CLEAR BEFORE YOU COMMIT

Your CV. Your information.

Updated 12 November 2026

Who is responsible

Rolevane is provided by No Flaws Art Ltd, company number 16209440. Registered in England and Wales. Registered office: 132a High Street Bromsgrove, Birmingham, United Kingdom, B61 8ES. Contact us about your privacy.

What we process

We process the CV fields, cover letters, job descriptions and extracted original text you choose to save; your sign-in identifier, name and email; purchase references, amounts, dates and access status; support requests, including the name, reply email and message you submit through our contact form; and limited operational/security records. Avoid unnecessary sensitive information such as identity documents, health details, date of birth or full home address.

PDF and Word imports are read in your browser. The original file is not uploaded. When you create or edit a guest draft, the extracted text and CV fields are saved on our server and linked to a random browser cookie so your work can survive reloads and sign-in.

Why we use it

We process saved content, account details and payments to provide the service you request, including steps before a purchase. We use limited security data to prevent abuse and protect accounts, and retain required accounting records to meet legal obligations. Optional integrated AI runs only after you choose it and confirm the data transfer.

Service providers

Cloudflare hosts Rolevane and stores saved CVs and application records in its D1 database. Supabase manages account authentication, and Google handles its own sign-in when you choose it. Stripe processes payment details and receipts. We do not store full card numbers. These services may process information internationally according to their account configuration and contractual safeguards.

If you choose integrated writing, we send the writing brief you review to OpenAI’s API. The brief includes CV content and the job description, plus company, role, supporting evidence and motivation when you request a cover letter. We omit the dedicated name, email, phone, location and website fields. Personal information typed into other sections is still included, so review the brief before sharing. You agree separately for each request and can continue editing without AI. Requests use the API’s non-storage option for generated responses; this is not a promise of zero provider retention, because operational and abuse-monitoring retention may still apply. We do not send the original imported file or the separate original-text field. Leaving the AI choice unchecked stops future transfers; contact us about withdrawal or deletion relating to an earlier request. This cannot reverse a completed transfer. A copied ChatGPT brief is sent only when you paste it into ChatGPT and follows your ChatGPT settings.

We record your account reference, the time, your writing goal, the wording you agreed to and a fingerprint of the brief, without saving another copy of your CV or prompt. This record is included in your personal-data download. We review it within 90 days and when you request withdrawal or account closure, and remove it when no longer needed. This limited evidence is kept to demonstrate and investigate your choice; it is separate from permission to send another request.

When contact-form email delivery is enabled, Namecheap Private Email delivers your request to our support mailbox over an encrypted SMTP connection. The message and reply address are also stored in Cloudflare D1. New messages sent while signed in are linked to that account for request history and data access; signed-out and older messages are not linked by an unverified email address. The email you enter is used to reply about your request, not for marketing. We verify identity separately before disclosing or changing account data.

For new CV pass purchases, Namecheap Private Email also sends your purchase confirmation to the email address on your signed-in account. It includes the purchase details, accepted terms and refund policy, without your CV content. We store the confirmation and delivery status in Cloudflare D1 to handle delivery and support; these emails are transactional, not marketing.

Career workspace and human services

Your career workspace stores the applications, career evidence, draft answers, practice transcripts and feedback you save. Submitted versions are separate snapshots and do not change when you later edit a CV. Reminders appear in your workspace; calendar files are downloaded only when you choose them. AI career tools send the brief you review, including selected confirmed evidence and practice answers, to OpenAI after a separate choice for each request. Voice recordings remain in your browser until you choose transcription. When you agree, the audio is sent to OpenAI; Rolevane does not store the audio. You review the transcript before requesting feedback. Provider operational retention may still apply.

A human rewrite request shares the selected CV snapshot and intake brief with the authorised writing team. Messages and delivery versions are stored for fulfilment, revisions and support. Paid bookings require an agreed quote and available service; submitting an interest request does not promise a writer or delivery date. Human-service records are separate from saved CVs and may need support review for deletion, including any purchase-record retention obligations.

A public portfolio is optional. Only the display name, headline, about text, selected work and professional link you explicitly publish become available to anyone with its link. Your private CVs, applications and practice are not included. Unpublishing disables the page but cannot remove copies other people have already made.

Retention

A guest draft expires seven days after its last successful save. Expired drafts are inaccessible and removed by scheduled cleanup and subsequent draft-save cleanup; removal from infrastructure backups follows the hosting provider’s backup lifecycle. Sign-in transfers the draft into your saved workspace and removes its duplicate CV text from the draft record. Deleting a saved CV also removes any linked legacy draft copy; deleting all CVs removes all transferred draft records linked to your account.

For accounts with saved CVs or career workspace items, we record the date you last signed in or used your workspace so we can tell whether you still use it. We update this date when you return to view, save or download a CV. We remove the date when you delete your last saved CV and career workspace item. Signed-in CVs stay available until you delete them; pass expiry does not delete them. You can delete individual CVs and career items. Your profile has separate controls for deleting all CVs and for deleting career items, submitted snapshots and the public portfolio. Practice transcripts and feedback remain until you delete them. Pass expiry does not delete career items. Purchase records and checkout consent evidence may be retained for up to six years after the relevant accounting period where required. Support and security data are reviewed for deletion when no longer needed. Retention reviews and provider-side deletion may require support action.

Cookies and tracking

Essential sign-in cookies maintain your account access. We set them for up to 30 days whenever a session cookie is written or refreshed. Temporary login-verification cookies last up to one hour and are removed when the login exchange completes. Signing out clears the session cookies. These browser-storage limits do not determine how long Supabase retains account or session records.

The random rv_draft recovery cookie lasts seven days from a successful guest-draft save; signing in to claim the draft or deleting the draft clears it. Our explicit sandbox checkout check uses a separate 30-minute cookie, not an ordinary purchase-tracking cookie. Older sign-in and login-verification cookies issued before this update may retain the earlier limit of up to 400 days until replaced, cleared or expired. You can clear Rolevane’s site data in your browser; doing so can remove access to an unclaimed guest draft.

We use Cloudflare Web Analytics to understand page usage and improve loading speed and responsiveness. Reports include page paths, referral information, browser and device categories, and performance measurements. Cloudflare says its analytics beacon does not use cookies or persistent browser storage and does not track people across its customers’ websites. We have enabled its regional exclusion for connections handled by the listed European data centres, including the UK. This depends on network routing and may differ from your physical location.

Cloudflare documents seven days of unsampled beacon data, followed by reduced-volume aggregation, with analytics history accessible for the previous six months. This reporting window does not establish when every provider-held copy is deleted. See Cloudflare’s reporting information and beacon and regional settings.

The builder does not add advertising cookies or behavioural advertising trackers. External sign-in and checkout providers apply their own notices.

Your choices and rights

Your profile offers a free, readable PDF download of stored account data, with a text-copy option and controls to delete saved CVs. Deleting CVs also deletes their saved original extracted text. Your profile also offers a confirmed account-closure request with a reference and status. Support verifies identity and completes sign-in closure and erasure; submitting a request does not immediately close your account, erase purchase records or issue a refund. For correction, access to older or signed-out support messages, erasure, objection or other privacy requests, use a privacy support request or the contact form. Rights depend on the circumstances and some records must be retained. Where UK GDPR applies, requests are generally answered within one month, subject to lawful extensions. You may complain to the UK Information Commissioner’s Office or your relevant local authority.

We do not make recruitment decisions about you or sell your CV content. Downloaded files remain under your control, and deleting a saved CV does not delete copies already on your devices.