Rolebird Privacy Policy

Effective 8 August 2026.

This privacy policy explains how Rolebird Limited (a New Zealand company, company number 9447842), trading as Rolebird (“we”, “us”), handles personal information. It applies to all personal information we collect through our website, our browser extension, and our services. Rolebird is offered in New Zealand, and we handle your information under the Privacy Act 2020.

We may update this policy from time to time as the service changes. We will update the effective date above whenever we do, and we will tell you by email if a change is significant. Continuing to use Rolebird after an update takes effect means you accept the updated policy.

What personal information we collect

• Your email address - for your account. There is no password, because we sign you in with a one-time emailed link. That means we hold no credentials for you at all: nothing to guess, nothing to reuse from another site’s breach, and nothing for a breach of ours to leak. The emails we send are the ones the product needs: sign-in links, the inactivity warnings described below, and replies to messages you send us. Product updates (new guides, research, features) go only to people who tick the box on their account page - it starts unticked, and unticking it stops them.
• Your CV and base cover letter, as you uploaded them after removing your personal details (see below). Encrypted at rest.
• The job listings you explicitly captured, one at a time - by clicking in the extension, or by pasting a listing into the manual entry form yourself. Each is stored against your account only; we never pool listings into a shared database.
• What we generated for you - the tailored cover letters, lists of suggested CV changes, ATS-style screening (a match score and which of the listing’s requirements your CV does and does not evidence), and strategy notes.
• Your run balance and what it was spent on - how many credits you hold, and a dated line for each purchase, generation, revision and refund, so the balance can always be explained. Plus a reference that links you to your payment record at Stripe. We hold nothing about your card at all - not the number, not the last four digits, and no fingerprint or other derived value. Card details sit with Stripe; we never see them.
• A small amount of account and usage information - when you signed up, when you were last active, how many jobs you’ve captured, and a record that you agreed to this notice (and which version). We keep counts and dates only, never the personal details you removed.

Like any website, our hosting provider and Cloudflare briefly process your IP address in security and access logs to keep the service running and safe. We don’t store it against your account or use it to identify you.

What we don’t collect

• Your name - you remove it before uploading and we never ask for it anywhere. One honest limit: the upload check flags a likely name as a warning rather than refusing outright, so if you choose to keep one after review, it will be in the stored text. That final call is yours, which is why the review step matters. It can also appear inside the email address you choose.
• Your location - no tracking, no geolocation.
• Government and financial identifiers - IRD number, NHI number, passport number, bank account number. The upload check refuses documents that still contain them.

Rolebird is not intended for anyone under 18. We do not knowingly collect information from people under that age.

Before you upload your CV and base cover letter

Before you upload, remove your personal details from your CV and cover letter.

Delete your name, email address, phone number, home address, date of birth, IRD number, and any links to profiles that identify you (LinkedIn, GitHub). Remove your referees' names and contact details too - those belong to them, not you.

Keep what describes your work - job titles, dates, achievements, skills, and qualifications. That is what we tailor against. Generalise your employers, though: replace each company name with a short description and keep the dates, so "Xero, 2019–2022" becomes something like "a NZ fintech, 2019–2022". The time you spent somewhere helps us tailor; the exact name is not needed and could identify you.

Rolebird reads your files in your browser and checks them for personal details before anything is sent - the original file never leaves your device, only the text does, after your removals and this check. The check is not a guarantee: some identifiers it refuses outright, but others - what looks like a name, a referee's details, a social media handle, a driver licence number - it can only warn you about, and if you accept the warning the text is sent as it stands. It cannot detect company names, and it cannot reliably catch exact dates. So review the result and remove or generalise anything that could identify you - the review step has a one-click tool for exactly this. You are responsible for what you upload. Rolebird does not need to know who you are to do its job.

Where your documents go: to write your letters, Rolebird sends the text of your CV and cover letter - after your removals and this check - to Anthropic, an AI company in the United States, which processes it on our behalf. This means your information leaves New Zealand. Anthropic holds a copy for up to 30 days to monitor for misuse, then deletes it - apart from anything their safety systems flag, or that the law requires them to keep, which may be held for up to two years. They do not use it to train their models. If you are not comfortable with that, do not upload, because there is no version of this product that works without it.

How we collect your personal information

We collect your personal information directly from you, such as when you set up an account, contact us via email, use our website or access our service.

The purposes for which we use your personal information

We may use personal information collected from you to:

• Provide the service
• Set up and manage your account
• Communicate with you by email
• Get feedback and improve our service
• Comply with our legal obligations or enforce our legal rights
• Promote our service to you (where you have consented to receive marketing communications)
• Aggregate and anonymise your personal information - so that it can no longer identify you (so that it is no longer personal information under the Privacy Act 2020) - and use the resulting statistical and de-identified information to analyse, improve, market and promote our business and services
• For any other purposes for which you have provided written consent
• As permitted or required by law

Who we disclose your personal information to and why

We are not the only ones who touch your data. A small number of overseas providers act on our behalf to process your personal information for the purposes specified above:

• Anthropic (United States) writes your letters and generates interview questions - see below.
• Stripe (United States) handles payment, so your email and billing details reach it too.
• Resend (United States) sends our email - your sign-in links, and any reply to a message you send us - so it handles your email address.
• Migadu (Switzerland) runs our inbox, so anything you email to us, and the address you send it from, is held there.
• Google Cloud (United States) provides the interviewer’s voice for interview practice, so once that feature generates questions from your CV, the text of those questions reaches it.
• Hugging Face (United States) hosts the speech-model file your browser downloads for voice interview practice; it sees the download request and your IP address, but never your voice or your CV.

Our site is also served through Cloudflare’s network, so your requests pass through it in transit, and we use Cloudflare’s Turnstile anti-bot check on our public forms. We use these for delivery and security, not to profile you.

Your personal information is processed overseas

As stated above, some of your personal information is transferred to and processed by our providers outside New Zealand, principally in the United States. Before we disclose your information to a provider overseas, we satisfy ourselves on reasonable grounds that the provider is required, under its agreement with us, to protect your information in a way that, overall, provides comparable safeguards to those in the Privacy Act 2020.

Interview practice

If you use our interview practice feature, the interviewer’s questions are planned from the text of your CV and the job you are preparing for - so that text is sent to Anthropic on the same terms described above.

In voice mode, your spoken answers are transcribed on your own device. The audio is never uploaded and never stored - only the resulting text is submitted, exactly like a typed answer. Voice mode needs a one-time speech-model download into your browser; that file is served by Hugging Face, which sees the download request and your IP address but never your voice or your CV. The interviewer’s spoken questions are generated from the session’s own text by Google Cloud’s text-to-speech service; nothing you say is ever turned into audio.

Session transcripts and debriefs are stored encrypted, belong to your account, appear in full in your data export, and are deleted when your account is. Your audio is never among them as it never left your device.

What we never do

• Read or store any page you did not explicitly click to capture.
• Browse job boards on your behalf, or fetch anything on a schedule.
• Submit an application for you.
• Sell, share, or publish your documents.

Cookies

We use three first-party cookies, all functional. The first keeps you signed in after you log in - the site needs it to work. The second exists for about ten minutes when you click an emailed sign-in link: it binds that link’s confirmation page to your own browser so nobody else can complete your sign-in, then expires. The third exists only if you arrive through a friend’s referral link: it remembers their referral code for up to 30 days so they get credit if you sign up, and it is deleted the moment you do. None of the three is a tracking or advertising cookie, and none follows you around the web.

For traffic, we use Cloudflare Web Analytics. It is cookieless and counts visits in aggregate: it does not use tracking cookies, does not identify you, and does not follow you across other websites. No advertising, and nothing to opt out of.

How long we keep it

Until you delete it, or until your account has been inactive for 12 months - whichever comes first. Inactivity deletion is not a trapdoor: we email you a warning a month before, another two weeks before, and signing in once at any point cancels it entirely. If it does go ahead, we confirm by email on the day, and the account and everything in it - profile, documents, captured jobs, notes - is gone.

One lawful exception, and only one. If you have paid us, we keep a minimal, pseudonymised record of that transaction - the amount, the date, the currency, and the Stripe payment reference - because a business is required to keep records of its sales for tax purposes. It holds no name, no contact details, no documents, nothing you removed before uploading. To be precise about its limits: our own systems can no longer connect it to you once your account is gone, but the Stripe payment reference still points at Stripe’s record of the payment, which Stripe retains under its own privacy policy for its own legal obligations. Everything else about you is deleted as described above.

Unused credits expire with the account, so both warning emails tell you exactly how many you have. Signing in once keeps them, along with everything else - that is how you hold on to a balance you have not used.

One narrower rule, for captured jobs specifically. Saving a listing is free and doesn’t need a balance, so we clear listings nobody ever did anything with: after six months we delete a captured job only if all of these are true - nothing was ever generated for it, you never wrote a note on it, you never moved it past “Interest” or marked it applied, and no AI run was ever started on it. Anything you generated, annotated, or moved along is kept for as long as your account is, and you can export the personal information we hold about you at any time from your account page before it happens. Your shortlist also holds up to 200 saved jobs at once; you can delete any of them yourself whenever you like.

One honest caveat: deleted data can persist in our encrypted backups for up to three months before those age out. The backups exist so a disk failure cannot destroy everyone’s data; their keys are held offline, and nothing restores from them in normal operation.

Your data is yours

You can export the personal information we hold about you, delete all of it, or delete your account entirely, at any time from your account page (sign in first). Deletion from the live service is immediate; residual copies in our encrypted backups age out within three months, as described above.

You also have the right, under the Privacy Act 2020, to ask for access to the personal information we hold about you and to ask us to correct it - email [email protected] and we will respond within the period the Act requires.

Keeping it safe

Your CV and cover-letter text, your notes and your revision instructions are encrypted before they are stored, and your uploaded documents are separately encrypted. The primary copy of everything we hold is stored in New Zealand, and access is limited to what is needed to run the service. No system is ever completely secure - but because you strip your identifying details before uploading, there is far less at stake if something ever did go wrong.

If something goes wrong

If we ever have a privacy breach that could cause you serious harm, we will notify you and the Office of the Privacy Commissioner, as the Privacy Act 2020 requires.

If you have any privacy questions, requests, or complaints, contact our privacy contact at [email protected]. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner. They take complaints through an online form (they no longer accept them by email), or you can call them on 0800 803 909.