Privacy Policy

Version 1.3 · Effective 2 November 2026

The “In short” lines are plain-language summaries for convenience only; the numbered clauses are the binding text.

Which information applies to you?

This notice covers people using Rolio to hire, people applying for jobs, and visitors to our website. Our role depends on how you use Rolio.

If you use Rolio for hiring

Rolio is responsible for your account information and how you use our service. Your company is responsible for the candidate information in its workspace; we process that information on its behalf. See section 2 for these responsibilities and section 3 for the information we process.

If you apply for a job

The company you apply to is responsible for your application and its hiring decisions. Rolio provides the software and processes your application on that company’s behalf. Read the company’s privacy notice for how it uses your information and how long it keeps it. Contact that company about accessing, correcting or deleting your application; we can help direct your request. Applying for a job does not create a Rolio hiring account or automatically join you to our talent pool.

If you join the optional Rolio talent pool

This is separate from applying for a job. Rolio is responsible for talent-pool data, based on your separate opt-in. Read the Talent Pool Privacy Notice.

The sections below also explain service providers, security, retention, your rights and website cookies.

1. General

In short: Rolio is operated by Cofounderie in Dubai. Our responsibility for your data depends on whether you use Rolio for hiring, apply to a company, or join our talent pool, as explained below.

1.1 This policy provides transparency about how COFOUNDERIE TECHNOLOGY FZCO, Trade License 41226, Office 301, A2 Building, Dubai Silicon Oasis, Dubai, United Arab Emirates (“Cofounderie,” “Rolio,” “us,” or “we”) collects, receives, processes, uses, discloses, or shares your information. When you use our websites, applications, or other services (the “Services”) or otherwise form a relationship with us, we may obtain data from you or your devices.

1.2 We handle your personal information confidentially and responsibly, and any processing of your personal information happens in compliance with applicable data protection laws, including the UAE Federal Personal Data Protection Law (“PDPL”), Indonesia’s Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) where it applies to you, and, where it applies to you, the General Data Protection Regulation (“GDPR”).

1.3 We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and access. These measures include encrypted transmission, encryption at rest appropriate to the service and risk, hashed password storage, access controls, tenant-level authorization, and error monitoring. No system is completely secure, and we cannot guarantee absolute security.

1.4 We may update this policy to reflect changes in law, the Services, or our practices. We will post the updated policy and revise the date above. Where a change is material, we will provide additional notice appropriate to the change. If applicable law requires consent for a new processing purpose, we will request it before beginning that processing.

2. Roles: when we are controller and when we are processor

In short: For your account and this website, we are responsible for your data. For job applications and candidate records, the company concerned is responsible — we process on its behalf.

2.1 Rolio is the controller, within the meaning of the PDPL, the PDP Law and the GDPR, for account, website-visitor, support, and business-administration data, and for limited security, fraud-prevention, and legal-compliance data where it determines those purposes itself.

2.2 Rolio is applicant-tracking software used by companies to receive and manage job applications. For applicant and candidate data in a company's workspace — whether submitted by the person through a Rolio-powered job board or uploaded or entered by the company, for example a CV added by a recruiter — the company determines the recruitment purposes and ordinarily acts as controller, and Rolio processes that data on the company's behalf as its processor. Companies are responsible for ensuring that data they upload about a person was collected lawfully and that any legally required notice has been given.

2.3 If you wish to exercise your data protection rights with respect to a job application or a candidate record (for example access, correction, or deletion), please direct your request to the company concerned; we support them in fulfilling such requests, and you can also contact us at support@getrolio.com and we will forward your request.

3. Information we collect

In short: Server logs, your account details, what you create in your workspace, applications and CVs (handled for the company), and contact messages. No payment details are needed for the free software. Paid recruiting engagements have separate business records.

3.1 If you visit the Websites, we process only data that your browser communicates to our servers, which is necessary to display the Websites correctly and guarantee the necessary stability and safety: IP address; date and time stamp; requested page; access status/HTTP status code; transmitted data volume; the site from which the request was sent; browser, operating system, and browser language and version.

3.2 When you register for a Rolio account, we process your email address, your full name, a password (stored in hashed form), and a record of your acceptance of the Terms and Conditions (version and timestamp). If you arrived through a link on our website, we may record which page or button led you to sign up.

3.3 When you use Rolio, we process your account details (including an optional profile photo, which your teammates see, and your time-zone setting), preferences and workspace data, including job and candidate information, files and team communications. We also process activity records to operate and secure the Services. The first time you open the app, we ask whether you want to share diagnostics with us. Nothing is collected until you answer, and nothing at all if you choose “Don’t share”; in that case we ask again once a month, and you can keep saying no. If you choose “Share”, we count which parts of the app you open, such as reports, job boards and My work (the kind of event, the time and the ids involved), and your browser times how long common actions take, such as changing a candidate’s stage or opening a page, together with your connection type, the app version and the time. Your browser keeps these timings on your device and sends them to us about once a day; we keep them for 90 days. Diagnostics never include text, names, CV content or anything you type. You can change your answer at any time under Settings › Preferences › Share diagnostics; turning it off stops both straight away, sends any timings already on your device and clears them there. For data exports, we prepare the requested records and verify who is authorized to receive them.

3.4 We process applicant and candidate data on behalf of the company concerned (see section 2.2): name, email address, answers to application forms, and documents such as CVs — whether submitted by the person through a job board or uploaded by the company. CVs and application answers may incidentally contain sensitive information; companies should configure their forms to avoid collecting information that is not necessary and are responsible for any legal basis required for sensitive data.

3.5 When you contact us, we process your contact details and your message. The contact form on this website sends your name, your email address if you give one, the topic you select and your message to a contact service we operate on Supabase (European Union). We keep the message so our team can answer it, together with a one-way hash of your IP address to limit abuse, and deliver it to support@getrolio.com through our email provider MailerSend. We do not email a copy of your message back to you. The “Let’s talk to Cofounderie” link on our “How we build” page opens a form operated by Cofounderie on Microsoft Forms; Microsoft hosts that form as our service provider (see section 5.2) and we read your answers in our Microsoft 365 account. We handle enquiries on the basis of our legitimate interest in responding to them (Art. 6(1)(f) GDPR) or, where the enquiry concerns a contract with you, Art. 6(1)(b) GDPR.

3.6 No payment or credit card details are required to use the free software. If you engage us for paid sourcing or recruiting support, we process the business contact details, agreed scope, invoices and payment records needed to administer that engagement and meet accounting obligations. We issue invoices ourselves and use no third-party invoicing or payment provider; if that changes, we will name the provider in section 5.2 first.

3.7 What you must provide. To open an account you need a name, an email address and a password; without them there is no account. To apply for a job you need the details the company has marked as required on its application form; without them the application cannot be sent. Everything else, including the talent-pool checkbox, is optional, and leaving it out has no other consequence.

4. Use of information and legal bases

In short: We use data to run the product, support you, keep things secure, and improve the Services — mostly because the contract requires it, not blanket “consent.”

4.1 The processing of data pursues the following purposes (“Purposes”):

  • providing the Services, including storing and displaying job postings and applications, and AI-assisted CV extraction as described in section 5.3;
  • customer relationship management (e.g. support and responding to inquiries);
  • communicating with you about the Services (transactional messages such as team invitations, account notices, and security alerts), and notifying teammates by email about mentions, tasks and new applications; a notification about a new application may include the applicant’s name, location, current role, source and first answers, and a mention or task email quotes the comment and names the person it concerns. These emails are sent through MailerSend (see section 5.2);
  • ensuring safety and security, including error monitoring and abuse prevention;
  • improving the Services; and
  • protecting our legitimate business interests and legal rights.

4.2 We rely on the following legal bases, purpose by purpose: account creation, authentication, workspace functions, and transactional communications rest on the performance of a contract or steps taken at your request before a contract (Art. 6(1)(b) GDPR; contract necessity under the PDPL). Support and sales inquiries rest on contract or pre-contract steps and our legitimate interests. Security, fraud prevention, error monitoring, and service integrity rest on our legitimate interests and legal obligations (Art. 6(1)(f) and (c) GDPR). Improving the Services rests on our legitimate interest in a product that works (Art. 6(1)(f) GDPR); for this we use account data and the activity records described in section 3.3. The diagnostics in section 3.3 (usage counts and speed timings) rest on your consent, given by choosing “Share” (Art. 6(1)(a) GDPR; consent under the PDPL and the PDP Law), which you can withdraw at any time in Settings. We look at the content of a specific CV only to investigate a problem, for example when extraction has produced wrong or missing details, limited to the document concerned and to authorized staff; CV content is never used to train AI models (section 5.3). Legal claims and compliance rest on legal obligations and the establishment, exercise, or defense of legal rights. Recording which ad campaign a sign-up came from rests on our legitimate interest in knowing which advertising works (Art. 6(1)(f) GDPR; section 8.4). Measuring our advertising with Meta rests on your consent (Art. 6(1)(a) GDPR; consent under the PDPL and the PDP Law; section 8.3). Applicant and candidate data in a company workspace is processed on the company's documented instructions; the company is responsible for the legal basis of that processing.

5. Information we share

In short: We use service providers to run Rolio, including AI-assisted CV processing. Public job boards are public; workspace records are shared with authorized users. The optional talent pool has separate rules below. We do not sell personal data.

5.1 We transmit data to third parties only as necessary for the Purposes, due to a request from a national authority, a court ruling, or if you have consented beforehand. We do not sell personal data. Apart from the Meta measurement you can accept on our website (section 8.3), we do not share it for third-party marketing.

5.2 We carefully select the service providers that process data on our behalf, especially concerning the suitability of their organizational and technical measures, and conclude appropriate data processing agreements. We currently use:

  • Supabase, Inc. (USA) — database, authentication, and file storage (including uploaded CVs), hosted in the European Union in Frankfurt, Germany (AWS eu-central-1);
  • Google LLC (USA) — hosting of the Rolio application on Firebase App Hosting in the European Union (Netherlands, europe-west4);
  • Functional Software, Inc. (Sentry) (USA) — error monitoring, and performance monitoring on about 10% of page loads;
  • MailerSend, Inc. (USA) — transactional email delivery;
  • OpenRouter, Inc. (USA), which passes the request to Google LLC (USA) for its Gemini models — AI-assisted extraction of structured information from uploaded CVs (see section 5.3);
  • Render Services, Inc. (USA) — hosting for our internal CV-processing service; and
  • Microsoft Corporation (USA) — hosting of the Cofounderie contact form (Microsoft Forms) linked from our “How we build” page (see section 3.5).

5.3 When a company user asks Rolio to parse a CV, the document is processed by our CV-processing service and AI service providers identified in section 5.2 to extract structured information, such as contact details, roles and skills. Text such as job titles, role descriptions, degrees and skills may be translated into English; names, organisations and contact details are kept as written. When a person is added from a CV, the contact details are shown for review before saving; everything extracted can be edited afterwards. Rolio does not use this feature to rank applicants or make hiring decisions. Rolio does not train AI models on CV content.

5.4 We may also disclose data to professional advisers, insurers, auditors, or authorities where legally necessary, and to a successor in connection with a merger, financing, reorganization, or sale of all or part of our business, subject to appropriate safeguards.

5.5 Where your data is stored and processed. Our database, user accounts and uploaded files (including CVs) are stored with Supabase in the European Union, in Frankfurt, Germany (AWS eu-central-1). The Rolio application runs on Firebase App Hosting in the European Union (Netherlands, europe-west4). Three kinds of processing take place outside the European Economic Area: (a) our own team, based in the United Arab Emirates, accesses data as needed to operate and support Rolio; (b) some providers listed in section 5.2 process data in the United States, namely transactional email delivery (MailerSend), error and performance monitoring (Sentry), AI-assisted CV extraction (OpenRouter and Google’s Gemini models) and our CV-processing service on Render; and (c) if you accept advertising cookies on our website, Meta may process the data described in section 8.3 in the United States. For data of persons in the European Economic Area we rely on the safeguards of Art. 44 et seq. GDPR: for our team’s access from the United Arab Emirates, the EU standard contractual clauses (Module Two, controller to processor) incorporated into our Data Processing Agreement; for United States providers, their data processing agreements including the EU standard contractual clauses or, where the provider is certified, the EU–US Data Privacy Framework; for Meta, Meta’s certification under the EU–US Data Privacy Framework and its standard contractual clauses. For data of persons in Indonesia, we transfer personal data outside Indonesia only as the PDP Law allows: to a country with an adequate level of protection, under appropriate and binding safeguards such as those above, or with your consent. You can request a copy of the safeguards applied by contacting us.

5.6 Jobs and company information that you publish on a hosted or embedded job board are public and may be indexed by search engines. Candidate records, CVs and internal comments are not made public merely because you publish a job board. Authorized workspace users can access information according to their permissions. Companies are responsible for choosing who has access and for handling copies they download or share. A company website hosting an embedded board may use its own cookies and services; its privacy notice also applies to those activities.

6. Keeping, exporting and deleting information

In short: You can request a copy of your data. Closing your personal account and deleting a company workspace are different actions; retention depends on whose data it is and why it is held.

6.1 We retain account data while needed to provide your account. Workspace recruitment records are retained according to the company's instructions and legal obligations. Removing a teammate or deleting their personal account does not automatically delete the company's candidate records, comments or activity history. After you delete your account, your full name stays on the comments and activity you left in the companies you worked in. The company must review how long recruitment records are needed; closing a vacancy does not itself delete its applications. Talent-pool retention is described separately in section 10.

6.2 How long deletion takes. Deleting an application in Rolio removes it at once; notifications already delivered to teammates, in their Inbox or by email, keep the name they showed. Deleting a person or a company first hides it and stops all processing; the remaining data is then erased on request to support@getrolio.com, within 30 days of the request. A closed company can still be exported through support during that time. A verified deletion request is completed within 30 days. Backup copies are overwritten on our provider's regular cycle and are never used for anything else; a restored backup has the deletion reapplied. Support correspondence and technical logs are kept only as long as the matter, security or our operations need them, and beyond that only where a legal obligation, an investigation or a legal claim requires it.

6.3 Data will be deleted if you (a) revoke your consent to storage that rests on consent, (b) the data is no longer needed to fulfill the user contract concerning the Services, or (c) the storage is or becomes legally impermissible. A deletion request does not affect data whose storage is legally necessary.

6.4 Authorized company representatives can request a workspace data export at support@getrolio.com or use available in-app controls. We verify authorization and confirm the export’s scope and format. Request an export before workspace deletion. Exporting does not delete data in Rolio, and deleting data in Rolio does not delete downloaded copies. The company is responsible for securing and retaining those copies appropriately.

6.5 A workspace export is different from an individual's request for their own personal data. If a candidate asks for a copy, the company must check the relevant records and protect other people's personal data before sharing them; a whole-workspace download should not be sent to an individual applicant.

6.6 Rolio keeps a record of compliance actions, such as exports, deletions, role changes and erasures, to show what was done, by whom and when. We will state how long this record is kept once its deletion runs automatically.

7. Rights

In short: You can access, correct, delete, export, and object — email support@getrolio.com. You can also complain to a data protection authority.

7.1 To exercise the rights defined in this section, please send a request via email to support@getrolio.com. We may need to verify your identity before acting on a request, and an authorized agent may act for you where the law allows. Rights are subject to legal exceptions. We respond within the time applicable law requires and explain any extension the law permits. Requests are normally free of charge, subject to the exceptions allowed by applicable law. For rights concerning a job application or candidate record, please also see section 2.3.

7.2 You can revoke consent for future data processing at any time. This does not affect the lawfulness of processing based on the consent before the revocation. Should the processing of data be lawful on another ground stated in paragraph 4.2, we may continue to process your data on those grounds.

7.3 You have the right to obtain (i) confirmation as to whether or not we are processing your data and, if so, (ii) more specific information on the data, concerning among others processing purposes, categories of data, potential recipients, or the duration of storage, including information about automated processing as described in section 5.3.

7.4 You have the right to obtain from us the rectification of inaccurate data concerning you.

7.5 You have the right to request erasure of your data. Should mandatory provisions of law prevent erasure, we will inform you without undue delay.

7.6 You have the right to obtain a restriction of processing where the accuracy of the data is contested, the processing is unlawful but you oppose erasure, you still require the data for the establishment, exercise, or defense of legal claims, or you have objected to the processing.

7.7 Where the applicable conditions for data portability are met, you can receive personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller. Under the GDPR this applies to automated processing based on consent or contract, and includes direct transmission where technically feasible. Your separate right of access is not limited to portable data. We respect the rights and freedoms of others when providing a copy.

7.8 You have the right to object at any time to the processing of data based on our legitimate interests. Where applicable law grants rights concerning solely automated decisions, those rights remain unaffected; as described in section 5.3, Rolio itself makes no such decisions.

7.9 You have the right to lodge a complaint with a supervisory authority — in the UAE, the UAE Data Office; in Indonesia, the authority responsible for personal data protection under the PDP Law; where the GDPR applies to you, the supervisory authority of your habitual residence or place of the alleged infringement.

8. Cookies, analytics, and advertising

In short: We use browser storage for preferences and login. The marketing website has no analytics or advertising trackers; the application has a separate setup described below.

8.1 The marketing website loads no analytics or advertising trackers unless you accept them in the cookie banner (section 8.3), and its fonts are served from our own site rather than fetched from Google. It uses local storage on your device to remember your selected theme and, when a consent choice is presented, that choice. Local storage is not a cookie, but it still stores information in your browser. You can clear it through your browser settings; doing so resets those preferences.

8.2 The Rolio application uses session cookies for signing in, and two preference cookies: rolio-locale, which remembers your language for one year, and rolio-last-org, which remembers the last company you opened so the app reopens it. It also uses browser storage for interface preferences and settings. These are needed for the app to work as you set it up, so they don’t ask for consent. Clearing login cookies signs you out; clearing local storage may reset your preferences. The application loads no analytics or advertising scripts either; the diagnostics in section 3.3 are collected by Rolio’s own code and servers, not by a third-party script, and only if you chose to share them. The speed timings wait in your browser’s storage until they are sent. Custom fonts on job boards are served by Rolio, so a visitor’s browser does not contact Google for them.

8.3 Meta Pixel (advertising measurement). We advertise Rolio on Facebook and Instagram. If you click “Accept” in the cookie banner on our marketing website, it loads the Meta Pixel from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) or, for visitors outside Europe, Meta Platforms, Inc. (USA). Nothing is loaded before you accept or if you reject.

  • What it collects: the pages you view on our marketing website, whether you click a link to sign up, the time, your IP address, browser and device details, and an identifier stored in Meta cookies on your device (_fbp, and _fbc if you arrived from a Meta ad), which last up to 90 days. If you are logged in to Facebook or Instagram, Meta can connect this to your Meta account.
  • What it is for: to measure which of our ads bring visitors and sign-ups, and to show our ads to people likely to be interested in Rolio.
  • Sign-ups: if you accepted and then sign up for Rolio, we may tell Meta that a sign-up happened, together with the Meta cookie identifiers from your visit. We do not send your name, email address, or anything you enter in Rolio.
  • What it never covers: the Rolio application, public job boards and application forms load no Meta Pixel, so nothing about applicants or candidates reaches Meta. We do not send Meta what you type into our contact form.
  • Who is responsible: for the collection and transmission of this data, we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR, based on Meta’s Controller Addendum. We are responsible for obtaining your consent and for this notice; Meta handles requests about the data it holds, and you can exercise your rights against either of us. What Meta does with the data afterwards is Meta’s own responsibility, described in Meta’s Privacy Policy.
  • Changing your mind: use “Cookie settings” at the bottom of any page to withdraw your consent; the pixel stops loading straight away. You can also manage ad preferences in your Facebook or Instagram settings.

8.4 Which ad you came from. Links in our ads carry campaign tags in the web address (for example utm_campaign). If you sign up for Rolio from such a link, we store the campaign and ad name with your account, so we can see which ads bring people who go on to use Rolio. This uses no cookie and works whether or not you accept the cookie banner; it rests on our legitimate interest in knowing which of our advertising works (Art. 6(1)(f) GDPR). We do not store the click identifiers that ad platforms add to links.

8.5 Non-essential analytics and advertising require a separate choice where applicable law requires consent. A theme preference, a job application or acceptance of the Terms is not consent to advertising tracking. Before introducing any further tracking on the marketing website, we will identify the provider and purpose here and provide the appropriate controls.

9. Children and young applicants

In short: Accounts are 18+; companies are responsible when younger people apply to their roles.

9.1 Customer accounts are intended for persons aged 18 or older. A company may use the Services to receive an application from a younger person only where lawful for the relevant role and jurisdiction; the company is responsible for any age-specific notice, consent, and employment-law requirements. If you believe a child's personal data was processed unlawfully, contact us and the company concerned.

10. Rolio talent pool (optional)

Applicants can separately choose to join Rolio’s talent pool. Rolio is responsible for that data, based on the applicant’s consent. Joining is optional and does not affect the original job application.

Read our Talent Pool Privacy Notice for what we collect, how we use and share it, how long we keep it, and how to leave.

11. Contact

In short: Questions or requests: support@getrolio.com.

11.1 We act as the controller for data processing within the meaning of the PDPL, the PDP Law and the GDPR, except where section 2.2 applies.

11.2 To understand more about this policy, access your personal information, ask questions about our privacy practices, or issue a complaint, contact us at support@getrolio.com.