Privacy Policy

This notice explains what personal data Career Forge Ltd ("we", "us") collects when you use Rolebound in the United States, why we collect it, who receives it, and the rights you have under US state privacy laws. It describes the same service and the same practices as our UK privacy policy, with what US law asks us to tell you added. If anything is unclear, contact [email protected].

What we collect

• Account data: name, email address, password hash, locale and, if you sign in with Google, the identifier Google provides.
• Profile and documents: the information you enter or upload to build resumes and cover letters, including work history, education, skills, uploaded files and LinkedIn PDF exports.
• Work authorization and visa status, if you give it to us: whether you are authorized to work in the US, whether you will need visa sponsorship now or in the future, and your status (for example US citizen, green card holder, H-1B, F-1 OPT or STEM OPT).
• Job-search activity: jobs you save, applications submitted (manually or through Auto Apply), Auto Apply preferences, scan results and interview sessions, including transcripts and feedback.
• Billing data: subscription status, credit balance and transaction history. Card details are handled by Stripe and never stored on our servers.
• Technical data: IP address, browser type, device information, pages visited and request identifiers, collected through server logs and, only if you agree to it, Google Analytics.

How we use it

• To provide the service: generating documents, matching and submitting applications, running interview sessions and scanning resumes.
• To operate AI features: your documents and job descriptions are sent to our AI provider to generate output. Providers are contractually prohibited from using your data to train their models.
• To submit applications on your behalf when you enable Auto Apply, which involves sending your documents and contact details to the employer's application system.
• To answer the work-authorization and sponsorship questions on the applications you send, and, if you tell us you need sponsorship, to match you only to employers with H-1B approvals on record. We use your visa status for nothing else: not for advertising, and not to infer anything about you.
• To bill you, prevent fraud, respond to support requests and send service emails. Marketing emails are sent only with consent and include an unsubscribe link.
• To improve the product using aggregated, de-identified usage statistics.

Legal bases

We are a UK company, so UK data protection law applies to everything we do with your data wherever you live. Under it we process data to perform our contract with you, for legitimate interests (security, product improvement, fraud prevention), with your consent (marketing, optional features) and to comply with legal obligations.

Categories of personal information

In the categories US state laws use, in the last 12 months we have collected: identifiers (name, email address, IP address, account identifiers); professional or employment-related information (work history, resumes, cover letters and applications); education information (the education history you enter); commercial information (purchases, subscriptions and credits); internet or other electronic network activity (pages visited, device and browser data, how you use the service); audio information (speech in interview sessions, converted to a text transcript); inferences (the match scores we compute between your profile and a job); and sensitive personal information (your account login, and your citizenship or immigration status if you give it to us).

We collect it from you, from your use of the service, from the files and LinkedIn exports you upload, and from Google if you sign in with Google. We use each category for the purposes listed under “How we use it” and disclose it only as described under “Sharing”.

Sharing

We share data with service providers (processors) who help us run the service, under contracts that allow them to use it only to provide their service to us:

• Our own servers in the United Kingdom, which run the application and hold the database and logs.
• Cloudflare (network delivery, security checks and file storage): United States, and Cloudflare's global network.
• DeepSeek (the AI that drafts resumes and cover letters, matches jobs and gives interview feedback): People's Republic of China.
• Deepgram (speech-to-text for interview sessions): United States.
• Stripe (payments): United States.
• Postmark (email delivery): United States.
• Google (sign-in with Google, and Google Analytics only if you accept analytics cookies): United States.
• Error monitoring.

Employers receive the application data you choose to send, through their own application systems, at your direction. We do not disclose personal information to third parties for their own direct marketing.

Where your data is processed

We are based in the United Kingdom, and your data is processed there and in the countries named above: the United States, and the People's Republic of China whenever an AI feature runs. The text our AI provider receives — the content of your resume, the job description, your interview answers — is processed on DeepSeek's servers in China. The law in those countries may not protect personal data in the same way as the law where you live; where UK law requires it, we rely on standard contractual clauses or equivalent safeguards.

Selling and sharing

We do not sell personal data. We do not share it for cross-context behavioral advertising or use it for targeted advertising, with one exception that stays off unless you turn it on: if you accept advertising cookies on our cookie banner, Google receives information about your visit and the advert that brought you here, and may use it for advertising. Refusing advertising cookies, or turning them off at any time from “Cookie settings” in the footer, is your opt-out.

We use sensitive personal information, including your immigration status, only to provide the service you asked for, and never to infer characteristics about you.

The browser extension

The Rolebound extension runs in your own browser, under your own sign-ins, and fills job application forms with the profile you have already given us. It is the part of the product that touches employer websites directly, so it is worth being precise about.

• It reads a page only to find an application form: the fields, their labels and the questions being asked. It sends those questions to us so we can answer them from your profile, and writes the answers back into the form.
• It never reads a page you are not applying on. On any other site it does nothing, records nothing and sends nothing.
• It does not collect your browsing history, your bookmarks, or the contents of pages unrelated to an application.
• It reads cookies only to tell whether you are signed in to a job board, so it knows whether a form can be filled at all. It does not read, copy or transmit the cookie values themselves.
• Wherever a site needs you — a captcha, a question we hold no answer for, a login — it stops and hands the tab back to you rather than guessing.
• Nothing it collects is sold, and none of it is used for advertising or to train models.

Cookies

Necessary cookies keep you signed in (rb_access, rb_refresh), protect the site from abuse, remember the choice you make on the cookie banner (rb_consent) and remember which of our sites, UK or US, you use (rb_market). We do not ask permission for these, because the site cannot do what you came for without them.

Everything else is optional and off until you turn it on. Analytics cookies are Google Analytics 4, which tells us which pages people use and where they give up. Advertising cookies let us tell which advert brought someone here, so we stop paying for the ones that do not work. None of these are loaded — no script, no request to Google, no cookie — unless and until you choose to accept them. If you refuse, or simply ignore the banner, nothing optional is set at all.

You can change your mind at any time from “Cookie settings” in the footer of every page. Turning something off removes the cookies it set and stops the tag loading again. We do not respond differently to a browser's Do Not Track signal, because nothing optional runs unless you accept it on the banner.

Anonymous free tools

Files uploaded to the free scanner or text entered into the sample cover letter generator without an account are processed to produce the result and deleted afterwards. Rate-limiting data (IP address) is kept briefly to prevent abuse.

Retention

Account data, including your visa status, is kept while your account is active. You can delete individual documents at any time, and deleting your account removes your personal data within 30 days, except records we must keep for tax or legal reasons. Backups are rotated within 90 days.

Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. Most of this is available directly in Settings; for anything else, email us. You can complain to your local data protection authority.

Your US state privacy rights

Depending on the state you live in — California, Colorado, Connecticut, Virginia, Texas, Oregon and the other states with a consumer privacy law — you have some or all of these rights:

• To know: what personal data we hold about you, where it came from, why we use it and to whom we disclose it, and to receive a copy of it in a portable format.
• To delete personal data we hold about you, subject to the exceptions the law allows, such as records we must keep for tax.
• To correct personal data that is inaccurate.
• To opt out of the sale of personal data, of sharing it for cross-context behavioral advertising and of targeted advertising. We do not sell personal data, and the only advertising use is the optional cookie described under “Selling and sharing”.
• To limit the use of sensitive personal information. We already use it only to provide the service you asked for.
• Not to be treated differently for using any of these rights: the service and its prices are the same either way.

How to make a request

You can correct your profile, delete documents and delete your account yourself in Settings. For anything else, email [email protected] with “Privacy request” in the subject, from the address on your account so we can confirm it is you. Someone else can make a request for you as your authorized agent; we will ask for proof that you authorized them and may ask you to confirm your identity with us directly.

We will confirm that we received your request within 10 business days and answer within 45 days. If we need longer, we will tell you why; the law allows one further 45 days. If we decline a request, we will explain why, and you can appeal by replying to our answer. We will respond to an appeal within 45 days, and if we deny it you can contact your state's attorney general.

Security

Data is encrypted in transit and at rest. Access is limited to staff who need it, and we log administrative access. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you as required by law.

Children

Rolebound is not intended for people under 16, and we do not knowingly collect their data.

Changes

We will post changes here and, for material changes, notify you by email or in the app.

Contact

Career Forge Ltd, United Kingdom. Email: [email protected].