Privacy Policy

1. Who we are

RoleFrame (“we”, “us”) runs the website at theroleframe.com. We decide how and why your personal data is used, which makes us the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023. You can reach us through our Facebook page.

2. What we collect

When you sign in with Google. Your name, email address, profile picture and Google account ID. Google also gives us sign-in tokens, which we store so you stay signed in. We never see or store your Google password.

Your resume. The file you upload, the text we read from it, and the details we pick out of that text: things like your skills, job history, education and location, and any contact details the resume itself contains. If you add a short note about what you are looking for, we keep that too. We also turn your resume into numbers (called “embeddings”) that let us compare it with jobs.

Enhanced resumes. If you enhance your resume for a job, or edit it in the resume editor, we keep each version: the AI’s rewording, your own edits, and a count of the enhancements you have made this month.

AI Apply, if you use it. The answers you save for application forms (such as your phone number, address, current and expected salary and notice period), your AI Apply settings, the jobs you apply to in your browser and where each one stands, which resume to attach to each, and how many of your applications were submitted this month. If you save personal details such as gender or date of birth, they are kept the same way and never sent to the AI service. In your browser they are filled only on a form where you approve it; with Auto apply on, RoleFrame fills them on the forms it applies to that ask for them, as you saved them. When you connect the RoleFrame browser extension, we store a code that lets it act for your account, kept only in scrambled form (a hash), and when it was last used.

Auto apply, if you turn it on. What you asked it for in your own words, the filters that became, your daily limit, and each job it picked, with where it stands and when it was applied.

Job-site accounts, if you allow them. Some employers’ application systems (such as Workday and SAP SuccessFactors) need an account on each company’s site. If you allow it in Settings, RoleFrame makes those accounts for you with your RoleFrame address (see below) and a strong password it generates. We keep each site, the email and the password, sealed with encryption (AES-256) under a key kept apart from the database. You can see each account, and its password, in Settings.

Your RoleFrame mailbox. RoleFrame gives you your own email address, and every application RoleFrame fills uses it, from our servers or through the extension in your browser, so employers’ codes and replies reach you without any setup. We keep every email sent to that address so you can read it in your Inbox on RoleFrame: who sent it, its subject and its text, sealed with encryption (AES-256) under a key kept apart from the database. We do not keep attachments, only their names. Each email is deleted automatically after 180 days, and you can delete any email sooner. We also read each email when it arrives to recognise what kind it is (for example a verification code, an interview invitation or a rejection), the company and the job site, so that we can show where each application stands and tell you the news. A verification code is kept apart for the application waiting for it for at most 30 minutes. We act on an email this way only when its sender’s domain proves it sent it.

Emails you send. You can send email from your RoleFrame address: replies to people who emailed it, and new emails to one person at a time. We send exactly what you write, with any files you attach (your resume on file, or documents you choose), and for a reply, the email you are answering quoted under it. We keep what you wrote, sealed the same way, so you can see it under Sent; a reply is deleted with the email it answers. We keep only the names of the files you attached, not the files. We send replies only to senders we could verify, and we limit how many emails you send a day.

What the extension sees. The extension works in your own browser, on the job application pages you open with it. It reads a form’s questions in order to fill them. It sends us only a short note on where each job stands (for example which fields it filled and which it left for you) and, when a form asks questions your saved answers do not cover, the text of those questions and their options. It does not send us anything else from the page. It never reads or types your own passwords. The only password it types is one RoleFrame made for a job-site account you allowed, and the only one-time code it types is one that came to your RoleFrame mailbox.

What you do on RoleFrame.

• The jobs we matched to you and how well each one fits.
• The job alerts you set up (the keywords and companies you watch) and which alerts we have already sent you, so you do not get the same one twice.
• When you press Apply on a job, the fact that you did. Other visitors see only a count for that job, never who pressed it.
• Time on site: how many seconds you actively use RoleFrame each day, as one daily total. We count a second only while the page is open in front of you and you have moved, typed, scrolled or tapped within the last minute. We do not record which pages you view, what you click or anything you type.

Telegram, if you connect it. Your Telegram chat ID and username, so we can send you messages there: job alerts, and news from Auto apply and your job emails.

Sign-in sessions. For each device you are signed in on, we store the IP address and the browser and device description (the “user agent”) it signed in with. This helps keep your account secure.

We do not use advertising trackers or third-party analytics, and we do not take payments, so we hold no card or bank details.

3. How we use it

• To sign you in and keep you signed in.
• To read your resume and match it against open jobs.
• To enhance your resume for a job when you ask, and to let you edit and download it.
• To fill the application forms you choose with AI Apply, and, if you turn on Auto mode, to submit the ones it filled completely, within the limits you set.
• If you turn on Auto apply, to apply for you from our own server to jobs that fit what you asked for, within your daily limit: filling each form with your resume and saved answers, and submitting it.
• If you allow it, to make and sign in to job-site accounts for those applications; and if you connect your job emails, to use the verification codes employers send and to tell you what they say about your applications.
• To send you the job alerts and messages you asked for, by Telegram if you connected it.
• To show how many people pressed Apply on a job, as a number only.
• To understand, in total, how RoleFrame is used (how many people sign up, come back, and how long they stay) so we can improve it.
• To keep the service secure and to fix problems.

We process your data on the basis of your consent, which you give by signing in and choosing to upload a resume, use AI Apply, turn on Auto apply, allow job-site accounts, connect your job emails or connect Telegram. You can withdraw it at any time by deleting your account (see Your rights).

4. Who we share it with

We never sell your data and never show your resume to employers or recruiters on our own. RoleFrame has no employer side.

When you apply. Applying always happens on the employer’s own website. If you use AI Apply, the extension types your details and attaches your resume (or the version enhanced for that job) into that employer’s form in your browser. The employer receives them only when the form is submitted: by you, or by RoleFrame if you turned on Auto mode. With Auto apply, RoleFrame’s own browser on our server does the same on the employer’s site and submits the form for you. From then on the employer, and the hiring system it uses, handle your application under their own terms and privacy policy.

We use a small number of services to run RoleFrame, and each receives only what it needs:

• Google, to sign you in.
• OpenRouter, the AI service that reads your resume. We send it the text of your resume so an AI model can pick out your details and create the embeddings we use for matching. If your resume is a scanned image with no text in it, we send the file itself, and a Google Gemini model reached through OpenRouter turns it into text. When you ask us to enhance your resume for a job, we send it the job’s description and the details from your resume, and an AI model rewords them for that job. When a form asks AI Apply questions your saved answers do not cover, we send it those questions, the job’s description, the details from your resume and your saved answers (never personal details such as gender or date of birth), and an AI model suggests answers from them. OpenRouter passes requests to the companies that run those models. These providers handle the data under their own terms and privacy policies.
• Telegram, only if you connect it, to deliver your alerts and messages.
• Resend, only when you send an email from your RoleFrame address, to deliver it: your name and address, the recipient, and what the email contains.
• Contabo, the company whose server in Mumbai, India hosts RoleFrame and its database.
• Cloudflare, which stores our nightly database backups. Each backup is encrypted on our server before it is sent, so Cloudflare holds only files it cannot read.
• Company logos. Logos on job listings load from Google’s logo service or from the company’s own website, so your browser contacts them to fetch the image. They see your IP address when it does, as with any image on the web. No other information is sent.

We may also disclose information if Indian law requires it, for example in response to a valid order from a court or government authority.

5. Cookies

We use only the cookies RoleFrame needs to work, and no advertising or tracking cookies:

• Sign-in cookie (better-auth.session_token): keeps you signed in. It lasts up to 30 days and is renewed while you keep using the site.
• Skip cookie (onboarding_skip): remembers that you chose “skip for now” on the resume step, for 7 days, so we do not ask again on every visit.

6. Where it is stored and for how long

Your data is stored in our database on a server in Mumbai, India. Data sent to OpenRouter and the model providers behind it may be processed in other countries, and our encrypted backups are stored with Cloudflare, which may keep them outside India.

• Your account and everything linked to it are kept until you delete your account.
• Your resume is replaced when you upload a new one. We keep only the latest.
• Sign-in sessions expire 30 days after you last use them.
• Emails in your RoleFrame mailbox are deleted 180 days after they arrive, or sooner when you delete them. Verification codes taken from them are erased 30 minutes after they arrive.
• Backups. Every night we save an encrypted copy of the database, so it can be recovered if something goes wrong. We keep the last 7, and the oldest is deleted each night.

When you delete your account, we delete it and everything linked to it from our database straight away. It then disappears from our backups within 7 days, as the backups made before the deletion are replaced. Small amounts of information may also remain in our server logs for a short time until those logs are overwritten. We cannot delete copies that OpenRouter or the model providers keep under their own policies.

7. Your rights and choices

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Delete your data. Go to Settings and choose “Delete account”. This removes your account, resume, enhanced resumes, saved application answers, the jobs you apply to, Auto apply settings and history, job-site accounts, your job-email address, matches, alerts, Telegram connection and activity history immediately, and from our backups within 7 days. Accounts RoleFrame made for you on employers’ sites stay on those sites: before deleting your account, you can sign in there with the email and password shown in Settings and close them.
• Withdraw consent at any time, which you do by deleting your account. You can also turn off Auto apply, stop allowing job-site accounts, disconnect your job emails or disconnect Telegram without deleting anything else.
• Get a summary of the personal data we hold about you and who we have shared it with.
• Correct or update your data. Uploading a new resume replaces the old one.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Have your complaints handled, as described below.

For anything you cannot do yourself in Settings, send us a private message on our Facebook page, rather than commenting on a public post. Before acting on a request we may ask you to show that you control the Google account you sign in with. We will reply within 30 days.

8. Security

Everything between your browser and RoleFrame is encrypted with HTTPS. Our database cannot be reached from the internet, only by RoleFrame itself on the same server, and access to the server is limited to its administrator. You sign in through Google, so we never hold your sign-in password. The only passwords we keep are the ones RoleFrame generates for job-site accounts you allowed, sealed with AES-256 encryption under a key kept apart from the database. No system is perfectly secure, but if a breach affects your data we will tell you and the Data Protection Board of India as the law requires.

9. Age limit

RoleFrame is for people aged 18 and over. Please do not use it if you are under 18. If we learn that someone under 18 has an account, we will delete it.

10. Changes to this policy

If we change how we handle your data, we will update this page and the date at the top. If the change is significant, we will also point it out on the site before it takes effect.

11. Contact and complaints

For questions, requests or complaints about your data, send us a private message on our Facebook page. We will respond within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.