Privacy notice

Who is responsible

RolePocket is a ByNeo! service, operated from Ireland. Jordi Molina is the data controller responsible for how your personal data is used. Contact us about support or privacy at support@rolepocket.com.

This notice covers the RolePocket website, Chrome extension and RolePocket's side of connections to AI assistants, such as ChatGPT and Claude Cowork. RolePocket is intended for individual job seekers aged 18 or over.

What we collect and why

We receive information from you, Google sign-in, the pages you choose to capture, your authorized AI assistant requests and our payment provider. Job postings can also contain another person's name or contact details.

Account and preferences

Your RolePocket account ID and Google sign-in identifier, verified email, display name, profile image where supplied, sign-in tokens and session information, and your chosen time zone. We use these to sign you in, keep accounts separate and show your workspace. Our basis is performing our contract with you or taking steps you request before entering it.

Page capture you request

Page URLs and titles, visible text, compensation text, headings, metadata, structured job data, selected text and, when visible text is unavailable, an HTML fallback. We collect these to carry out your request to save a posting. The basis for processing your data is performing our contract with you. The separate basis for another person's details is explained below.

AI extraction

We send the captured material needed to an AI service to turn the posting into structured job details. This requested extraction uses the same contract basis for your data. The provider and its separate safety monitoring and account-data uses are explained in Providers and international transfers.

Saved workspace and AI suggestions

We store extracted jobs, your decisions, notes, activities, application history and reports to provide your workspace under our contract. When you request an assessment from a connected AI assistant, it receives the permitted job data and can return a recommendation and explanation. Our disclosure and saving of that requested result also use the contract basis. We do not use this as permission for unrelated profiling or advertising.

Documents

Files you upload, including CVs and application documents, plus filenames, file hashes and related metadata. We store and retrieve them for your workspace under our contract with you. Job capture does not send stored CVs to the AI extraction service. The current RolePocket tools for AI assistants do not download stored document files; career files you give directly to your AI assistant follow that provider's terms.

Billing

We send your verified email and account reference to Creem and receive customer, transaction and subscription identifiers, entitlement status and payment events. Creem collects payment information at checkout. We use billing data to provide paid access under our contract, meet applicable accounting duties and handle payment disputes. Those duties rely on legal obligations; preventing fraud and defending claims rely on our legitimate interests.

AI assistant connections

Connection/client identifiers, permissions, credentials, authorization and request records, and job data needed for permitted actions. We use these to deliver the connection you request under our contract and secure access in our legitimate interests. Approving a connection grants technical permission; it is not blanket consent for unrelated processing.

Support and privacy requests

Your email, message, attachments and information needed to verify and resolve the request. Service support relies on our contract; handling data-protection rights relies on our legal obligations. Resolving complaints and preserving necessary evidence rely on our legitimate interests in resolving disputes.

Security and operational records

IP addresses, request time, route, status and device/browser information, capture and delivery identifiers, errors, audit history and deletion recovery records. Error details can include submitted content. Our legitimate interests are protecting accounts, preventing abuse, completing deletion reliably and diagnosing failures; mandatory records also rely on applicable legal obligations.

Account identification is needed to provide a private workspace, captured content is needed for extraction, and billing details are needed for a paid subscription. You choose which jobs, notes and documents to add and whether to connect an AI assistant. If you do not provide information needed for a feature, we may be unable to provide that feature.

Please capture job postings and share only information needed for your search. Avoid unrelated private messages, identity documents or sensitive information such as health details in captures or support attachments.

AI and your decisions

Our AI extraction service turns captured pages into structured job details. Connected AI assistants may add assessments or suggestions. AI can make mistakes, so check the original posting and review suggestions. RolePocket does not make hiring decisions or submit applications for you, and does not use these suggestions to make decisions with legal or similarly significant effects on you.

People named in postings

A posting or a user's job-search notes may include a recruiter's name, work contact details or role. The source is the employer's or job board's posting, which may be public, or material the user supplies. We use only details needed to identify and organize that opportunity, rather than building contact lists or contacting people for marketing.

For these third-party details, our basis is the legitimate interests of RolePocket and its users in keeping an accurate private record of a job opportunity, subject to necessity and the person's rights. This is separate from our contract with the user. The capture, provider and retention sections apply to these details too.

If you are named, you can request access, correction, erasure or restriction, or object, at support@rolepocket.com. Please identify the posting URL or relevant context. We assess the request without revealing another user's private information.

Where individual information is required under Article 14 GDPR, we provide it within the applicable time limit. A public posting does not automatically remove that duty. Any exception must have a documented basis and safeguards; this public notice is not, by itself, a replacement for a required individual notice.

Sensitive information

RolePocket does not offer intentional processing of special-category or criminal-offense data. Omit or redact information revealing health or disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric identifiers used to identify someone, sex life or sexual orientation, and criminal convictions or offenses. This applies to captures, CVs, notes, support attachments and AI assistant workflows.

If we find sensitive information, we limit access and further use and remove or redact it where possible. Copies already sent to service providers may remain for the retention periods described in this notice.

If you accidentally share sensitive information and want help removing it, email support@rolepocket.com. Tell us which job, file or message is affected, without including the sensitive details again.

The service does not guarantee automatic detection or filtering of every sensitive detail. Please review the content before capturing, uploading or sharing it.

Chrome extension

When you choose a capture action, the extension reads the selected job page and may inspect its embedded frames to find a posting. It sends the page data listed above to RolePocket for AI extraction and storage in your workspace, using the providers described below. Selected text may accompany other page content; selecting text does not guarantee that only the selection is sent.

The extension requests access across websites because employers use many different sites and embedded job boards. It reads page content for a capture you request. It does not collect a continuous browsing history. Background retries can later upload the page you already chose and check its result.

Google identity and profile information are used for sign-in and account separation. Pending captures and recent results are stored on your device so a closed popup or interrupted connection does not lose progress. The local and server retention rules below are different.

Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The Google API Services User Data Policy also applies to our Google sign-in integration.

Extension data is used for the disclosed job-capture feature and its necessary operation and security. It is not sold, used for personalized advertising, transferred to data brokers or used to determine creditworthiness. Human reading of extension data is limited to your explicit agreement to read specific data for help, necessary security investigation, legal requirements, or aggregated and anonymized internal operations. Google's authorized safety review described below remains separate.

Providers and international transfers

• Google: sign-in, hosting, AI extraction and support email. Google processes account and application data to run the service, deliver background captures and keep operational records. The main application runs in Belgium; sign-in data is processed in the US. Google also handles support messages, including your email address, message and attachments. These services process data on our behalf; Google's own account and service purposes are governed separately by its terms. Our current AI extraction service is Google Gemini. Under its paid-service terms, prompts and responses are not used to improve Google's products. Google separately keeps prompts, context and output for abuse monitoring for 55 days, and authorized staff may review flagged content. See AI service terms and safety monitoring details.
• Supabase: workspace and file storage. Supabase stores account records, saved jobs, capture progress and documents and delivers workspace updates on our behalf. The primary database and file storage are in Ireland. Its infrastructure, support and other suppliers may operate elsewhere.
• Creem: checkout and payments. Creem acts as the seller for checkout, payment and invoicing (the "merchant of record"). It is independently responsible for personal data it uses for these purposes, fraud prevention and its accounting duties. RolePocket is separately responsible for the buyer data it receives to manage subscriptions. Creem may also process data on our instructions for separate services. See its privacy notice, data-sharing terms and data-processing terms.
• Your selected AI assistant provider, such as ChatGPT or Claude Cowork, receives the job information that its authorized actions access. Your career context and files supplied directly to that provider follow its own terms. Depending on your account and the purpose, it may use data under its own privacy rules or process it under an agreement with you or your organization. Its history, training settings and retention apply to its copies. Revoking a RolePocket connection stops its future access; it does not erase copies already received.

Service providers may use their own infrastructure and subprocessors, including network and content-delivery services. Primary hosting in Ireland and Belgium does not mean EU-only processing. Authentication, AI, logs, support and provider operations may involve the US and other countries.

Providers that handle personal data on our instructions must follow binding contract rules about how they use, protect and delete it. These rules are separate from the provider's own uses described above.

When data is sent outside the European Economic Area (EEA), it needs legal protections for that transfer. These can include European Commission-approved contract clauses that protect your rights, or a Commission decision recognizing adequate protection for the destination or covered recipient. The providers' terms include these contract clauses for covered transfers. You can read those terms and transfer protections in the links below.

We may disclose data where legally required or where necessary to investigate abuse or protect legal rights, subject to the extension's Limited Use restrictions. Workspace data is not supplied to employers as part of job capture.

How long we keep data

Temporary capture source on our server

Raw source is cleared after successful or terminal processing. Otherwise it becomes ineligible for retry after 24 hours and is cleared on status access or a scheduled cleanup. It can remain until cleanup runs; 24 hours is not a guaranteed removal deadline.

Server capture history

Capture status and result history becomes eligible for scheduled deletion after 30 days. Saved jobs and documents have their own lifecycle and are not removed by capture-history cleanup.

Extension copies

Local raw page data is discarded after server acceptance. Source older than 24 hours and records older than 30 days are cleared when the same signed-in account next synchronizes. The extension caches up to 30 recent results. Offline or signed-out copies can remain longer. Removing the extension clears its local storage; signing out alone does not delete all local capture records.

Workspace after subscription expiration

Paid workspace access ends at expiration, but account data is not immediately erased. We review inactive accounts monthly. After 11 months without an active subscription, we send an email notice with an opportunity to request an export. Deletion is no earlier than both 12 months without an active subscription and 30 days after the notice. Active billing, resubscription, an unresolved rights request or a failed notice pauses deletion for review. You can request access, export or deletion without resubscribing.

Deletion and recovery

Account deletion is a background process that removes workspace records, stored files and your RolePocket sign-in account. Pending work remains until it completes. Completed account recovery records keep an account identifier, receipt hash, timestamps and attempt information for 30 days; completed file-deletion records keep paths for 30 days to prevent immediate reuse. These records are then eligible for scheduled pruning.

Operational and provider records

Ordinary application logs are retained for 30 days and required audit logs for 400 days. Records used to deliver background captures can remain for up to 31 days; identifiers for deleted deliveries may remain for up to 24 hours to prevent duplicates. The AI service's 55-day abuse-monitoring retention is separate. Our sign-in provider keeps authentication IP logs for a few weeks, and removal of deleted sign-in data from its live and backup systems can take up to 180 days.

Routine support correspondence

We keep routine support messages for 12 months after the case closes, then remove them unless a documented legal obligation or dispute requires specified records for longer. The purpose is resolving the case and related follow-up.

Privacy requests and verification

We keep a minimal record of the request, verification outcome, response and closure for 3 years after closure to demonstrate how it was handled. Verification attachments are removed within 30 days after verification. We keep no identity-document copy by default and do not retain a full export merely as proof of delivery.

Necessary accounting and billing evidence

Irish tax-supporting records are retained for the applicable statutory period, generally 6 years. We retain only transaction and accounting evidence needed for those duties, rather than keeping the full workspace for tax purposes. A documented legal requirement or unresolved dispute may extend specific records, with a review date. Creem independently describes contractual data retention of 3.5 years, accounting data of 7 years and due-diligence data of 5 years in its notice.

Copies held by providers and on your devices

Deleting your RolePocket workspace does not automatically remove provider recovery copies, logs, billing records, support emails, copies held by AI assistants or offline device data. The separate retention periods and deletion limits described in this notice apply to those copies.

Deletion is not an immediate removal of every copy everywhere. Any information retained for a legal obligation or a specific dispute must remain limited to that purpose. We will update this notice if retention arrangements change.

Storage on your device and security

RolePocket and our sign-in provider use browser storage to keep you signed in. The website also stores a temporary sign-up/purchase choice and a deletion receipt so you can return to check progress. The extension stores sign-in state, pending captures and recent results locally. You can remove local copies through your browser's site-data controls or by removing the extension, but clearing local data does not delete your server workspace.

We do not use advertising or marketing analytics integrations. Network providers and sign-in services still receive technical request information. We use HTTPS, account-based access controls and restricted server credentials to protect data. No service can guarantee that every incident or unauthorized access will be prevented.

Your rights and choices

Depending on the circumstances, you can request access, correction, erasure, restriction or a portable copy of your personal data. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Connecting an AI assistant is your choice and you can revoke its access.

Email support@rolepocket.com with your account email and the request. This route is available without payment or an active subscription. Please do not send passwords, access tokens or identity documents with your initial request. We may ask for proportionate information to verify you before disclosing or changing account data.

We normally respond within one month. If a lawful extension is needed because of complexity or the number of requests, we will explain it within that month. Rights requests are normally free. If a right is limited by law, we will explain the reason and available complaint route.

You can complain to Ireland's Data Protection Commission, or the relevant supervisory authority where you live, work or believe a breach occurred. You can contact us first if you would like help resolving a concern.

Changes to this notice

We will update the date at the top when this notice changes. We keep the provider information current and give appropriate notice of material changes to how we handle your data.