Legal

Privacy Policy

Last updated: 2 August 2026

This policy explains what personal data RoleForth collects, why we use it, and the choices you have. It applies to the RoleForth web application and related marketing pages.

Who we are

RoleForth (“we”, “us”) is a career operating system that helps you organise recruiters, applications, tasks, and related job-search activity. The service is provided at roleforth.co.uk.

For privacy questions or requests, email info@roleforth.co.uk, or use the in-app Feedback form when signed in.

Data we collect

Account and profile

Name, email address, and password (stored as a secure hash) when you register
Optional sign-in details if you use Google or Microsoft
Job-search profile information you enter (target roles, locations, skills, pitch, salary preferences, LinkedIn URL, and similar fields)

Job-search content you create

Recruiters, agencies, companies, jobs, tasks, calendar items, and interaction history
CV files you upload, plus extracted text we store to power search and AI features
Email templates and branding images you configure
Feedback messages you send to us

Mailbox connection (optional)

If you connect your own mailbox, we store IMAP/SMTP settings and an encrypted app password so RoleForth can import recruiter replies into your review queue and send mail you explicitly choose to send. We do not use your mailbox to send messages without your action in the product.

Technical and usage data

Authentication session cookies needed to keep you signed in
Basic server logs (for example IP address, timestamps, and error diagnostics) used to run and secure the service
Token balance, purchases, and AI usage history tied to your account
If you consent to analytics cookies: usage events and related device/browser data processed by Google Analytics 4 and (on public pages only) Microsoft Clarity, as described below

How we use your data

To provide and improve the RoleForth product (CRM, tasks, dashboard, calendar, CVs, email features)
To authenticate you and protect your account
To process token purchases and show billing-related history when payments are enabled
To generate AI-assisted content you request (for example intro drafts, CV review, application prep, upskill plans)
To send essential system emails when configured (for example welcome, password reset, purchase confirmation)
To respond to feedback you submit
With your consent, to measure traffic and product usage (GA4) and to understand public-page usability via heatmaps/session insights (Clarity)

We do not sell your personal data. We do not use your CV or CRM content for advertising.

Legal bases

Where UK GDPR applies, we rely on:

Contract — to provide the RoleForth account and features you request
Legitimate interests — to secure and operate the service (for example essential logs), balanced against your rights
Consent — for non-essential analytics cookies (GA4 and Clarity), which you can refuse or withdraw at any time
Legal obligation — where we must keep or disclose information by law

AI processing

Some features send relevant snippets of your profile, CV text, or job/recruiter context to an AI provider (currently OpenAI when configured) to generate a response for you. Those calls are made only when you use an AI feature (or when the product runs a background catalog task that does not include your private CRM data). Failed AI calls are not charged against your token balance.

Who we share data with

We use processors only as needed to operate RoleForth, for example:

Hosting and database providers — to store and serve the application
OpenAI — when you use AI features and a live API key is configured
Stripe — when you buy token packs (card details are handled by Stripe, not stored by RoleForth)
Google / Microsoft — if you choose their sign-in, subject to their terms
Google Places — if you use company map search, subject to Google’s terms for that API
Google Analytics — if you consent to analytics cookies, to measure site and product usage (see Google’s Privacy Policy)
Microsoft Clarity — if you consent to analytics cookies, on public/marketing pages only, for heatmaps and session insights (see Microsoft’s Privacy Statement)

Google and Microsoft may process analytics data outside the UK/EEA. Where they do, they rely on appropriate transfer mechanisms in their terms (such as standard contractual clauses) where required.

We may also disclose information if required by law or to protect the service and users.

Cookies and similar technology

RoleForth uses essential cookies and local session storage to keep you signed in and operate the app. These are necessary for the service and are not used for advertising.

Non-essential analytics cookies load only after you choose Accept analytics (or enable analytics in Manage preferences). You can reject analytics with equal ease, and change your mind later via Cookie preferences in the site footer, or by clearing site data for roleforth.co.uk.

Essential

Authentication / session cookies — keep you signed in and protect account actions (set by RoleForth; duration follows your session / remember-me settings)
Cookie preference (roleforth-cookie-consent in local storage) — remembers your analytics choice
Theme / UI preferences (local storage) — for example light/dark theme in the app

Analytics (consent required)

Google Analytics 4 — page views and product events (for example feature usage) to understand traffic and improve RoleForth. Google may set cookies such as _ga / _ga_*. GA4 is configured not to use advertising storage in our Consent Mode defaults. Google briefly processes IP addresses as part of collecting analytics and applies its own IP anonymisation practices for GA4; we do not use analytics for ads personalisation.
Microsoft Clarity — heatmaps and session recordings on public/marketing pages only (not on authenticated CRM, CV, or inbox screens). Microsoft may set cookies such as _clck / _clsk. We enable strict masking where supported so form inputs are less likely to appear in recordings.

Analytics retention follows the retention settings we configure in the Google Analytics and Microsoft Clarity admin consoles (typically measured in months, not indefinite product storage of your CRM data).

Legal basis for analytics cookies: consent (UK PECR and UK GDPR). Withdrawing consent does not affect the lawfulness of processing before withdrawal.

How long we keep data

We keep your account and job-search data while your account is active. Token lots expire according to the published token rules. Server logs are retained only as long as needed for security and operations. Analytics data retained by Google or Microsoft follows their product retention settings described above. When you delete your account, we remove your account data and associated CRM content from the live system, subject to short-term backups and any legal retention requirements.

Your rights

Depending on where you live (including under UK GDPR), you may have rights to access, correct, delete, or restrict use of your personal data, and to object to certain processing. You can update much of your information in the app, download or replace CVs you uploaded, and delete your account from Account settings.

You may withdraw analytics cookie consent at any time using Cookie preferences in the footer.

To make a privacy request, email info@roleforth.co.uk or use Feedback. You may also complain to the UK Information Commissioner’s Office (ICO) if you believe our processing breaches UK data protection law.

Security

We use industry-standard measures appropriate to a web application, including hashed passwords, encrypted mailbox credentials at rest, HTTPS in production, and access controls that separate customer data by account. No method of transmission or storage is perfectly secure; please use a strong unique password and protect your sign-in.

Children

RoleForth is intended for adults seeking employment. It is not directed at children under 16.

Changes

We may update this policy from time to time. The “Last updated” date at the top will change when we do. If we make material changes to how we use personal data or cookies, we will take additional steps where appropriate (for example updating this page and, for analytics cookies, asking for consent again when our consent version changes).