Privacy Policy

1. Who we are

RuneShips is operated by [legal entity name, e.g. RuneShips LLC, a California limited liability company] ("RuneShips," "we," "us").

For account holders (recruiters, companies, candidates who sign up and career centres) we are the controller of the personal information described here. For information about candidates that a recruiter sources, the recruiter decides why and how it is used, and we process it on the recruiter's behalf [confirm controller/processor roles with counsel]. Section 7 explains this.

Contact: hello@runeships.com · Mail: [postal address]

This policy covers runeships.com, the RuneShips Chrome extension, our apps and related services (the "Service"). The extension has its own short disclosure, which forms part of this policy.

2. Information we collect

From recruiters and account holders

• Account details: name, email address, employer, role, and whether you're a recruiter, company, candidate or career centre.
• Hiring details: roles, search criteria, tasks you assign, shortlists, notes and decision logs.
• Connected accounts: when you connect Greenhouse, Ashby or an email inbox, the access tokens and the data those services send us for the role you're hiring for.
• Billing details: none today. RuneShips doesn't take payments during the launch. If paid plans are introduced later, card numbers will be held by a payment processor, not by us, and we'll update this policy first.

About candidates a recruiter sources

• Profile information visible to the recruiter in the sourcing tool they're using, such as Juicebox: name, current title and employer, location, work and education history, and public portfolio or code links.
• Application information from the recruiter's own Greenhouse or Ashby account: past and current applications, résumés and stage history for relevant roles.
• What we generate: match scores against the recruiter's criteria, and a ranking.
• Outreach records: messages sent on the recruiter's behalf, whether you replied, and your reply.

From candidates who take a task or sign up

• Work you submit: code, files, links, written reasoning and time taken on timed tasks.
• Evaluations: scores on five dimensions (strategy, execution, communication, technical skill, creativity), written feedback, level and trend.
• Interview practice, on plans that include it: audio recordings of your answers and their transcripts.
• Profile details you choose to add.

Collected automatically: server and security logs (IP address, browser and device type, pages requested, timestamps), essential cookies and local storage (see the Cookie Policy), and aggregate usage statistics from our hosting provider.

What we don't collect: we don't buy data from data brokers. The extension only reads pages a recruiter opens and asks it to read, in tools that recruiter is licensed to use. We don't create voiceprints or other biometric identifiers, and we don't infer sensitive characteristics such as race, religion, health or sexual orientation.

3. How we use it, and our legal bases

Legal bases apply to people in the EEA, UK and Switzerland. Everywhere else, the purposes are the same.

We don't sell personal information. We don't "share" it for cross-context behavioural advertising, as California law defines that term, and we don't show ads.

4. AI and automated evaluation

We use AI models, currently provided by OpenAI, to rank sourced profiles against a recruiter's criteria, draft outreach, score submissions, write feedback, and transcribe interview practice.

• Rankings and scores are advisory. RuneShips doesn't decide whether anyone gets a job, an interview or any other opportunity. Recruiters make those decisions.
• People approve outreach. Messages go out only after a recruiter approves them.
• You can ask for human review of any score, contest it and add context. Email hello@runeships.com.
• You can ask how a score or ranking was produced, and we'll explain the criteria and main factors.
• No model training by our providers. Our AI providers process content to return results to us, under terms that don't allow them to train their models on it.

5. What recruiters can see

• If a recruiter sources you, that recruiter's team sees the profile information gathered for the role, your match score and ranking, and the status of any outreach. [Confirm whether other RuneShips customers can ever see a sourced profile. The draft assumes they can't.]
• If you take a task, the recruiter who assigned it sees your submission, the time you took, its evaluation and your write-up.
• Interview practice recordings and transcripts are private. Recruiters never see them.
• Deleting or opting out stops further use from that point on. It can't recall copies a recruiter already exported. Recruiters must delete those on request (see our Terms), and we'll pass your request on.

6. Who we share it with

We use service providers that process data on our behalf, under contracts that limit how they use it:

• With recruiters and employers, as described in Section 5.
• With career centres, only as aggregated, de-identified cohort statistics.
• For legal reasons: to comply with law or valid legal process, and to protect the rights, safety and property of our users, the public or RuneShips.
• In a business transfer, such as a merger or acquisition. This policy continues to apply, and we'll tell you before your information becomes subject to a different policy.

7. Recruiters as controllers of the candidates they source

When a recruiter uses RuneShips to source, contact and evaluate candidates, the recruiter decides whom to look for and why, and is responsible for having a lawful basis, for its own notices where the law requires them, and for its compliance with employment, privacy and anti-discrimination law. We act on the recruiter's instructions for that data [confirm processor/service-provider role and put a data processing agreement in place].

Our Terms require recruiters to use candidate information only to recruit for real roles, to keep it confidential, to honour opt-outs, and to delete it when it's no longer needed or when the candidate asks.

8. International transfers

We and our providers process data in the United States and possibly other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism. Ask us for a copy of the relevant safeguards.

9. How long we keep it

We may keep information longer where the law requires it, or to resolve disputes and enforce our agreements. De-identified, aggregated data that can no longer identify you may be kept indefinitely.

10. Your rights and choices

Depending on where you live, you can:

• Find out whether we hold information about you, and where it came from
• Access it, and get a portable copy
• Correct inaccurate information
• Delete your information
• Object to, or restrict, processing based on legitimate interest, including sourcing and ranking
• Ask never to be contacted through RuneShips again
• Opt out of the sale or sharing of personal information, and of profiling in furtherance of decisions with legal or similarly significant effects. We don't sell or share, but the right is yours.
• Ask for human review of an automated evaluation or ranking
• Complain to your data protection authority, if you're in the EEA, UK or Switzerland

How to use these rights: use the opt-out link in any message, the settings in your account, or email hello@runeships.com. We answer within 30 days, or sooner if the law requires it (45 days under most US state laws, extendable once where allowed). We may need to verify your identity. You can use an authorised agent.

Appeals: if we decline your request, reply to our decision with "Appeal" in the subject line. If you're still unhappy, you can contact your state attorney general. We won't discriminate against you for using these rights.

11. Notice for California residents

In the last 12 months we collected these categories of personal information, as defined by the CCPA: identifiers (name, email, IP address); professional or employment-related information and education information (titles, employers, work history, résumés, work samples); commercial information (plan and payment history); internet activity (logs); audio information (interview practice recordings); and inferences (match scores, rankings and evaluations).

Sources include you, recruiters and the tools they connect or use with the extension (such as Juicebox, Greenhouse and Ashby). Purposes, recipients and retention periods are in Sections 3, 6 and 9. We don't sell or share personal information, and we don't knowingly sell or share the personal information of anyone under 16.

12. Cookies

We use only the cookies and local storage needed to run the Service. The Cookie Policy has the details. We honour Global Privacy Control signals.

13. Age requirements

RuneShips is for people aged 16 and over. We don't knowingly collect personal information from anyone under 16, and recruiters may not use RuneShips to source anyone under 16. If we learn we have such information, we delete it. Contact hello@runeships.com.

14. Security

We use encryption in transit (HTTPS) and at rest, access controls including row-level security on our database, least-privilege access for staff, and reputable infrastructure providers. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the relevant authorities as the law requires.

15. Changes to this policy

We'll post changes here and update the "Last updated" date. For material changes, we'll email account holders at least 14 days before the change takes effect.

16. Contact

hello@runeships.com · [legal entity name], [postal address] · EEA/UK representative: [if required]