Legal
Privacy Policy
Last updated 29 September 2026
What Rayfold collects, why we collect it, who else touches it, and how you get it back or delete it.
1. The short version
Rayfold is operated by Introva LLC, which is responsible for your personal data (“we”, “us”). You can reach us at email@rayfold.ai.
- We collect what we need to build your resume, portfolio, roadmap and interview practice - nothing speculative.
- Your resume text is sent to AI providers so they can generate content for you. It is not used to train our models.
- We do not sell your personal data, and we do not run advertising on Rayfold.
- You can delete your account and everything in it from Settings, at any time.
2. What we collect
You give us
- Account details - email address, password (stored only as a hash by Supabase), and your name if you provide one.
- Profile picture - if you upload one. It is resized in your browser and stored in our Supabase storage bucket.
- Career profile - target role, experience level, job search stage, current title, company, employment status and target industry.
- Resumes - files you upload and the text extracted from them, plus resumes you build in the app.
- Portfolio content - the copy, projects, links and design choices in any portfolio you create or publish.
- Interview sessions - your audio while a Mock Interviewer session runs, the transcript produced from it, and the resulting scores and feedback.
We generate
- Usage and credits - which AI features you ran, when, and how many credits and tokens they consumed. This is how billing and quotas work.
- Technical logs - IP address, browser type and timestamps, kept for security, abuse prevention and debugging.
We do not collect
- Card numbers. Payments go directly to Stripe; we only ever see a customer reference and subscription status.
- Advertising or cross-site tracking identifiers.
3. Why we use it
- To provide the service - generate and store your documents, publish your portfolio, run interviews. This is necessary to perform our contract with you.
- To bill you - meter credits and manage subscriptions.
- To keep Rayfold working and safe - debugging, rate limiting, preventing abuse. This is our legitimate interest.
- To contact you - verification codes, password resets and essential service notices. We will ask before adding you to anything promotional.
4. AI processing - read this one
When you ask Rayfold to generate or improve something, the relevant text from your resume and career profile is sent to a third-party AI provider so the model can produce a result. That provider is OpenAI.
These providers process the text to return a response. Under their API terms they do not use it to train their models, but we cannot control their infrastructure, and you should not put information into Rayfold that you would not be comfortable sending to a third-party API. If a resume contains a home address, a national ID number or similarly sensitive detail, consider removing it first.
5. Who else processes your data
We use the providers below to run Rayfold. Each only receives the data it needs for its job.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Authentication, application database, file storage | Email, password hash, profile picture, all account and portfolio records |
| Amazon Web Services | Hosting, published portfolio storage and delivery (S3, CloudFront, EC2) | Uploaded resumes, generated portfolio files, server logs |
| Stripe | Subscription payments | Email, billing details, payment method (held by Stripe, never by us) |
| OpenAI | AI generation for resumes, portfolios, roadmaps, interview prep and the Mock Interviewer | Resume and profile text you ask us to process, and Mock Interviewer transcripts |
| LiveKit | Real-time audio transport for the Mock Interviewer | Interview audio while a session is live |
| Deepgram | Speech-to-text during Mock Interviewer sessions | Interview audio and the resulting transcript |
6. Who we do not share with
We do not sell, rent or trade your personal data. Beyond the providers above we disclose it only where the law requires it, to enforce our Terms of Service, or to protect someone’s safety. If Rayfold is ever acquired, your data may transfer as part of that - we would tell you first and you could delete your account beforehand.
Published portfolios are public by design. Anything you choose to publish is visible to anyone with the link and may be indexed by search engines.
7. How long we keep it
- Account data - while your account exists.
- Resumes, portfolios and roadmaps - until you delete them, or you delete your account.
- Interview recordings and transcripts - kept with the session so you can revisit your feedback; removed when you delete the session or your account.
- Billing records - retained as long as tax and accounting law requires, even after account deletion.
- Technical logs - a short rolling window for security and debugging.
8. Your rights
Depending on where you live you may have the right to access, correct, export, delete or restrict processing of your personal data, and to object to it. In practice:
- Access and correction - your data is in the app; edit it in Career Profile and Settings.
- Export - download your resumes as PDFs, and email us for anything else.
- Deletion - Settings → Danger Zone → Delete Account removes your account and its data, including your authentication record. This cannot be undone.
To exercise anything not available in the app, email email@rayfold.ai. We aim to respond within 30 days. If you are in the EU or UK and are unhappy with our response, you can complain to your local data protection authority.
9. Cookies and local storage
Rayfold does not use advertising or analytics cookies. We store a small amount of data in your browser purely to make the app work:
- Your Supabase session token, so you stay signed in.
- Interface preferences, such as whether the sidebar is collapsed and your notification toggles.
- A short-lived note of the email you are verifying, so a refresh does not lose the code screen.
Clearing your browser storage signs you out and resets those preferences.
10. Security
Traffic is encrypted in transit over HTTPS. Passwords are hashed by Supabase and never visible to us. Database access is restricted by row-level security so one account cannot read another’s data, and uploads are limited by type and size. No service is perfectly secure - if we ever discover a breach affecting your data, we will notify you and the relevant authority as the law requires.
11. International transfers
Our providers operate globally, so your data may be processed outside your country, including in the United States. Where required we rely on the standard contractual clauses or equivalent safeguards offered by those providers.
12. Children
Rayfold is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.
13. Changes to this policy
We will update this page when our practices change, and the “last updated” date at the top will move. Significant changes - a new category of data, or a new subprocessor that sees your content - will be announced by email or in the app.
14. Contact
Privacy questions or requests go to email@rayfold.ai. See also our Terms of Service.