This Privacy Policy explains how Startup Roles ("Startup Roles", "we", "us", "our") collects, uses, discloses, retains and protects personal data when you visit our website, use the Platform, or when we surface Candidate information to a Client using the Platform.

We take a purpose-limited approach: we collect only what we need to run the Platform, keep it secure, comply with law, and make product decisions grounded in real use.

1. Who is the controller

Startup Roles is the data controller for:

website visitors;
Clients and their individual users;
Candidate information we surface, insofar as we determine the purposes and means of our own sourcing, ranking, and quality-of-service processing.

Once we reveal a Candidate's contact details to a Client, the Client becomes an independent controller of that data for their own outreach, evaluation and hiring purposes, as further described in the Data Sharing Agreement.

To contact us about privacy, email privacy@startuproles.co.

2. Personal data we collect

Website visitors: IP address, device and browser data, pages viewed, referrer, approximate location derived from IP, timestamps, and information you volunteer through forms.

Clients and their individual users: name, work email, password hash, organisation name and (optionally) company website or LinkedIn URL, role, workspace membership, usage events, invoicing details where relevant, and communications with our team.

Job briefs and mandates: the text you write or upload (including any personal data you choose to include), swipe feedback, criteria, personas, notes, pipeline stage changes and other events.

Candidate data we surface: name, professional headline, current and past roles, education, skills, public profile links, contact details we obtain from public or licensed sources, and any assessments generated by our ranking and evaluation models. We do not intentionally seek or store special-category data (e.g. health, religion, political opinion, sexuality), and we apply automated filters that attempt to strip or redact such fields.

Cookies and similar technologies: see the Cookie Policy.

3. How we collect it

directly from you (account creation, forms, uploads, messages, briefs);
automatically as you use the Platform (event logs, cookies, local storage);
from publicly available sources and licensed data providers when we build Candidate profiles;
from AI systems that generate rankings, summaries and personas from the inputs above.

4. Why we use personal data and legal bases (UK / EEA)

Where UK GDPR or EU GDPR applies, our legal bases are:

Contract, to provide the Platform, to fulfil Client instructions, and to invoice Success Fees.
Legitimate interests, to source and surface potential Candidates to Clients, to secure and improve the Platform, to prevent fraud and abuse, to run our business and, where lawful, to send business-to-business promotional emails to relevant contacts. We have carried out balancing tests where required.
Legal obligation, to comply with tax, accounting, anti-money-laundering, employment, and other applicable law.
Consent, for optional analytics or marketing cookies, and for any other processing where consent is required by law. You can withdraw consent at any time.

Candidates have a right to object to processing based on our legitimate interests; see section 9.

5. AI processing

The Platform uses large language models and other AI systems to generate suggestions, personas, shortlists and message drafts. Prompts and outputs may be transmitted to model providers under contractual terms that restrict them from using your inputs or outputs to train their foundation models. Human reviewers may access samples of AI Output for quality, safety, and abuse-prevention purposes under confidentiality obligations.

AI Output can be inaccurate. Clients are contractually required to independently verify AI Output before acting on it and not to rely on it as the sole basis for an employment decision.

6. Sharing

We share personal data only with:

Sub-processors that operate the Platform on our behalf, including hosting (Cloudflare), database, authentication and storage (Supabase), email delivery providers, AI inference providers, and error/observability tooling. Each sub-processor operates under a written data processing agreement with appropriate safeguards.
Clients who have accepted a Candidate through the Platform. We share the Candidate's professional profile and (once accepted) their contact details for the Client to reach out directly.
Advisers and auditors under duties of confidentiality.
Authorities and law-enforcement when required by law, valid legal process, or to protect rights, safety, security, or property.
Successors in a merger, acquisition, reorganisation, or asset transfer, subject to confidentiality.

We do not sell personal data.

7. International transfers

We are based in the United Kingdom and our sub-processors may process personal data in the UK, the European Economic Area, the United States, and other jurisdictions. Where a transfer is a UK Restricted Transfer or an EEA restricted transfer, we rely on an adequacy decision where one applies, the UK International Data Transfer Addendum, the EU Commission Standard Contractual Clauses, or an equivalent lawful transfer mechanism, together with supplementary measures where appropriate.

8. Retention

We retain personal data only for as long as we need it for the purposes described in this Policy, plus any period needed to comply with legal, tax and accounting obligations or to establish, exercise or defend legal claims.

Account data, for the life of the account and up to twelve (12) months after closure, unless required for longer.
Mandate and brief data, for the life of the workspace and up to twenty-four (24) months after the last activity, unless the Client instructs earlier deletion.
Candidate profiles surfaced but never Introduced, periodically refreshed and purged; contact details are retained only for the sourcing pipeline in question.
Introduced Candidates, retained for the twelve-month Success Fee tracking window and audit period, and up to twenty-four (24) months thereafter.
Invoicing, tax and accounting records, for at least six (6) years, or longer where required by law.
Security logs, typically thirteen (13) months.

9. Your rights

Depending on where you are located, you may have rights to:

access personal data we hold about you;
request correction of inaccurate or incomplete data;
request deletion of your data;
restrict or object to processing (including profiling), particularly where processing is based on our legitimate interests or for direct marketing;
request portability of data you provided to us;
withdraw consent where processing is based on consent;
lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email privacy@startuproles.co. We will respond within the timeframe required by applicable law (usually one month). We may need to verify your identity before actioning your request.

California residents. We do not sell or "share" personal information as defined by the CCPA/CPRA. You may still exercise access, deletion, correction, and opt-out rights by contacting us at the address above.

10. Candidates: how to reach us

If you are a Candidate and want to know whether we hold information about you, ask us to update or delete it, or object to our processing, please email privacy@startuproles.co. If a specific Client contacted you using details we surfaced, that Client also holds a copy of your data as an independent controller; you may need to contact them directly for outreach they conducted.

11. Security

We use administrative, technical and physical safeguards appropriate to the risk, including encryption in transit (TLS) and at rest, least-privilege access controls, row-level security in our database, audit logging, vulnerability scanning, and staff access reviews. No system is perfectly secure, so we cannot guarantee absolute security.

If we become aware of a Personal Data Breach affecting your data, we will comply with our notification obligations under applicable law.

12. Automated decision-making

The Platform uses ranking and matching models to help Clients decide whom to consider. These outputs are advisory inputs to a human hiring decision, and we do not use them to produce legal or similarly significant effects on any Candidate without meaningful human involvement.

13. Children

The Platform is not directed to children under 18 and we do not knowingly collect personal data from them. If you believe we hold personal data about a child, please contact us and we will delete it.

14. Third-party links

The Platform may contain links to third-party sites (for example, public profiles). We are not responsible for the privacy practices of those sites; please review their privacy policies.

15. Changes

We may update this Policy from time to time. Material changes will be notified by updating the Effective Date above and, where appropriate, by email or in-product notice.

16. Contact

Privacy questions: privacy@startuproles.co. Legal questions: legal@startuproles.co.