Privacy notice

Version of this notice: 3 November 2026. The Terms of Use have the same version.

Who we are

This notice is for Role Den, the job board on this site and in its apps. It says what the board stores about you, why it uses it, where it is kept, for how long, and what you can ask for.

Open clause: the legal entity that runs Role Den (its name, registered number, country and address) is not written here yet.

Open clause: the privacy contact (New Zealand Privacy Act s.201) is not named here yet. Until it is, ask through the contact page.

Open clause: the board's public email address is not set yet. The contact page shows it once the owner sets it.

Age

Role Den is for people aged 16 or older. When you sign up, you tick one box that says you are 16 or older and that you agree to the Terms of Use and the Privacy Policy. The board asks for no birth date and makes no other check of your age.

What the site stores

• Employer accounts — company name, email address, a hashed password, the time of the last sign-in, and optionally a website, location, logo and description. When the board can send email, a company's work email is also confirmed with a link: the account keeps whether and when it was confirmed, and, until the link is used or expires, a one-way hash of it.
• Team members — a company's owner can invite colleagues. Each is stored with a name, email address, a hashed password and the time they last signed in. Until an invitation is accepted, the record holds a one-way hash of the invitation link and when it expires.
• Job seeker profiles — full name, email address, a hashed password, and an optional phone number. A profile can also hold what you choose to add: a headline, a summary, a location, the kind of work you want, your skills, your field of work, the date you can start, whether you are open to work, and a salary expectation. If you continue with Google, the board also stores the identifier of your Google account.
• Agreement to the terms — for a job seeker, a company's owner and a team member: the version of the Terms of Use and the Privacy Policy they agreed to and the time they agreed (UTC). No birth date is kept.
• Old CV files — the board has not taken CV files since 21 October 2026. An account made before then may still hold one: the file itself, saved on the server under a randomised name, plus the original filename, its size and the time it was uploaded. No one is given the file now, and it goes when the account is deleted.
• Typed CVs — if you type your CV on your Profile, the text you typed (up to 1,000 words), kept in the database until you remove it or your account goes.
• Verification documents — files an employer uploads to prove who they are, such as business registration, a licence or identity documents, saved on the server with their original filename, size and file type. Once the company is approved or rejected, the board's staff may save a copy to the board's own storage, off this site, and delete the file here; the verification history keeps its type and filename. The board also deletes each file by itself 30 days after the company is approved or rejected, on the first day the board is used after that. A file sent after a decision waits for the next one, and a company that goes back into review keeps its files until it is decided again. This deletes the file on this site only, not a copy the board's staff saved off it.
• Applications — the name, email address, phone number and cover letter sent with an application, and a CV link if you pasted one, linked to the listing and, if you were signed in, to your profile. An application also keeps the stage the employer moved it to, when, and who moved it (the owner, a team member or the board's staff), and a note if the board's staff left one.
• Listings — everything the employer types into a listing, the date and time it ends, plus a counter of how many times it has been viewed. When the board's checks hold a listing for review, the listing also stores a short plain reason, the words that raised it and the time.
• Saved jobs — the listings a signed-in job seeker saved, and when.
• Approaches — the message or offer a verified employer sends to a job seeker who chose to be found, the job seeker's reply, its status and the times.
• Reports — when a job seeker reports a listing, an approach or a company: which one, the reason chosen, the words the job seeker added, the time, and what the board's staff decided and when, with a copy of its name, title and words as they were then. Only the board's staff who handle applications see who reported; the company reported never does. A report stays on file when the company it is about deletes its account (see Keeping and deleting).
• Blocked companies — the companies a job seeker blocked, and when. A blocked company cannot find, shortlist or approach that job seeker, and is not told.
• Shortlists and saved searches — a company's own list of job seekers it may contact (kept by the profile number its search showed), and the searches it saved.
• Review history — an append-only log of every verification action on an employer account: what happened, which role acted, and any note left with it.
• Subscriptions — Stripe customer and subscription identifiers, the current billing period, and the raw text of each event Stripe sends back, which can carry billing details.
• Plan changes — every change to a company's plan, whether the company or the board's staff made it, with the reason.
• Profile moderation log — each time the board's staff take a profile out of search: the reason they gave and the time. The reason is shown to you on your Profile.
• Listing review log — each time the board's staff release a held listing, close it or put it under review: the note they wrote, the listing and the time. The note is shown to the company in Listings.
• Removal log — when the board's staff delete a listing, an application, a job seeker's account or a company's account: which staff account, what was deleted, the record's number and the time, the kind of account when a company's account goes (an ordinary company or a board administrator), and counts or yes/no facts such as how many applications went with it. It holds no name, email address or text.
• Password reset links — if you ask to reset a forgotten password, we email you a link and keep only a one-way hash (SHA-256) of it, with the account it is for and when it expires. The link works once and for one hour; a newer request replaces it. Used and expired records are cleared out a day after they expire, the next time anyone asks for a link, and with the account when it is deleted.

Email addresses are not confirmed, with two exceptions. The board does not check that an email address belongs to the person who typed it, except in two places: Continue with Google, where Google confirms the address before the board accepts it, and a company's work email, where signing up sends one confirmation link when the host has a mail server set up. An unconfirmed address blocks nothing; the board's staff see whether it is confirmed when they review the company.

Why the board uses it

The board uses what it stores for these things:

• to run accounts: sign-in, your profile and your company page
• to show listings on the board
• to deliver applications to the company that owns the listing
• to let verified employers find job seekers who chose to be found
• to verify companies before their listings go public
• to take payment for plans
• to keep the board safe: the ad check, reports, blocks and the limits on repeated tries
• to answer your requests

Sessions and browser storage

Signing in returns a signed session token that works for 24 hours. A second token is stored beside it and sent with every request that changes something, which is what stops another site from acting as you. The browser keeps both, with the account's details, in sessionStorage and discards them when you close the tab. A link you open in a new tab from a signed-in tab (middle-click, or right-click and Open link in new tab) gets that tab's sign-in, passed between the two tabs in your browser; a right-click sends it once, encrypted, to the one tab opened from that link, and nothing is stored for it. Signing out clears them from the browser and ends the session on the server: a copy of that token stops working at once. To know it is signed out, the board keeps only that session's random id, with no account or token beside it, and deletes it when the token would have expired anyway. Changing your password ends every other sign-in on that account at once; the browser or app where you changed it stays signed in.

These are all the notes the pages keep in your browser. Kept in sessionStorage, and gone when you close the tab:

• candidateAuth — a job seeker's sign-in: the two tokens and the account's details.
• auth — the same for a company's owner or team member, on the employer pages.
• staffAuth — the same for the board's staff, on the staff pages.
• demoMode — a flag set only when a page is opened with the demo switch (?demo=1), to show sample listings.
• jsb-door-email — the email address you typed on one sign-in page, carried to the other and removed once it has been used.
• jsb-apply-draft — what you had typed in an application when your sign-in ended, kept so it can be put back, and removed when it is.
• jsb-google — the one-time values of a Continue with Google started in this tab, removed when Google sends you back.

Kept in localStorage, which stays until you clear it:

• jsb-theme — your choice of light or dark.

The site sets no cookies of its own, the server sends none, and it loads no advertising or analytics scripts.

The Android and iOS apps keep the same session token, its second token and the account's details in the app's own storage on the phone, not in a browser, until you sign out or the server stops accepting the token. They keep your light or dark choice there too. Android leaves them out of its cloud backup and phone-to-phone transfer. On iPhone the app's storage can be part of the phone's own backup.

Other companies involved

• Stripe — handles payment. When a company first starts a checkout, the board creates the company in Stripe with its name and email address. Card details are entered on Stripe's own checkout pages and never reach this server. What comes back is an identifier, a subscription status, and the events Stripe sends when a payment succeeds or fails.
• Google — involved only if you choose Continue with Google. Your browser goes to Google's sign-in page, and Google tells the board your name, your email address and your Google account identifier. The board loads no Google script or font. To check what Google sent, the board's server also fetches Google's public signing keys, a request that carries nothing about you.
• An email provider — the board sends email through a mail server the operator sets up, and whoever runs that server receives each email the board sends, with the address it goes to and the message. Without a mail server set up on the host, the emails below are refused.
• The hosting provider (Railway) — the machine serving this site sees ordinary web server request data, and it runs the database and holds the uploaded files.
• Company logos — a company's logo is shown from the web address the company gave, so whoever runs that address sees the request your browser makes to show it.

The typefaces (Roboto and Roboto Mono) are files served by the site itself, so no font request goes to Google or anyone else.

Open clause: the owner must confirm that each company named here that holds personal data (Stripe, Railway, the email provider and Google) protects it as this notice does.

Where it is kept

The site, the database and the uploaded files are kept with the hosting provider, Railway. The uploaded files (verification documents) are kept in the United States, in the US East region.

Open clause: the region of the database is not written here yet. Only the owner can say where it runs.

Email the board sends

The board sends three kinds of email, each only because someone asked: the team-member invitation a company's owner sends (its link works once, for 7 days), the password-reset message, which carries a link (or, for an account made with Google, a note to use Continue with Google), and the confirmation link sent to a company's work email when the company signs up (it works once, for 2 days). It sends no newsletter or notification.

IP addresses

Sign-in, registration, password reset, payment and many other endpoints that change something are rate limited so they cannot be hammered. To do that the server keeps a small file in its temporary folder for each address, named by a hash of the address, with the timestamps of recent attempts. A sign-in attempt also writes a hash of the email typed. Only hashes appear on disk, a file is deleted once the time window it covers has passed, and no IP address is written to the database.

Who can see what

• A published listing, and the company name attached to it, are public.
• A CV is only a link you paste when you apply or the text you typed on your Profile: the board takes no CV files. A link goes with the application, so it is seen by whoever sees the application (below).
• A CV you typed is read by the company you applied to at the time it asks: an application holds a link to your profile, not a copy of the text, so the company reads the text on your profile as it is then. Board staff who can read applications can read it too. It is not part of the profile that employers search.
• Verification documents are visible to administrators and to the owner of the company that uploaded them; a team member cannot open them.
• An application is visible to the company that owns the listing (its owner and team members), and to administrators who can read applications.
• Administrators can see employer accounts, verification history and subscription status in order to run the review queue.

Being found by employers

• Job seeker profiles are private. Nothing is published until you switch on employer discovery on your Profile.
• A verified employer with a plan can search the profiles of job seekers who switched this on.
• They see your headline, summary, location, kind of work, skills, field of work, start date, whether you are open to work and when you last changed the profile, under your initials, not your name, email address, phone number, CV or salary expectation.
• An employer can send one message to a profile. Your name, email address and phone number go to that employer only after you reply.

Decisions made by computer

The board decides nothing about a job seeker by computer alone. Two automatic steps exist, and a person is in each:

• The ad check reads the words of a listing. It refuses some wording, and it holds some listings for a person on the board's staff to decide. It looks at listings, not at job seekers. The posting rules list what it looks for.
• Talent search shows a company the profiles that match the filters and words the company typed, and, unless the company picks another order, puts the profiles that match more of them first. The company reads the results and chooses whether to send anyone a message. Only profiles of job seekers who switched on employer discovery are in it.

Getting a copy of your data

• A job seeker: on the site, Profile, then Download my data. You get one file with your profile (including the private parts), the applications you sent, the approaches you got and your replies, the jobs you saved, the reports you sent and the companies you blocked, and any record of our team taking your profile out of search. The CV you typed is in it, and so are the name, size and upload date of an old CV file if your account still holds one; the board no longer serves that file.
• A company's owner: the Company page, then Download my data. You get one file with the company page, its listings, the record of reviews of its listings, your team, the verification history, the plan and billing history, the approaches you sent, your shortlist and saved searches. Verification documents are their own download, on Verification, while they are on the site (until staff delete them, or the board does 30 days after the decision); for a copy the board's staff kept off the site after review, ask through the contact page.
• Left out on purpose: passwords (kept only as a one-way hash), the counter that ends old sign-ins, Stripe's raw event bodies (their types and times are in the file), reset and invitation links, the internal names of stored files, and other people's details, such as who on the board's staff did what and the applicants' own details. An application sent without an account is not tied to one; to get a copy of it, ask through the contact page.

Your rights and how to ask

• Copy: get a copy of your data yourself (see Getting a copy of your data).
• Correct: change your details yourself, a job seeker on Profile and a company on the Company page.
• Delete: delete your account yourself (see Keeping and deleting, and the delete account page).
• Object, or stop being found: switch off employer discovery on your Profile at any time, and block a company you do not want to hear from.
• Ask: for anything you cannot do yourself, write through the contact page.

Open clause: how fast the board answers a request about your data is not set here yet. The owner must write it before launch.

Complaints

If you are unhappy with how the board has used your information, write through the contact page first. You can also complain to the data protection regulator where you live, for example the Office of the Privacy Commissioner in New Zealand, the Office of the Australian Information Commissioner (OAIC), the Information Commissioner's Office (ICO) in the United Kingdom, or a data protection authority in the European Union.

Open clause: whether the EU and UK data protection laws apply to Role Den, and who its EU and UK representatives are, is not decided here yet.

Keeping and deleting

• You can change or clear the CV you typed on your Profile at any time. The board takes no CV files, so there is no file to delete; an old one goes when you delete your account.
• An employer can remove a verification document they uploaded until the company is approved. After that its documents are locked.
• You can delete your account yourself, on the site or in the app. A job seeker: Profile, then Delete account. That removes your profile, CV, saved jobs, the applications you sent and the approaches you got, along with the reports you sent and the companies you blocked.
• A company's owner: the Company page (in the app, the account menu), then Delete account. That removes the company, its listings and the applications to them, its team members' access, its verification documents and review history, and its billing records here (Stripe keeps its own). Reports that job seekers sent about the company are not deleted with it: they stay with the board's staff, no longer tied to its account, until the job seeker who sent one deletes theirs. Blocks against the company go. A paid plan has to end first. A copy of a verification document the board's staff kept off the site after review is not deleted by this; to have it deleted, ask through the contact page.
• Deleting asks for your password again (a job seeker who signs in with Google types the account's email instead) and cannot be undone. An application sent without an account is not tied to one; to remove it, ask through the contact page.
• Board staff can delete a listing, a single application, a job seeker's whole account or a company's account, for good. Deleting an application or a job seeker's account needs the staff member's password again. Each deletion leaves a row in the removal log, which keeps numbers and counts, and the kind of account when a company's account goes, and outlives what it describes.
• The review log is append-only by design: it is the record of why an employer was approved or rejected, so entries are not edited or removed while the company's account exists. Deleting the account deletes its log with it.
• Apart from the rate-limit files, the reset-link records, the signed-out session ids and the verification documents described above, nothing is deleted automatically after a set time. What you or the board's staff have not deleted stays.

How long the board keeps it

• Verification documents: 30 days after the company is approved or rejected.
• Listings: a listing ends 60 days after it goes public, unless the board's staff set another time from 7 to 180 days. The time starts when an approved company posts a listing that is not held, when the company is approved (for a listing it saved while it waited), when staff release a held listing, or when the company renews it. Pausing a listing does not stop the time. An ended listing leaves the board and stays in the company's account until it is deleted.
• Links: a password reset link works for 1 hour, a confirmation link for 2 days and a team invitation for 7 days.
• Sign-in sessions: 24 hours, and 8 hours for the board's staff.
• Rate-limit files: until the time window they cover has passed.
• Reports: until the job seeker who sent one deletes their account, even when the company reported deletes its own.
• Everything else: until you or the board's staff delete it.

Keeping it safe

• The site tells browsers to use HTTPS only (a Strict-Transport-Security header, for one year).
• Passwords are stored only as a hash, never as typed.
• Reset, invitation and confirmation links are stored only as a hash, so a link cannot be read back from the database.
• A board administrator reaches only the sections of the staff panel the board owner gave them, and a section they were not given is refused.
• Verification documents can be opened only by the company's owner and by the staff who have the verification section.

To report a security problem, use the contact page.

Changes to this notice

This document changes as the software changes. The version at the top of this page is always the current one. When the version changes, a notice that says "We have updated our Terms and Privacy Policy." with links to both pages and an I agree button shows on the website, in the company console and in the app. It does not stop you using anything. The board does not email people when this notice changes.

Questions

Anything about your own data goes through the contact page. The terms of use cover the rules for using the board itself.