and maintain the platform.
• To send transactional email notifications about your job pipeline (stale application nudges, offer reminders, weekly digests). You may opt out at any time — see Section 8.
• To send an internal Slack notification when a new user registers. This contains only your email address and is used solely for operational monitoring by the RolePilot team.
• To analyse usage patterns and improve the platform.
• To respond to support requests.
• To comply with legal obligations.

We do not use your data for: selling or renting to third parties, behavioural advertising, or automated decision-making with legal or similarly significant effects. AI-generated match scores are informational heuristics only — they do not constitute automated decisions under GDPR Article 22.

We share data only with processors necessary to provide the service. All processors are subject to data processing agreements or standard contractual clauses where required.

Transfers to the United States are governed by Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework where applicable.

• Account and profile data: retained until you delete your account via Settings → Delete Account. Deletion is permanent and irreversible.
• Application data: retained until you delete individual applications or your account.
• Notification records: automatically purged after 90 days.
• Analytics data: retained for 14 months (our analytics provider's default retention period). Raw IP addresses are not stored.
• Email delivery logs: retained by our email delivery provider for up to 30 days.

You have the following rights regarding your personal data:

• Access — request a copy of all personal data we hold about you.
• Rectification — correct inaccurate or incomplete data via your account settings.
• Erasure ("right to be forgotten") — request permanent deletion of your data. You may do this directly via Settings → Delete Account at any time.
• Data portability — receive your personal data in a structured, commonly used, machine-readable format.
• Restriction — request that we limit processing in certain circumstances (e.g., while a dispute is resolved).
• Objection — object to processing based on legitimate interests, including analytics.
• Withdraw consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.
• Lodge a complaint — UK users may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. EU users may contact their local supervisory authority.

To exercise any right, email privacy@role-pilot.com. We will respond within 30 days and may ask you to verify your identity before processing the request.

California residents have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know — request disclosure of the categories and specific pieces of personal information we collect, use, and share.
• Right to delete — request deletion of personal information we have collected from you.
• Right to correct — request correction of inaccurate personal information.
• Right to opt-out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA.
• Non-discrimination — we will not discriminate against you for exercising any CCPA/CPRA right.

To exercise your rights, email privacy@role-pilot.com with the subject line "CCPA Request". We will respond within 45 days.

We use a minimal set of cookies:

• Essential cookies: Authentication session tokens stored in your browser's local storage. These are required for the service to function and cannot be disabled.
• Analytics cookies: Set by our web analytics provider to understand how users interact with the platform. IP addresses are anonymised. You may opt out by using a content-blocking browser extension or your browser's built-in tracking protection.

We do not use advertising cookies, tracking pixels, or cross-site tracking technology.

We send transactional emails related to your job pipeline (e.g., stale application reminders, offer follow-up nudges, weekly digest). These are sent only because you have an active account and application data.

You may manage or disable notification types at any time via Settings → Notifications, or by clicking the unsubscribe link in any email we send. Opt-outs are processed immediately.

We do not send marketing emails without explicit consent. We will not add you to any third-party mailing lists.

We implement industry-standard safeguards including:

• Supabase Row-Level Security (RLS) — database access is strictly scoped to the authenticated account holder.
• HTTPS/TLS encryption for all data in transit.
• Passwords are hashed by Supabase Auth and never stored in plain text.
• Service-role database keys are server-side only and never exposed to the browser or client-side code.
• Secrets are stored in environment variables and never committed to version control.

No system is perfectly secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and the relevant supervisory authority within 72 hours where required by law (GDPR Article 33/34).

RolePilot operates with processors in the United States. Where we transfer your personal data outside the UK or European Economic Area (EEA), we rely on appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO.
• The EU–US Data Privacy Framework (DPF) where processors are certified.
• UK Adequacy Regulations for transfers between the UK and EEA.

RolePilot is not directed at anyone under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided data to us, contact privacy@role-pilot.com and we will delete the data promptly upon verification.

We may update this Privacy Policy to reflect changes in the platform, legal requirements, or our data practices. Material changes will be communicated via email and/or an in-app notice at least 30 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.

For all privacy-related enquiries, requests, or complaints:

Email: privacy@role-pilot.com
Website: role-pilot.com