Privacy noticePrivacy notice

RoleFramework is responsible for the personal data described here. The company name, registration number and a contact address for privacy questions are published here once registration is complete.

Only what the service needs to work for you:

• Your account: email address and display name. If you log in with Google, we keep the address Google confirms and the ID that links your Google account to this one. If you made your account with Google, the name on your Google account becomes your display name. We keep nothing else from your Google account: no log-in tokens and no profile picture.
• Your password, if you set one: only a scrypt hash of it with a random salt, never the password itself.
• Your log-in sessions, each with the browser and operating system it was opened in and no IP address, and the log-in links and 6-digit codes we email you, stored only as a hash.
• A record of what you accepted and confirmed when you made your account: which version of the terms and of this notice, and that you are 18 or older. Each entry has the time and a hash of your IP address made with a secret key. If either document changes, your next log-in records the new version.
• Your resumes: the files and photos you upload, the editable copies, every version, and your conversation under “Ask for a change”.
• Facts you confirm and the questions they answer.
• Postings you add, their fit ratings and your tailoring sessions.
• Applications, their stages and interview rounds.
• Usage counts for rate and spending limits, such as how many wrong passwords were tried for an address, and a security log of what is done in your account, such as log-ins, password changes, imports, exports and deletions. Where these need your IP address or email address, they keep a hash of it made with a secret key, not the address itself.

To provide the service you signed up for: importing, tailoring and tracking. This is necessary to perform our agreement with you.

To keep the service safe and affordable: rate limits, spending caps and the log above. This is our legitimate interest, and the log holds no resume content.

To be able to show what you accepted and when. This is our legitimate interest.

We do not sell your data, use it for advertising, or use it to train models.

To rate a posting and draft changes, text is sent to a language model provider, Anthropic. Before it is sent, your name, email address, phone number, links and photo are removed. To research salary and interviews for a posting, the model also searches the web for the employer, the role and the place named in it.

Anthropic processes these requests in the United States. Under its commercial terms it does not train models on them. Transfers will rely on a data processing agreement and the EU's standard contractual clauses or the EU–US Data Privacy Framework.

RoleFramework is in a closed beta today, running on infrastructure we control. For the public beta, the plan is the EU: the database and files with Supabase in Stockholm, the web app with Vercel in Frankfurt, and the import and rendering services with Google Cloud in Finland.

Emails about logging in and your account, such as log-in links and the codes that confirm an address or reset a password, are planned to be sent through Resend, which receives your email address and the email itself; where Resend processes them is published here before the public beta. If the check that you are a person is switched on, the log-in page loads Cloudflare Turnstile, which receives your IP address and details of your browser. If you continue with Google, you log in on a page Google runs under its own privacy policy.

When you choose a password, our server checks it against Pwned Passwords, a list kept by Have I Been Pwned of passwords from published data breaches. It sends only the first five characters of the password's SHA-1 hash, which many other passwords share, so the service cannot tell which password it was. It never receives the password, your email address or your IP address.

This list is updated before any new provider receives personal data.

Until you delete it. Deleting a resume removes it with all its versions; deleting an application removes it with its interview rounds.

On your account page, “Delete my account…” removes your account and everything stored for it at once: every resume with its files and versions, your facts, postings, tailoring sessions, applications and preferences. Kept after that: what each model call cost and a security log of log-ins, password changes, imports, exports and deletions, with ids, counts and a hashed IP address; neither holds resume or posting text. For the public beta, backups are planned to expire within 30 days.

You can ask for a copy of your data, have it corrected or deleted, take it elsewhere, or object to how it is used. We answer within one month.

You can also complain to the Swedish Authority for Privacy Protection, IMY.

This site sets no cookies until you log in or create an account, and runs no analytics or advertising scripts. Logging in sets a cookie that keeps you logged in for 90 days; it is renewed while you use the app and removed when you log out. Creating an account with a password sets one for up to an hour, so the password counts only if the emailed code is entered in the same browser. If you chose a language when logging in or in the app, a cookie remembers it for a year. Logging in with Google sets one more, for at most ten minutes, while you are on Google's page. None of them is used for tracking or advertising.

The fit rating is advice for you. It decides nothing about you, and no employer sees it.

We keep a password only as a scrypt hash with a random salt, never the password itself. A new password needs at least 12 characters, cannot be your email address or your name, and is checked against passwords from published data breaches: one found there is refused, and if the check cannot run, the password is accepted. After 10 wrong passwords for an address within 15 minutes, that address cannot log in with a password for up to 15 minutes.

Password-reset codes work once and expire after 10 minutes; log-in links work once and expire after an hour; both are stored only as a hash. The code that confirms a new account works the same way as a reset code, and any code stops working after five wrong tries. Setting a new password logs out every other browser. You can also do without a password: continue with Google where the log-in page offers it, or ask for a log-in link by email.

Each account can read only its own data, and the database enforces it. Uploads are checked for type and size, requests are rate-limited and spending on the language model is capped.

If a breach puts you at risk, we tell you, and we tell IMY when the law requires it.

RoleFramework is for people 18 or older.

Every change is dated here. We tell you before a change that affects how your data is used.