Rolehound

Privacy policy

Who is responsible for your data

The data controller for Rolehound is Kyrby Limited, a company registered in England and Wales (company number 10063736), whose registered office is 9 Bonhill Street, London, England, EC2A 4DJ. That is who decides what happens to the personal data described here, and who to contact about it. This policy is written to the UK GDPR and the Data Protection Act 2018.

What we collect

  • Your account. Your email address, a hash of your password, and — if you turn on two-factor authentication, which you can do for yourself on the Security page — your two-factor settings and recovery codes. Your password itself is never stored and cannot be read back by anyone.
  • Your CV and profile. The text of the CV you import and the structured version built from it — headline, summary, skills, sectors, must-haves, dealbreakers, employment history, education, certifications — including the contact block on the CV, which is your name, email address, phone number, location and links.
  • Your search criteria. Your search titles and keywords, your salary floor, your home postcode and the coordinates it resolves to, and your maximum commute.
  • Jobs, scores and applications. The roles found for you, the fit score, summary, strengths and concerns for each, which roles you applied for, what stage each application is at, and the CV and cover letter generated for it — both the text and the finished PDF.
  • Email details from a mailbox you connect. For each message: the sender address, the subject, a short preview of the text, when it arrived, and what Rolehound decided the message was. Read the next section before you connect anything — this is broader than it sounds.
  • Your mailbox connection. The host, port and username you gave, with the password or OAuth token encrypted.
  • Billing records. Your payment provider's customer reference, payment and invoice references, amounts, currencies and dates, your credit balance and its ledger, and your metered AI usage. No card details — see below.
  • An AI provider key, if you add one. Encrypted, and never shown back to you.
  • An audit trail. What ran on your account, and when.
  • A referral signal. If you arrived through somebody's referral link, a one-way hash of the internet address you signed up from is kept to spot abuse of the scheme. The address itself is not kept.
  • A message you send through the contact form. The name, email address, subject and message you type, and the date you sent it. It is kept so the message can be read and answered, and it stays until it has been dealt with — there is no automatic deletion and no button to remove it yourself. You do not need an account to use the form, and nothing else about you is recorded with the message: no internet address, no browser details, no page you came from.

What happens to your mailbox, in full

This has its own section because it is the most consequential thing Rolehound does with your data, and the honest description is wider than "it reads your job emails".

When you connect a mailbox, Rolehound looks at every message that has arrived since it last checked — not only the ones that turn out to be about a job. It sends the sender, subject and a short preview of each one to an AI model to work out what the message is, and it stores that same sender, subject and preview as a row on your account, alongside the model's decision. Personal mail is classified too, and gets a row like everything else, marked irrelevant.

It then moves every message it has classified out of your inbox, into a folder under Rolehound/ in your own mailbox named for the category it landed in — including Rolehound/Irrelevant for the personal mail. Your inbox is changed by this, and that is the part people do not expect.

Nothing is ever deleted or sent to trash. Where your server supports a server-side move the message is relocated in one operation; where it does not, the message is copied into the target folder first and the original is only removed once that copy has come back confirmed. If the copy fails, nothing is touched and the message stays exactly where it was.

Message bodies are not stored. When a message is classified as a job alert, its full text is then fetched and passed to an AI model to pull the roles out of it. That text is read in flight and never written to the database. What is kept is the roles it produced, plus the sender, subject and preview above.

Because of all this, a mailbox you use only for your job search is a better thing to connect than your main personal one. You can disconnect at any time on the Mailbox tab, which removes the stored connection and its encrypted secret.

Why we hold it, and on what lawful basis

  • To perform our contract with you. Your account, your CV and profile, your criteria, the jobs and scores, your applications and generated documents, and your billing records. This is the data without which the service you signed up for cannot run at all.
  • Your consent. Access to your mailbox, and everything derived from it. Nothing happens until you connect one, and disconnecting withdraws that consent for the future. Withdrawing it does not make what was done while it was in place unlawful.
  • Our legitimate interests. Keeping the service secure and available, preventing abuse of the referral scheme, keeping the audit trail, diagnosing faults, and reading and answering a message you send through the contact form. We have weighed this against your interests; it covers no advertising and no profiling for marketing.
  • Our legal obligations. Keeping records of payments for tax and accounting.

We do not sell your data and we do not share it for advertising. We make no automated decision about you that produces a legal or similarly significant effect: a fit score is a suggestion shown to you, not a decision made about you, and no employer ever sees one.

Who else sees it

This is the whole list. Each one gets only what its job needs.

  • Anthropic. The AI provider behind the four AI tasks — reading a CV or job page into structured detail, scoring a role against your profile, working out what an incoming email means, and drafting your CV and cover letter — whenever that work runs on Rolehound's own key. Scoring and drafting send your profile and the role; classification sends the sender, subject and preview of a message plus the company and job title of your open applications; extraction sends the CV or job text being read. On Rolehound's own key this is the only AI provider ever used, and that is a property of the code rather than a setting somebody could change.
  • OpenAI, or Google. Only if you add your own OpenAI or Google Gemini key on the Billing page. Everything described above then goes to that provider instead, under the account and terms you hold with them directly, and Rolehound meters none of it.
  • Stripe. Payments. Stripe receives your card details directly, on its own checkout page, and tells us only the outcome.
  • Adzuna. The job-board aggregator Rolehound searches for you. It receives a search term, and where you have set them a salary minimum and a distance in kilometres. It does not receive your CV, your postcode, your coordinates or anything identifying you.
  • postcodes.io. Turns your home postcode into coordinates. It receives the postcode, and nothing else.
  • OpenRouteService. Estimates commute time. It receives the coordinates of your home and of a job, and nothing that identifies you.
  • The operator's email provider. Sends you transactional email — confirming your address, resetting your password, and a sign-in code if you have turned on the emailed-code option for two-factor authentication. It receives your email address and the contents of that message. It is never used to send anything from your own address.
  • Your own mail provider. The mailbox you connect is yours, on a server you name; Rolehound connects to it over an encrypted connection using the credentials you supplied.
  • The hosting provider for the server the service runs on, which holds the database as part of holding the machine.

The careers boards on the company watchlist are read once for everyone who follows them, rather than once per follower, so following a company tells that company nothing about you.

Some of these providers operate outside the United Kingdom. Where they do, the transfer relies on the safeguards in that provider's own data-processing terms.

Where it is stored, and for how long

Everything sits in a single PostgreSQL database on the server the service runs on, which is hosted by DigitalOcean in London (region lon1). Backups of that database are taken automatically each time the service is updated, kept on the same server for up to 30 days and cleared out on a later update once they are that old; they are used only to restore the service if something goes wrong. There is no third-party analytics store, because these pages load no analytics or advertising scripts at all.

There is no automatic deletion routine in Rolehound. Data stays on your account until you ask for it to be removed, or until the service closes. That is a plain description of the code as it stands rather than a retention policy, and Rolehound does not yet publish a fixed retention period. Records of payments have to be kept for as long as tax law requires, regardless of any other request.

How it is protected

Every row we hold carries the id of the account that owns it, and the filter enforcing that is applied in the data layer rather than in each screen. It fails closed: with no signed-in account resolved behind a query, it matches no rows at all rather than every row. Passwords are stored only as hashes. Traffic runs over HTTPS. Sign-in, registration, password reset and two-factor attempts are rate limited.

Your mailbox secret and your AI provider key are encrypted before they are stored. Be clear about what that is worth, because the honest answer is narrower than the word suggests: the key that unwraps them is held in the same database as the ciphertext it protects, and that key is itself only wrapped with a certificate where the operator has configured one. Encryption here puts those secrets out of reach of anything that can see one row without reading the whole database — a stray log line, a partial backup, a bug in the application. It does not put them out of reach of whoever runs the server. Nothing does: an operator can read their own database, and that is true of every hosted service you have ever used.

Rolehound has been through no external security audit and holds no security certification. The security and privacy page describes the mechanics in more detail.

Payments and card details

Card details never reach Rolehound. Paying takes you to a page hosted by Stripe; you enter your card there, on Stripe's page, and we are told only the outcome. What comes back and is stored is a customer reference, a payment or invoice reference, an amount, a currency and a date. There is no card number, expiry date or security code anywhere in the database, because none is ever sent to it.

Cookies

Rolehound sets only the cookies it needs to keep you signed in. There are no analytics, advertising or third-party tracking cookies, which is why you have not been asked to consent to any. The cookie policy names each one.

Your rights

Under UK data protection law you have the right to:

  • ask what we hold about you and get a copy of it (access);
  • have anything inaccurate corrected (rectification) — much of which you can do yourself on the Profile, Mailbox and Search tabs;
  • have your data deleted (erasure);
  • receive your data in a portable form, or have it sent on to somebody else (portability);
  • object to processing we do on the basis of legitimate interests, and ask us to restrict processing while a dispute is settled;
  • withdraw consent for mailbox access at any time, which you can do yourself by disconnecting the mailbox on the Mailbox tab.

Erasure and export are handled by request, not by a button. There is no delete-my-account feature in Rolehound today and no export endpoint; describing one here would be inventing it. Ask through the contact page, or by email to support@rolehound.co.uk, and it is done by hand and confirmed to you when it is done. We will respond within the time the law allows.

In the meantime you can clear the most sensitive parts yourself: disconnecting your mailbox on the Mailbox tab removes the stored connection and its encrypted secret, and clearing your provider key on the Billing page removes that.

Complaints

If you are unhappy with how your data has been handled, tell us first, through the contact page or by email to support@rolehound.co.uk. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk.

Changes to this policy

We may update this policy as the product changes. The current version always lives at this address, and where a change materially affects you we will email the address on your account.

Contact

Kyrby Limited, a company registered in England and Wales (company number 10063736), 9 Bonhill Street, London, England, EC2A 4DJ, or support@rolehound.co.uk. For anything in this policy, use the contact page.