1. Who We Are

RoleMinded ("we", "us", "our") is an online job-matching platform that connects candidates with employers. Our registered address and data controller contact is: privacy@roleminded.com.

2. What Data We Collect

We collect the following categories of personal data:

• Account data — name, email address, password (hashed with bcrypt), role (Candidate / Recruiter).
• Profile data — resume, skills, work experience, education, portfolio links, profile photo.
• Job-posting data (Recruiters) — company name, job titles, descriptions, salary ranges.
• Application data — which jobs you applied to, cover letters, application status.
• Messaging data — messages exchanged between candidates and recruiters on the platform.
• Payment data — subscription tier, Stripe customer ID. We do not store card numbers; payments are processed by Stripe, Inc.
• Usage data — server logs (IP address, browser user-agent, timestamps) retained for up to 30 days for security monitoring.

3. How We Use Your Data

• Create and manage your account.
• Match candidates with relevant job postings.
• Send transactional emails (application confirmations, password resets).
• Process subscription payments via Stripe.
• Detect and prevent fraud or abuse.
• Improve platform features using aggregated, anonymised analytics.

We do not sell your personal data. We do not use your data for behavioural advertising.

4. How We Store Data

Your data is stored in an encrypted SQLite database hosted on fly.io infrastructure in Singapore (Asia-Pacific region). Data is encrypted at rest by the hosting provider. Backups are taken periodically.

Local storage: We store your authentication token (JWT) in your browser's localStorage so you stay signed in between sessions. This token contains your user ID, name, email, and role — it does not contain your password. No tracking cookies are used.

5. Third-Party Services

• Stripe, Inc. — payment processing. Your card details go directly to Stripe and are never stored on our servers. Stripe's privacy policy: stripe.com/privacy.
• Google Fonts — fonts are loaded from Google's CDN. Google may log your IP address. No personal account data is shared.
• SMTP provider (Gmail / Google Workspace) — used to send transactional emails. Email content is transmitted over TLS.
• fly.io — cloud hosting. Server logs (IP, timestamps) are stored by fly.io per their data retention policy.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of your personal data.
• Correction — update inaccurate data via your profile page.
• Erasure — request deletion of your account and associated data.
• Portability — receive your data in a machine-readable format.
• Objection — object to specific processing activities.

To exercise any of these rights, email us at privacy@roleminded.com. We will respond within 30 days.

7. Data Retention

• Account and profile data is retained while your account is active.
• Upon account deletion, personal data is removed within 30 days; aggregated analytics data may be retained indefinitely.
• Server logs are retained for up to 30 days.

8. Children's Privacy

RoleMinded is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@roleminded.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before any material changes take effect. Continued use of the platform after changes constitutes acceptance of the updated policy.