The short version
- Recruiters only see a student's work if the student opts in. You can turn visibility off at any time.
- We don't sell your personal information, and we don't use it for advertising.
- AI helps score submissions. Scores are advisory, and you can ask a person to review any of them.
- We don't create voiceprints or other biometric identifiers from interview recordings.
- You can download or delete your data at any time.
1. Who we are
RuneShips is operated by [legal entity name, e.g. RuneShips LLC, a California limited liability company] ("RuneShips," "we," "us"). We are the controller of the personal information described in this policy, except where Section 7 says a recruiter or employer acts as an independent controller.
Contact: hello@runeships.com · Mail: [postal address]
This policy covers runeships.com, our apps, and related services (the "Service"). It doesn't cover third-party sites you reach through links.
2. Information we collect
Information you give us
- Account details: name, email address, and whether you're a student, recruiter, company or career centre.
- Student profile: school, expected graduation year, career interests, self-rated skills, and anything else you choose to add.
- CV or résumé, if you upload one for the job scout. Please leave out government ID numbers, health information, and anything else you wouldn't want an employer to see.
- Work you submit: task submissions, written reasoning, links, files and code.
- Interview practice, on plans that include it: audio recordings of your answers and the transcripts made from them.
- Recruiter and company details: name, work email, employer, role, tasks you post, shortlists, notes and decision logs.
- People screened with Scout: when a recruiter switches on the Scout browser extension, it sends us what the recruiter's own screen shows for each person in their search results (name, headline, a short snippet and the profile link) so our AI can score the fit against the recruiter's role. We keep only the name, the profile link and Scout's score and reasons, in that recruiter's list. We don't keep the rest of what was on screen.
- Billing details: none today. RuneShips doesn't take payments during the launch. If paid plans are introduced later, card numbers will be collected and stored by a payment processor, not by us, and we'll update this policy first.
- Messages you send us, including support requests and feedback.
Information we generate
- Scores on five dimensions (strategy, execution, communication, technical skill, creativity), written feedback, your level and your trend over time.
- Rankings and comparisons derived from those scores.
- Job matches from the job scout, and the reasons given for each.
Information collected automatically
- Server and security logs: IP address, browser and device type, pages requested, and timestamps.
- Essential cookies and local storage (see Section 12).
- Aggregate, non-identifying usage statistics from our hosting provider.
What we don't collect
We don't buy data about you from brokers. We don't scrape profiles from other sites. We don't create voiceprints, face geometry, or other biometric identifiers, and we don't infer sensitive characteristics such as race, religion, health, or sexual orientation.
3. How we use it, and our legal bases
Legal bases apply to users in the EEA, UK and Switzerland. Everywhere else, the purposes are the same.
| Purpose | Legal basis |
|---|---|
| Create and run your account; deliver tasks, feedback, the job scout and interview practice | Contract |
| Show your work to recruiters when you opt in | Consent, which you can withdraw at any time |
| Let recruiters run tasks, compare submissions and keep shortlists | Contract, with the recruiter; consent, for the student's visibility |
| Process payments and keep billing records | Contract; legal obligation (tax and accounting) |
| Send service emails: sign-in links, feedback ready, changes to your plan | Contract |
| Calibrate and improve scoring, using submissions and scores in de-identified or aggregated form | Legitimate interest in accurate, fair evaluation; you can object (Section 10) |
| Confirm that a company or recruiter account belongs to the organisation it names, using the work email's domain and a one-time code | Legitimate interest in keeping impersonated or fake employers off the Service; contract |
| Score the people a recruiter has on screen with Scout, and keep the recruiter's list | Contract, with the recruiter; legitimate interest (the recruiter's, as an independent controller under Section 7, and ours in providing the tool) |
| Security, fraud and abuse prevention; enforcing our Terms | Legitimate interest; legal obligation |
| Optional product updates and newsletters | Consent; unsubscribe in any email |
We don't sell personal information. We don't "share" it for cross-context behavioural advertising, as California law defines that term, and we don't show ads.
4. AI and automated evaluation
We use AI models, currently provided by Anthropic, to help score submissions, write feedback, read CVs for the job scout, and transcribe and review interview practice. Here is how that works:
- Scores are advisory. They help you understand your work. RuneShips doesn't decide whether anyone gets a job, an interview, or any other opportunity.
- Recruiters make hiring decisions, not RuneShips. Evaluations in paid task runs are reviewed by a person before recruiters rely on them.
- You can ask for human review of any score, contest it, and add context. Email hello@runeships.com and a person will re-evaluate the submission.
- You can ask how a score was produced. We'll explain the rubric, the dimensions and the main factors involved.
- No model training by our providers. Our AI providers process your content to return results to us, under terms that don't allow them to train their models on it.
5. What recruiters can see
Students choose whether recruiters can see them. Visibility is off until you turn it on.
- When visibility is on, recruiters can see your name, school, graduation year, the submissions you've made visible, their evaluations, and your level and trend. Your email address and CV are only shared if you choose to share them, for example by replying to a recruiter.
- Interview practice recordings and transcripts are private. Recruiters never see them.
- When you apply to a recruiter's task run, that recruiter can see the submission you made for it, whatever your general visibility setting.
- Turning visibility off stops recruiters from finding or opening your profile from that point on. It can't recall copies a recruiter already made, such as a shortlist export. Recruiters must delete those copies on request (see our Terms), and you can ask us to pass that request on.
7. Recruiters and employers as independent controllers
When a recruiter views, exports or acts on a candidate's information for its own hiring, it does so as an independent controller, responsible for its own compliance with employment, privacy and anti-discrimination law. Our Terms require recruiters to use candidate information only for recruiting, to keep it confidential, and to delete it when it's no longer needed or when the candidate asks.
8. International transfers
We and our providers process data in the United States and possibly other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism. Ask us for a copy of the relevant safeguards.
9. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, submissions and evaluations | While your account is open. Deleted within 30 days of account deletion. |
| Interview recordings and transcripts | Until you delete them or close your account |
| Uploaded CV | Until you replace or delete it, or close your account |
| Company accounts after a free premium period | Kept. Premium features pause; nothing is deleted because a free period ends. |
| Billing and tax records | As long as tax and accounting law requires, typically up to 7 years |
| Security and server logs | Up to 12 months |
| Backups | Up to 90 days, then overwritten |
We may keep information longer where the law requires it, or to resolve disputes and enforce our agreements. De-identified, aggregated data that can no longer identify you may be kept indefinitely.
10. Your rights and choices
Depending on where you live, you can:
- Access your personal information, and get a portable copy of it
- Correct inaccurate information
- Delete your information
- Object to, or restrict, certain processing, including calibration based on legitimate interest
- Withdraw consent, including recruiter visibility, at any time
- Opt out of the sale or sharing of personal information, and of profiling in furtherance of decisions with legal or similarly significant effects. We don't do any of these, but the right is yours.
- Ask for human review of an automated evaluation (Section 4)
- Complain to your data protection authority, if you're in the EEA, UK or Switzerland
How to use these rights: use the settings in your account, or email hello@runeships.com. We answer within 30 days, or sooner if the law requires it (45 days under most US state laws, extendable once where allowed). We may need to verify your identity. You can use an authorised agent; we may ask for proof of their authority.
Appeals: if we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. If you're still unhappy after the appeal, you can contact your state attorney general.
We won't discriminate against you for using these rights.
11. Notice for California residents
In the last 12 months we collected these categories of personal information, as defined by the CCPA: identifiers (name, email, IP address); professional or employment-related information and education information (school, graduation year, CV, work samples); commercial information (plan and payment history); internet activity (logs); audio information (interview practice recordings, if you use them); and inferences (scores, levels and job matches).
The sources, purposes, recipients and retention periods are described in Sections 2, 3, 6 and 9. We don't sell or share personal information, and we don't knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to provide the Service, as permitted by law. Under California's "Shine the Light" law, you can ask whether we disclosed personal information to third parties for their direct marketing; we don't.
13. Age requirements
RuneShips is for people aged 16 and over. We don't knowingly collect personal information from anyone under 16. If we learn we have, we delete it and close the account. Paid plans require you to be 18 or older, or to have a parent or guardian's permission and payment. If you believe a child under 16 has given us information, email hello@runeships.com.
14. Security
We use encryption in transit (HTTPS) and at rest, access controls including row-level security on our database, least-privilege access for staff, and reputable infrastructure providers. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the relevant authorities as the law requires.
15. Changes to this policy
We'll post changes here and update the "Last updated" date. For material changes, we'll email active users at least 14 days before the change takes effect. Where the law requires consent to a change, we'll ask for it.
16. Contact
Questions or requests: hello@runeships.com
[legal entity name], [postal address]
Users in the EEA or UK: [EU / UK representative, if one is required once you have users there]