Data Processing Addendum

Status of this document

DRAFT — NOT YET REVIEWED BY COUNSEL. This addendum describes how personal data is handled in the AllRoles business products, in plain terms, so a customer's privacy or security reviewer can see the shape of the arrangement before signing. AllRoles operates without a formed legal entity at this time; counterparty details will be completed as [OPERATOR LEGAL NAME — TO BE COMPLETED ON ENTITY FORMATION] when an entity exists and counsel has reviewed this text.

1. Scope and roles

AllRoles is the data controller for its own accounts and operations: account registrations, billing relationships, lead-form submissions, and platform security logs.

For customer workspace data — the watchlists, saved report configurations, API keys, and usage records a customer's authorised users create in the data workspace — AllRoles acts as a processor (service provider) on the customer's behalf: that data exists to provide the service to that customer, is scoped to their account by row-level security, and is not used for AllRoles' own marketing or product analytics beyond operating and securing the service.

The job-posting dataset itself is company- and posting-level information published by employers. It is not customer data. Employer-published posting text can incidentally contain a recruiter's or hiring manager's name; AllRoles does not extract or profile individuals from posting text.

2. Personal data in the business products

The business products hold a deliberately small amount of personal data: (a) account data — the name and email address of each account holder, and their organisation's plan and entitlement status; (b) lead-form submissions — name, work email, company, the product requested, and the message the submitter wrote; (c) API records — the API key identifier and prefix (keys themselves are stored only as SHA-256 hashes), creation and last-used timestamps, and request metadata used for rate limiting and abuse prevention; (d) workspace content the customer creates — company watchlists, saved report names and parameters, and webhook endpoints the customer configures.

AllRoles does not ask business customers to upload personal data about third parties, and customers must not put personal data about individuals (for example candidate lists) into workspace fields, saved report names, or webhook payloads.

3. How the data is processed

Account and workspace data is processed only to authenticate users, enforce plan entitlements, deliver exports and API responses, dispatch customer-configured webhooks, provide support, and keep the platform secure. Lead-form submissions are processed only to respond to the enquiry. AllRoles does not sell personal data and does not share it with third parties other than the subprocessors below.

4. Subprocessors

AllRoles runs on a small, named stack. Current subprocessors: Lovable — application hosting and deployment platform; Supabase — Postgres database, authentication, and storage (the application database behind Lovable Cloud); Stripe — payment processing, only when card payments are enabled for an account (inactive until enabled).

AllRoles will update this page before adding a subprocessor that would process customer workspace data, and will note the change in the changelog.

5. Security measures

The technical and organisational measures in place are summarised on the Security page (/legal/security): row-level security on database tables, entitlement-gated data access, hashed API keys, TLS-encrypted transport, and service-role credentials held server-side only. Those measures are incorporated into this addendum by reference and are the factual basis for it — this addendum does not claim controls beyond what that page describes.

6. Retention

Account and workspace data is retained while the account is active. Lead-form submissions are retained until the enquiry is resolved and then reviewed periodically and deleted when no longer needed for the business relationship. API request metadata is retained for a short operational window for rate limiting, security, and debugging, and is not kept as a long-term archive.

7. Deletion on termination

When a business customer's agreement ends or the customer asks in writing, AllRoles will delete that customer's workspace data — watchlists, saved reports, API keys, and webhook configurations — within 30 days, except records that must be kept for accounting or legal reasons. Account holders can also request deletion of their account data at any time through the contact options on this site. Platform backups roll off on the hosting platform's cycle after deletion from live systems.

8. Breach notification

If AllRoles confirms a personal-data breach affecting customer workspace or account data, it will notify affected customers without undue delay and, where feasible, within 72 hours of confirmation, describing the nature of the breach, the categories of data affected, and the measures taken. Notifications go to the customer's account email or through the contact options on this site.

9. Data subject requests

Individuals can exercise their privacy rights — access, correction, deletion — over their own account or lead-form data through the contact options on this site, as described in the Privacy Policy. Where a request concerns data a customer controls in its workspace, AllRoles will refer the request to that customer and provide reasonable assistance so the customer can respond within the time its own obligations require.

10. Location of processing

Customer and account data is hosted with the subprocessors named above, in the United States. If a customer's regulatory position requires specific transfer mechanisms or regional hosting, that requirement should be raised before purchase — AllRoles will state plainly whether it can be met rather than paper over it.