Retrailed Privacy Policy

This Privacy Policy explains how Retrailed ("Retrailed," "we," "us," or "our"), collects, uses, stores, discloses, and otherwise processes personal information when you access or use Retrailed.

Retrailed is a professional identity and professional expertise platform that enables individuals to structure and manage professional information, create and share professional profiles, generate CVs, and use AI-assisted tools. Retrailed also provides recruiting, candidate management, employer portal, team, HR, and organizational functionality.

This Privacy Policy applies to:

• Retrailed websites and web applications;
• individual Retrailed accounts;
• organization accounts and associated user accounts;
• professional profiles and CV-processing functionality;
• embedded CV-intake widgets;
• recruiter and employer portals;
• profile-sharing links and profile buckets; and
• other services provided under the Retrailed brand.

This Privacy Policy should be read together with the Retrailed Terms of Use, which govern your access to and use of the Services.

By using Retrailed, you acknowledge that your personal information may be processed as described in this Privacy Policy, subject to any consent or other legal basis required by applicable law.

Retrailed serves different types of users and supports different processing activities. Our role depends on the context.

3.1 Individual accounts

When you create and manage your own Retrailed account, Retrailed generally determines how personal information is processed to operate the account, provide the platform, maintain security, administer subscriptions, and deliver requested features.

For these activities, Retrailed generally acts as a data controller or equivalent entity under applicable privacy law.

3.2 Organization accounts

Organizations may use Retrailed to manage their users, professional profiles, candidate information, recruitment processes, and other organizational workflows.

An Organization may determine the purposes and means of processing personal information within its account. In such cases, the Organization may act as the data controller or equivalent entity, while Retrailed may process information on its behalf as a service provider or processor.

The precise roles depend on the relevant processing activity and applicable law.

If you are an employee, candidate, contractor, or other individual whose information is processed through an Organization's Retrailed account, you may need to contact that Organization to exercise certain privacy rights or obtain information about its processing activities.

3.3 Candidate CVs submitted by recruiters or other third parties

Recruiters, employers, HR professionals, hiring managers, and other users may submit CVs and professional information relating to other people.

The submitting party is responsible for ensuring that it has the necessary authority and lawful basis to submit and process that information.

Retrailed provides technical functionality for processing and managing such information. We do not independently determine whether a recruiter or other submitting party has the necessary legal authority in every case.

However, this does not remove any independent legal obligations that Retrailed may have under applicable privacy law.

3.4 Separate personal and organization-managed records

Retrailed distinguishes between individually controlled records and organization-managed records.

Records created before a user joins an Organization, or after the user leaves it, remain under the user's control and are not automatically accessible to the Organization. The user may choose to share those records.

Records created within the Organization and managed through its organizational workflows may remain under the Organization's control after the user leaves.

These distinctions describe access and management within Retrailed. They do not independently determine legal ownership of underlying content.

The information we collect depends on how you use Retrailed.

4.1 Account and authentication information

We may collect:

• email address;
• authentication and account identifiers;
• information received through Google authentication;
• account status and preferences;
• account creation and login information; and
• security-related information associated with account access.

Retrailed currently supports Google authentication and email magic links.

We do not need your Google password to provide Google authentication.

4.2 Professional profile information

You may provide professional information such as:

• name and professional title;
• work experience and employment history;
• projects and contributions;
• skills and technologies;
• roles and responsibilities;
• achievements and outcomes;
• education and certifications;
• industries and professional domains;
• portfolio links and other professional references;
• career narratives and professional summaries;
• CVs, resumes, and other documents; and
• other information you choose to include in your profile.

Depending on the content you submit, this information may include personal information relating to you or other individuals.

4.3 CVs and documents

When you upload or submit a CV, resume, job description, or other document, we may process the document and information extracted from it to provide the requested functionality.

This may include extracting text, structuring professional information, creating a profile, generating summaries, or performing other requested analysis.

Documents may contain personal information such as names, contact details, employment history, education, photographs, or other information included by the document's author.

You should only submit documents that you are authorized to provide and process.

4.4 Candidate and recruitment information

When Retrailed is used for recruiting or hiring, the information processed may include:

• candidate CVs and professional profiles;
• employment and project history;
• skills, technologies, and responsibilities;
• job descriptions and role requirements;
• candidate status within a recruitment pipeline;
• recruiter notes and hiring-related communications;
• interview progress and related information; and
• other information provided by candidates, recruiters, employers, or hiring teams.

The exact information depends on the features used and the information submitted by the relevant parties.

4.5 Organization and team information

For Organization accounts, we may process:

• Organization name and account details;
• administrator and user information;
• membership and access requests;
• roles and permissions;
• organization-managed profiles and records;
• subscription and billing information;
• organizational settings;
• recruiting and HR workflow information; and
• administrative and audit activity.

4.6 Billing and subscription information

Paid services are processed through Stripe.

We may receive information necessary to administer subscriptions, such as subscription status, plan, payment status, transaction identifiers, billing history, and related billing metadata.

Payment card information is handled through the applicable payment provider. We do not intend to store complete payment card details in Retrailed.

The payment provider's own privacy policy also applies to its processing.

4.7 Usage, diagnostic, and security information

We may collect information about how the Services are accessed and used, including:

• application events and feature usage;
• access timestamps;
• authentication and session events;
• technical logs and diagnostic information;
• error reports and performance information;
• security and audit events;
• suspected abuse or unauthorized activity; and
• information needed for load balancing, reliability, and service operation.

We use this information to operate, secure, maintain, and improve the Services and to investigate suspected misuse.

4.8 Communications

If you contact us or communicate with Retrailed, we may process your email address, message content, attachments, and information needed to respond to your inquiry.

We may also maintain records of support requests and related communications.

4.9 Information from third parties

Depending on how you use Retrailed, we may receive information from authentication providers, payment providers, Organization administrators, recruiters, employers, candidates, and other parties who submit or share information through the Services.

We may also receive information from third-party services integrated with Retrailed, where necessary to provide the relevant functionality.

We use personal information for the following purposes, as applicable.

5.1 Providing and maintaining Retrailed

We process information to:

• create and maintain accounts;
• authenticate users;
• create, structure, and maintain professional profiles;
• process CVs and other documents;
• generate CVs and profile variations;
• provide profile sharing and export functionality;
• provide recruiting, HR, team, and organizational features;
• administer subscriptions and Points;
• respond to support requests; and
• deliver functionality requested by users.

5.2 AI-assisted processing and analysis

We may process relevant information using AI technologies to provide requested features, including:

• extracting and structuring professional information;
• generating summaries and career narratives;
• identifying skills, responsibilities, and achievements;
• analyzing job descriptions and requirements;
• generating recommendations and insights;
• supporting candidate evaluation workflows; and
• providing other AI-assisted functionality.

AI outputs may contain errors or omissions and should be reviewed by the user. Retrailed does not itself make employment or hiring decisions.

5.3 Privacy filtering and anonymization

Retrailed incorporates mechanisms designed to filter or anonymize personal information in applicable processing workflows.

Depending on the feature, these mechanisms may be used to reduce unnecessary exposure of personal information when processing or presenting professional information.

Filtering and anonymization are not necessarily effective in every circumstance. Users should not assume that all personal information will always be removed from every document, output, or workflow.

5.4 Organization and recruitment workflows

We process information to enable organizations to manage users, professional records, candidate profiles, hiring pipelines, employer portals, permissions, and related workflows.

Where an Organization controls the relevant processing, the Organization is responsible for determining its purposes and ensuring an appropriate legal basis and compliance with applicable law.

5.5 Security, abuse prevention, and service reliability

We may process technical and usage information to:

• protect accounts and infrastructure;
• detect and investigate suspicious activity;
• prevent fraud, scams, spam, and abuse;
• enforce our Terms of Use;
• maintain service reliability and performance;
• troubleshoot technical issues;
• audit relevant activity; and
• protect Retrailed, users, Organizations, and third parties.

5.6 Billing and administration

We process information to administer subscriptions, calculate and record Points usage, maintain billing history, process plan changes, manage cancellations, and handle billing inquiries.

5.7 Communications

We may use contact information to send account notifications, authentication messages, security alerts, billing notices, important service announcements, data-retention reminders, and other service-related communications.

We may also send optional product, informational, or promotional communications in accordance with applicable law and your notification preferences.

5.8 Legal compliance and protection of rights

We may process information where necessary to comply with applicable laws, respond to valid legal requests, establish or defend legal claims, enforce our agreements, and protect the rights, safety, and security of Retrailed, its users, and others.

Where applicable privacy law requires a legal basis for processing, we rely on one or more of the following, depending on the activity and jurisdiction:

• Contract: processing necessary to create an account, provide requested functionality, administer subscriptions, or perform our agreement with you.
• Legitimate interests: processing necessary for legitimate interests such as service security, fraud prevention, reliability, support, and service improvement, where those interests are not overridden by applicable rights.
• Consent: processing where you have provided consent, where consent is required, or where a feature specifically relies on your consent.
• Legal obligation: processing necessary to comply with applicable legal or regulatory requirements.
• Other lawful bases: where recognized by applicable law, including legal bases that may apply to organizational or recruitment-related processing.

The applicable legal basis depends on the specific processing activity.

Where an Organization submits candidate or employee information, that Organization is responsible for identifying and documenting the lawful basis applicable to its processing. Retrailed may separately rely on its own legal bases for processing necessary to provide and secure the Services.

Where processing relies on consent, you may withdraw consent where permitted by applicable law. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Retrailed allows certain CV-processing workflows to be used without creating a persistent account.

When a CV is submitted through such a workflow, Retrailed may temporarily process the original file and create a temporary profile.

Temporary profiles and their associated original uploaded files that are not saved to a Retrailed account are retained for no more than 30 minutes, after which they are wiped.

If you create an account and save the profile, the saved information becomes subject to the retention and deletion rules applicable to account data.

This temporary-processing rule applies to the relevant temporary workflow. It does not mean that information saved to an account, separately submitted by another user, or independently retained in another system is automatically deleted at the same time.

If a recruiter, employer, or other third party submits another person's CV, that submitting party remains responsible for having the necessary authority and lawful basis to do so.

When a user participates in an Organization's Retrailed account, the Organization may manage records created within the organizational context.

Organization Administrators may be able to access, manage, or administer organization-managed information according to the features, permissions, and workflows available to that Organization.

Records created before a user joins an Organization or after the user leaves it are not automatically accessible to that Organization. The user may separately share those records.

When a user leaves an Organization, records created within the Organization's managed context may remain with the Organization.

If you are concerned about how your employer or another Organization processes your personal information, you may need to contact that Organization directly. Retrailed's access model does not independently determine legal ownership of the information.

We may disclose personal information in the following circumstances.

9.1 Sharing initiated by users

Retrailed allows users to share professional information through available features, which may include authenticated access, secure web links, Profile Buckets, Employer Portals, and public Profiles.

The information made available depends on the user's sharing settings and the features used.

Users are responsible for checking the intended audience before sharing information.

9.2 Organization administrators and members

Organization Administrators and authorized Organization users may access organization-managed information according to their roles, permissions, and the applicable workflows.

Information shared directly with an Organization may also become available to the recipients selected by the user.

9.3 Service providers

We use third-party providers to support the Services. These providers may process personal information on our behalf or in connection with their services.

Provider categories may include:

• cloud hosting and infrastructure;
• databases and application services;
• authentication;
• payment processing;
• email and notifications;
• analytics and diagnostics; and
• AI processing.

Current providers include Vercel, Supabase, Stripe, Google, email service providers, analytics providers, and third-party AI providers. Providers may change as the Services develop.

9.4 Legal requests and protection

We may disclose information where required by law or where reasonably necessary to comply with legal process, respond to valid governmental requests, enforce our agreements, investigate suspected fraud or abuse, protect the security of the Services, or protect the rights and safety of users or third parties.

Where legally appropriate, we may challenge or seek to limit a request. We are not obligated to challenge every request.

9.5 Business transfers

Personal information may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, subject to applicable law.

9.6 With your direction or permission

We may disclose information where you direct us to do so or where you otherwise authorize the disclosure.

Retrailed uses third-party AI services to provide certain features. The specific providers may change over time.

Where necessary to perform a requested operation, relevant information may be sent to an AI provider for processing.

Retrailed does not currently train or fine-tune its own AI models using user Content. Retrailed does not intentionally provide user Content to third-party AI providers for the purpose of training their general-purpose AI models.

Retrailed intends to use AI provider arrangements that limit processing to what is necessary to provide the relevant service and prevent providers from using Retrailed user Content for their own purposes or model training, subject to the applicable provider arrangements and terms.

AI processing may involve the transmission of professional information or other personal information included in the relevant input. Users and Organizations should consider the nature of the information they submit when using AI-assisted features.

AI-generated content may be inaccurate or incomplete and should be reviewed before use, especially in recruitment or employment contexts.

11.1 Website analytics

Retrailed websites may use analytics technologies such as Vercel Analytics, Google Analytics, Statcounter, and similar services introduced in the future.

These technologies may collect information about website visits, usage patterns, browser or device information, and interactions with website content.

Where required by applicable law, non-essential cookies or analytics technologies will be used only after the required consent has been obtained. Where applicable, users will be provided with options to accept or reject non-essential technologies and manage their preferences.

The specific technologies used may change over time.

11.2 Application operations and security

The Retrailed application may process operational telemetry, logs, and security-related information needed to maintain the platform, balance system load, detect abuse, investigate incidents, audit activity, and support reliable operation.

Such processing may occur without separate optional analytics consent where permitted by applicable law and where it is necessary for the relevant operational or security purpose.

Optional product analytics, advertising, or tracking technologies, if introduced, will be treated separately where required by applicable law.

11.3 Managing preferences

Where a cookie or consent management interface is provided, you can use it to manage applicable preferences. You may also be able to manage cookies through your browser settings.

Disabling certain technologies may affect website functionality.

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, subject to applicable law and the specific retention rules below.

12.1 Individual accounts

When an individual deletes their Retrailed account, we wipe the account and associated data, except for billing history and records of Points spent where applicable to a paid plan.

12.2 Organization accounts

Organization accounts are separate from individual administrator accounts.

When an Organization subscription is suspended, a 30-day grace period applies. Following that period, the Organization's data is wiped unless the Organization restores the subscription or another applicable arrangement applies.

An Organization may request immediate deletion and full data wiping through the applicable process.

Organization data is wiped except for billing history and other information that we are legally required or permitted to retain.

Deleting an administrator's individual account does not, by itself, delete the Organization.

12.3 Inactive accounts

Retrailed does not automatically expire accounts solely because they are inactive.

However, we reserve the right to delete accounts and associated data that have remained inactive for an extended period. Where practical, we may provide notice or an opportunity to retain the account before deletion.

12.4 Retention reminders

Retrailed may periodically check stored profiles and send reminders asking users whether they want to keep, update, or delete their information. These reminders may be sent approximately every six months or more frequently.

12.5 Billing and legally required records

We may retain billing history and other information where reasonably necessary for accounting, tax, legal compliance, dispute resolution, fraud prevention, security, or the establishment, exercise, or defense of legal claims.

12.6 Temporary CV processing

Temporary profiles and their associated original uploaded files that are not saved to an account are wiped within 30 minutes, as described in Section 7.

12.7 Technical backups and residual copies

Deletion from active systems may not immediately remove every residual copy from backups, logs, or systems maintained for security and operational purposes. Where such residual copies exist, they will be handled in accordance with applicable retention practices and legal requirements.

We do not promise that every technical copy is erased instantaneously unless the relevant workflow expressly provides that guarantee.

Retrailed is intended for global use. Retrailed and its service providers may process or store personal information in countries other than the country where the individual resides.

Those countries may have privacy laws different from those of the individual's jurisdiction.

Where applicable law requires safeguards for international transfers, we intend to implement appropriate safeguards, which may include contractual protections or other legally recognized transfer mechanisms.

Further information about relevant safeguards may be requested through support@retrailed.com, subject to applicable law and confidentiality obligations.

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.

These measures may include access controls, authentication, monitoring, infrastructure safeguards, and other security practices appropriate to the Services.

No online service or storage system can guarantee absolute security. We cannot guarantee that unauthorized access, security incidents, or data loss will never occur.

Users and Organizations are responsible for maintaining account security, protecting authentication methods, and configuring access and sharing permissions appropriately.

If we become aware of a personal data breach requiring notification under applicable law, we will provide notifications to affected individuals, authorities, or other parties as required by law.

Not every technical incident or security event constitutes a personal data breach requiring notification.

Depending on your location and the applicable law, you may have rights regarding your personal information, which may include:

• the right to request access to personal information;
• the right to request correction of inaccurate information;
• the right to request deletion;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent; and
• the right to lodge a complaint with an applicable data protection authority.

These rights are subject to applicable legal conditions, exemptions, and limitations. They may not all be available to every individual in every jurisdiction.

16.1 How to submit a request

You may submit a privacy request to:

support@retrailed.com

Please describe the request and provide enough information for us to understand and verify it.

We may request additional information to verify your identity or authority before acting on a request.

We will respond in accordance with applicable legal requirements.

16.2 Organization-managed information

If your information is processed by an Organization through Retrailed, the Organization may be responsible for responding to certain privacy requests.

In such cases, we may direct you to the relevant Organization or assist it in responding, as appropriate under applicable law and our arrangements with that Organization.

16.3 Complaints

If you believe that your personal information has been processed unlawfully, you may contact us. Depending on your jurisdiction, you may also have the right to lodge a complaint with the relevant data protection or privacy authority.

We may send communications needed to operate Retrailed, including authentication messages, account notices, security alerts, billing notices, service updates, and retention reminders.

We may also send optional product updates, informational messages, or promotional communications.

Where applicable, you can manage communication preferences through the mechanisms provided by Retrailed, including account settings or an unsubscribe mechanism in the communication.

Unsubscribing from optional communications does not prevent us from sending essential transactional, security, legal, or service-related messages.

Retrailed is intended for individuals aged 18 and older.

We do not knowingly collect personal information from children under 18 for the purpose of allowing them to use the Services.

If we become aware that an account belongs to a person under 18, we may suspend or delete the account and associated personal information, subject to applicable legal requirements.

If you believe a person under 18 has provided personal information to Retrailed, please contact support@retrailed.com.

Retrailed may contain links to third-party websites or integrate with third-party services.

Those services operate under their own privacy policies and terms. We do not control their independent processing practices and are not responsible for their privacy practices, security, content, or availability, except to the extent required by applicable law.

We encourage users to review the privacy policies of third-party services they choose to use.

We may update this Privacy Policy from time to time to reflect changes to Retrailed, our processing activities, service providers, legal requirements, or operational practices.

The updated version will be published with a revised effective date.

For material changes, we will provide reasonable notice through email, an in-application notification, or another appropriate method.

Where required by law, we will obtain consent or take other steps before implementing changes that require it.

For questions, requests, or concerns regarding this Privacy Policy or the processing of personal information, contact: support@retrailed.com