Effective Date: July 18, 2026 Last Updated: July 18, 2026

1. Overview and Scope

This Privacy Policy describes how Rafalski Enterprises LLC ("Rafador AI," "Rafador," "we," "us," or "our") collects, uses, discloses, sells, shares, and protects personal information when you use the Rafador AI websites, applications, and services (the "Service"), and the rights and choices available to you. It applies to users of the Service in the United States. The Service is intended for individuals 18 or older.

Rafador is a service that uses artificial intelligence to complete and submit job applications on your behalf. That purpose shapes everything in this Policy: most of the information we collect exists so the Service can apply to jobs as you.

2. Information We Collect

2.1 Information You Provide

• Account and contact information: name, email address, password, phone number, and postal address.

• Profile and career information: résumés and cover letters and their contents (work history, employers, dates, education, certifications, skills), job preferences, target roles, locations, and salary expectations.

• Standing application answers: your saved answers to common application questions, such as work-authorization status, sponsorship needs, willingness to relocate, notice periods, and similar.

• Voluntary self-identification information: if you choose to provide it for equal-opportunity questions, this may include race or ethnicity, gender, veteran status, and disability status. This is sensitive personal information, handled as described in Section 3, and you are never required to provide it.

• Communications: messages you send us, support requests, and feedback.

• Payment information: payments are processed by our payment processor (currently Stripe). We receive limited transaction information (such as plan, amount, and card brand/last four digits) but do not receive or store your full card number.

2.2 Information Collected Automatically

• Usage and device information: IP address, browser and device type, operating system, pages viewed, features used, timestamps, and similar log data.

• Cookies and similar technologies: as described in Section 8.

2.3 Information Generated or Received by the Service

• Application activity: the jobs found and evaluated for you, match scores, the applications completed, submitted, or skipped, and the résumés, cover letters, and written answers generated for each application.

• Third-party information: job postings and related data from job platforms; confirmations or communications relating to your applications; and information from service providers such as analytics and security vendors.

3. Sensitive Personal Information

"Sensitive personal information" means information such as racial or ethnic origin, disability or health information, religious beliefs, sexual orientation, citizenship or immigration status, and similar categories given heightened protection under state privacy laws. In our Service this arises mainly from voluntary equal-opportunity self-identification answers and from anything similar you include in your materials.

• We collect it only if you choose to provide it, and we ask for your consent before using it to answer equal-opportunity questions on applications.

• We use it only to complete your applications and for no other purpose. We do not use it for advertising, and we do not use it to train AI models.

• We do not sell or share sensitive personal information, and we do not use or disclose it for purposes beyond those permitted by applicable law without your consent.

4. How We Use Personal Information

• To provide the Service: find and evaluate job postings, complete and submit applications as your authorized agent, generate tailored résumés, cover letters, and written answers, verify completeness before submission, and maintain your application history and saved documents.

• To operate your account: authentication, billing and renewals, customer support, and service communications about your account and applications.

• To improve the Service and train our AI: we use information about how the Service is used, and user content, to improve the Service and to develop and train the AI systems and models used to provide and improve it, as disclosed at signup. Sensitive personal information is excluded from AI training.

• For safety, security, and legal purposes: fraud and abuse prevention, security monitoring, enforcing our Terms, and complying with law and legal process.

• For marketing: to send you marketing about the Service, which you can opt out of at any time.

5. Automated Processing

The Service is automated by design: AI evaluates job postings against your profile and completes and submits applications on your behalf under the authorization in our Terms of Service. AI can make mistakes, and submitted applications cannot be recalled. The Service does not make decisions about you that produce legal or similarly significant effects; hiring decisions are made by employers, not by Rafador. Where an application cannot be truthfully completed from your information, it is skipped rather than guessed at.

6. How We Disclose Personal Information (Service Operations)

• Employers and job platforms (the core of the Service): when the Service applies to a job for you, your application information - including your résumé, answers, and any consented self-identification information - is submitted to the relevant employer and/or the platform hosting the application. Employers and platforms are independent of Rafador and handle your information under their own privacy policies.

• Service providers: vendors that host our infrastructure, process payments (Stripe), provide AI model services used to power features, and provide analytics, communications, and security services, in each case under contracts limiting their use of your information to providing services to us. Our AI service providers are contractually restricted from using your content to train their own models.

• Legal and safety: to comply with law or legal process, to enforce our Terms, or to protect the rights, safety, or property of Rafador, our users, or others.

• Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, where your information may be transferred as part of the transaction, subject to this Policy or equivalent protections.

• With your direction or consent: other disclosures you request or agree to.

7. No Sale of Personal Data; Recruiter Visibility

We do not sell your personal data, and we do not share it with third parties for targeted advertising. The Service is funded by subscriptions, not by selling your information.

Recruiter visibility (a planned, opt-in feature). We may in the future offer a feature that lets you make a recruiter-facing profile visible to recruiters and employers searching for candidates, and recruiters may pay us for access to opted-in profiles. If we launch this feature: (a) visibility will be off by default and will apply only if you turn it on; (b) recruiters will see a profile generated from your information (such as skills, experience, education, and job preferences), not your raw résumé file; (c) your references and the contact information of anyone other than you will be excluded, and your sensitive personal information (Section 3) will never be included; and (d) you will be able to turn visibility off at any time, which removes your profile from recruiter access going forward. Because this disclosure happens only at your direction, it is a choice you control. We will notify you when the feature launches, and this Policy will be updated with its final details before it goes live.

Regardless of any feature or future change, we do not sell or share: sensitive personal information (Section 3); personal information of anyone we know to be under 18; information about individuals other than you that appears in your materials (such as references); or your full card number (which we never hold).

If we ever propose to sell personal data or to share it beyond what this Section describes, we will update this Policy, give you advance notice, obtain any consent the law requires, and put the legally required opt-out mechanisms in place first (such as a "Do Not Sell or Share My Personal Information" link and honoring Global Privacy Control signals) before any such activity begins.

8. Cookies and Analytics

We use cookies and similar technologies for sign-in and session management, preferences, security, and analytics. We do not use cookies to sell personal data or to share it for third-party targeted advertising. Your browser can limit or delete cookies; disabling some cookies may impair the Service.

9. Your Privacy Rights

Depending on your state, you may have the right to: know and access the personal information we hold about you (including, where required, in a portable format); correct inaccurate information; delete your information; opt out of any sale of personal data, sharing for targeted advertising, or certain profiling (as Section 7 explains, we do not sell or share your personal data); limit the use of sensitive personal information (we already limit it as described in Section 3); and not be discriminated against for exercising rights. You may also have the right to appeal a refusal.

To exercise rights: use your account settings or contact us at privacy@rafador.com. We will verify your request using information associated with your account (and may request additional verification), respond within the time required by law (generally 45 days, extendable where permitted), and permit an authorized agent to act for you where the law provides, subject to verification. If we deny a request, you may appeal by replying to our decision, and we will respond as the law requires; if the appeal is denied, you may contact your state attorney general.

Deleting your account deletes your profile and materials from active systems, subject to the retention criteria in Section 10; applications already submitted to employers cannot be recalled, and employers hold their copies under their own policies.

10. Retention

We keep personal information only as long as reasonably necessary for the purposes in this Policy, judged by: how long you keep your account, what the Service needs to operate (your application history and saved documents persist while your account does), our legal, tax, billing, security, and dispute-resolution obligations, and the sensitivity of the data. When you delete content or your account, we delete or de-identify it from active systems and purge it from routine backups within approximately 30 days, except where law or the criteria above require longer retention. De-identified and aggregated information that no longer identifies you may be retained and used, including for the improvement and training purposes in Section 4, and we commit not to attempt to re-identify it.

11. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest and access controls limiting data to your account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and regulators as applicable law requires.

12. Children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of anyone we know to be under 18. If you believe a minor has provided us information, contact us and we will delete it.

13. United States Only; Visitors From Elsewhere

The Service is offered from the United States for United States residents, and information is processed in the United States. If you access the Service from elsewhere, you do so on your own initiative, and your information will be processed in the U.S.

14. Additional Disclosures for California and Other States

The table below summarizes, in the categories used by the California Consumer Privacy Act (as amended), what we collect and whether it is sold or shared. As Section 7 explains, we do not sell personal information and do not share it for cross-context behavioral advertising.

California residents: the rights in Section 9 apply, including the rights to know, delete, and correct. We do not sell personal information and do not share it for cross-context behavioral advertising, so no "Do Not Sell or Share My Personal Information" link is required; if that ever changes, we will post the link, honor Global Privacy Control signals, and provide all required notices first. We do not use or disclose sensitive personal information for purposes requiring a "Limit the Use of My Sensitive Personal Information" link. We do not knowingly sell or share personal information of consumers under 16. California's "Shine the Light" law (Civ. Code §1798.83) permits requests about disclosures to third parties for their direct marketing.

15. Changes to This Policy

We may update this Policy. If we make material changes, we will notify you in advance by email or in-product notice before they take effect. We will not materially expand how we sell, share, or use already-collected personal information - including for AI training - without providing notice and obtaining any consent required by law.

16. Contact Us

Privacy questions and requests: privacy@rafador.com. Controller: Rafalski Enterprises LLC