Privacy Policy

01Overview and Scope

This Privacy Policy describes how Rafalski Enterprises LLC ("Rafador AI," "Rafador," "we," "us," or "our") collects, uses, discloses, sells, shares, and protects personal information when you use the Rafador AI websites, applications, and services (the "Service"), and the rights and choices available to you. It applies to users of the Service in the United States. The Service is intended for individuals 18 or older.

Rafador is a service that uses artificial intelligence to complete and submit job applications on your behalf. That purpose shapes everything in this Policy: most of the information we collect exists so the Service can apply to jobs as you.

02Information We Collect

2.1 Information You Provide

Account and contact information: name, email address, password, phone number, and postal address.

Profile and career information: resumes and cover letters and their contents (work history, employers, dates, education, certifications, skills), job preferences, target roles, locations, and salary expectations.

Standing application answers: your saved answers to common application questions, such as work-authorization status, sponsorship needs, willingness to relocate, notice periods, and similar.

Employer account credentials: where an employer’s application system requires an account and you have authorized us to create one (see our Terms of Service, Section 4.5), the login email for that account and the password the Service generates for it. Passwords are stored in encrypted form and are used only to complete and submit your applications and to check their status.

Voluntary self-identification information: if you choose to provide it for equal-opportunity questions, this may include race or ethnicity, gender, veteran status, and disability status. This is sensitive personal information, handled as described in Section 3, and you are never required to provide it.

Communications: messages you send us, support requests, and feedback.

Payment information: payments are processed by our payment processor (currently Stripe). We receive limited transaction information (such as plan, amount, and card brand/last four digits) but do not receive or store your full card number.

2.2 Information Collected Automatically

Usage and device information: IP address, browser and device type, operating system, pages viewed, features used, timestamps, and similar log data.

Cookies and similar technologies: as described in Section 8.

2.3 Information Generated or Received by the Service

Application activity: the jobs found and evaluated for you, match scores, the applications completed, submitted, or skipped, and the resumes, cover letters, and written answers generated for each application.

Third-party information: job postings and related data from job platforms; confirmations or communications relating to your applications; and information from service providers such as analytics and security vendors.

03Sensitive Personal Information

"Sensitive personal information" means information such as racial or ethnic origin, disability or health information, religious beliefs, sexual orientation, citizenship or immigration status, and similar categories given heightened protection under state privacy laws. In our Service this arises mainly from voluntary equal-opportunity self-identification answers and from anything similar you include in your materials.

• We collect it only if you choose to provide it, and we ask for your consent before using it to answer equal-opportunity questions on applications.
• We use it only to complete your applications and for no other purpose. We do not use it for advertising, and we do not use it to train AI models.
• We do not sell or share sensitive personal information, and we do not use or disclose it for purposes beyond those permitted by applicable law without your consent.

04How We Use Personal Information

To provide the Service: find and evaluate job postings, complete and submit applications as your authorized agent, use the contents of documents you upload (such as your resume) to fill in your profile and saved answers, for your review, generate tailored resumes, cover letters, and written answers, verify completeness before submission, and maintain your application history and saved documents.

To operate your account: authentication, billing and renewals, customer support, and service communications about your account and applications.

To improve the Service and train our AI: we use information about how the Service is used, and user content, to improve the Service and to develop and train the AI systems and models used to provide and improve it, as disclosed at signup. Sensitive personal information is excluded from AI training.

For safety, security, and legal purposes: fraud and abuse prevention, security monitoring, enforcing our Terms, and complying with law and legal process.

For marketing and advertising: to send you marketing about the Service, which you can opt out of at any time, and to measure the performance of our advertising and reach people who may be interested in the Service, including through the advertising platforms described in Sections 7 and 8.

05Automated Processing

The Service is automated by design: AI evaluates job postings against your profile and completes and submits applications on your behalf under the authorization in our Terms of Service. AI can make mistakes, and submitted applications cannot be recalled. The Service does not make decisions about you that produce legal or similarly significant effects; hiring decisions are made by employers, not by Rafador. Where an application cannot be truthfully completed from your information, it is skipped rather than guessed at.

06How We Disclose Personal Information (Service Operations)

Employers and job platforms (the core of the Service): when the Service applies to a job for you, your application information — including your resume, answers, and any consented self-identification information — is submitted to the relevant employer and/or the platform hosting the application. Employers and platforms are independent of Rafador and handle your information under their own privacy policies.

Service providers: vendors that host our infrastructure, process payments (Stripe), provide AI model services used to power features, and provide analytics, communications, and security services, in each case under contracts limiting their use of your information to providing services to us. Our AI service providers are contractually restricted from using your content to train their own models.

Legal and safety: to comply with law or legal process, to enforce our Terms, or to protect the rights, safety, or property of Rafador, our users, or others.

Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, where your information may be transferred as part of the transaction, subject to this Policy or equivalent protections.

With your direction or consent: other disclosures you request or agree to.

07Advertising, Sale, and Sharing of Personal Data; Recruiter Visibility

We do not sell your personal data for money. The Service is funded by subscriptions, not by selling your information. We do, however, use advertising and measurement technologies on our marketing and sign-up pages, and California and a number of other states define the disclosures those technologies make as "sharing" for targeted advertising (and, under some statutes, as a "sale," because those laws do not require an exchange of money). This Section and Section 8 are the disclosure those laws require, and you may opt out at any time as described below.

Advertising and measurement technologies. We use the Meta pixel (provided by Meta Platforms, Inc.) and Google Analytics (provided by Google LLC) so that we can measure whether our advertising works, understand how visitors use our public pages, and reach people who may be interested in the Service. When these tools run, the platform may receive: your IP address; your browser, device, and operating system information; the page you are viewing and the page that referred you to it; identifiers stored in cookies the platform sets in your browser, which allow it to recognize your browser across websites; and the fact that you took an action we measure, such as creating an account or purchasing a subscription (including the price of the plan). Meta additionally receives, if you have created an account, contact information from your account in hashed form (your email address and, if you have provided one, your name), as described below; Google Analytics does not. These platforms may use that information for their own purposes, including, in Meta’s case, building profiles about you, under their own privacy policies, which we do not control. Meta’s privacy policy is available at facebook.com/privacy/policy and Google’s is available at policies.google.com/privacy.

What Google Analytics is not permitted to do. We configure Google Analytics so that it does three things less than it is capable of doing, and we commit to each of them. First, we send it no identifier for you: no user identifier, no email address, no name, and no hashed form of any of them, so it receives only the browser and page information described above. Second, we disable Google Signals, the setting that would let Google join your activity on our site to your signed-in Google account across devices for advertising purposes. Third, we disable advertising personalization and instruct Google not to use this data to personalize advertising to you. We also instruct Google to truncate your IP address. If we ever change any of these three settings, that is a material change to this Policy and Section 15 applies to it.

Where these technologies run, and what they never receive. We run them on our public pages (such as our home page, pricing page, frequently asked questions, and sign-up flow) and at two points connected to your account: when you finish creating an account, and when you complete a paid subscription. We do not run them on the pages where you manage your resumes, cover letters, application answers, or application history. We never transmit to an advertising or analytics platform: your phone number; your resumes or cover letters or their contents; your application answers; the jobs or employers you have applied to; your equal-opportunity self-identification answers or any other sensitive personal information; or your payment card information. The only contact information we share is your email address and, if you have provided one, your name, each in hashed form only, shared with Meta and not with Google Analytics, as described next.

Hashed matching (Meta only). When you create an account or make a purchase, we may share contact information from your account with Meta in hashed form: your email address and, if you have provided one, your name. Meta compares the hashed values against its own records so it can match the event to a Meta account, which helps us measure whether our advertising works and reach people who may be interested in the Service. Hashing converts each value into a fixed-length code inside your browser before anything is sent; your readable email address and name never leave our systems for this purpose. Hashed values can still identify you to a platform that already knows them, so we treat them as personal information shared for advertising: they appear in the Section 14 table, they are covered by the opt-out rights below, and if you opt out, or your browser sends an opt-out preference signal such as Global Privacy Control, they are not sent at all.

Your opt-out rights. You may opt out of this sharing at any time, at no cost and without affecting your use of the Service, by using the "Do Not Sell or Share My Personal Information" link in the footer of our website or the privacy controls in your account settings. We also honor browser-based opt-out preference signals, including Global Privacy Control: where we detect such a signal, we treat it as an opt-out for that browser and do not load advertising technologies during that visit. You can also exercise choices directly with the platforms and through industry opt-out tools, including Meta’s ad preferences at facebook.com/adpreferences, Google’s Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout, the Digital Advertising Alliance at optout.aboutads.info, and the Network Advertising Initiative at optout.networkadvertising.org. Opting out does not disable the cookies that are necessary for sign-in, security, fraud prevention, and basic service analytics, which we do not use for advertising.

Recruiter visibility (a planned, opt-in feature). We may in the future offer a feature that lets you make a recruiter-facing profile visible to recruiters and employers searching for candidates, and recruiters may pay us for access to opted-in profiles. If we launch this feature: (a) visibility will be off by default and will apply only if you turn it on; (b) recruiters will see a profile generated from your information (such as skills, experience, education, and job preferences), not your raw resume file; (c) your references and the contact information of anyone other than you will be excluded, and your sensitive personal information (Section 3) will never be included; and (d) you will be able to turn visibility off at any time, which removes your profile from recruiter access going forward. Because this disclosure happens only at your direction, it is a choice you control. We will notify you when the feature launches, and this Policy will be updated with its final details before it goes live.

Regardless of any feature or future change, we do not sell or share: sensitive personal information (Section 3); personal information of anyone we know to be under 18; information about individuals other than you that appears in your materials (such as references); the contents of your resumes, cover letters, application answers, or application history; the identity of the employers to which you have applied; or your full card number (which we never hold).

If we ever propose to sell personal data in exchange for money, or to disclose personal data to third parties beyond what this Section describes, we will update this Policy, ask you to accept the updated Policy before it applies to you, obtain any consent the law requires, and put the legally required opt-out mechanisms in place first before any such activity begins.

08Cookies and Analytics

We use cookies and similar technologies, including pixels, tags, software development kits, and browser storage, for sign-in and session management, preferences, security and fraud prevention, analytics, and advertising. Cookies used for sign-in, security, and fraud prevention are necessary to operate the Service and are not used for advertising. Advertising and measurement technologies, including the Meta pixel and Google Analytics, are provided by third parties that set their own cookies and can recognize your browser across websites; as Section 7 explains, several state privacy laws treat the resulting disclosures as sharing for targeted advertising, and you can opt out through the "Do Not Sell or Share My Personal Information" link in our footer, your account privacy settings, or a Global Privacy Control signal. Your browser can also limit or delete cookies; disabling some cookies may impair the Service.

09Your Privacy Rights

Depending on your state, you may have the right to: know and access the personal information we hold about you (including, where required, in a portable format); correct inaccurate information; delete your information; opt out of any sale of personal data, sharing for targeted advertising, or certain profiling (Section 7 describes the advertising-related sharing we do and how to opt out); limit the use of sensitive personal information (we already limit it as described in Section 3); and not be discriminated against for exercising rights. You may also have the right to appeal a refusal.

To exercise rights: use your account settings or contact us at privacy@rafador.com. We will verify your request using information associated with your account (and may request additional verification), respond within the time required by law (generally 45 days, extendable where permitted), and permit an authorized agent to act for you where the law provides, subject to verification. If we deny a request, you may appeal by replying to our decision, and we will respond as the law requires; if the appeal is denied, you may contact your state attorney general.

Deleting your account deletes your profile and materials from active systems, subject to the retention criteria in Section 10; applications already submitted to employers cannot be recalled, and employers hold their copies under their own policies.

10Retention

We keep personal information only as long as reasonably necessary for the purposes in this Policy, judged by: how long you keep your account, what the Service needs to operate (your application history and saved documents persist while your account does), our legal, tax, billing, security, and dispute-resolution obligations, and the sensitivity of the data. When you delete content or your account, we delete or de-identify it from active systems and purge it from routine backups within approximately 30 days, except where law or the criteria above require longer retention. De-identified and aggregated information that no longer identifies you may be retained and used, including for the improvement and training purposes in Section 4, and we commit not to attempt to re-identify it.

11Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest and access controls limiting data to your account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and regulators as applicable law requires.

12Children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of anyone we know to be under 18. If you believe a minor has provided us information, contact us and we will delete it.

13United States Only; Visitors From Elsewhere

The Service is offered from the United States for United States residents, and information is processed in the United States. If you access the Service from elsewhere, you do so on your own initiative, and your information will be processed in the U.S.

14Additional Disclosures for California and Other States

The table below summarizes, in the categories used by the California Consumer Privacy Act (as amended), what we collect and whether it is sold or shared. As Section 7 explains, we do not sell personal information in exchange for money, but the advertising and measurement technologies we use on our marketing and sign-up pages, including Google Analytics, are treated as sharing for cross-context behavioral advertising, and you may opt out at any time.

California residents: the rights in Section 9 apply, including the rights to know, delete, and correct. We do not sell personal information in exchange for money, but because the advertising and measurement technologies described in Sections 7 and 8 constitute sharing for cross-context behavioral advertising, we provide a "Do Not Sell or Share My Personal Information" link in the footer of our website and in your account privacy settings, and we honor Global Privacy Control and other opt-out preference signals as a valid opt-out for the browser that sends them. We do not use or disclose sensitive personal information for purposes requiring a "Limit the Use of My Sensitive Personal Information" link. We do not knowingly sell or share personal information of consumers under 16. California's "Shine the Light" law (Civ. Code §1798.83) permits requests about disclosures to third parties for their direct marketing.

15Changes to This Policy

We may update this Policy. If we make material changes, we will present the updated Policy to you and ask you to accept it before you continue using the Service, and we will post it with an updated “Last Updated” date. Changes that are not material take effect when we post them. We will not materially expand how we sell, share, or use already-collected personal information — including for AI training — without providing notice and obtaining any consent required by law.

16Contact Us

Privacy questions and requests: privacy@rafador.com. Controller: Rafalski Enterprises LLC