v1
# Rolechia — Privacy Policy
**Effective date:** 17 August 2026
**Version:** 1.0
This Privacy Policy explains how **Modern Technology Co. Ltd.** (شركة
مودرن تكنولوجي المحدودة), registered at Al-Mandara District, Block 5/11,
Property No. 63, Khartoum, Republic of Sudan ("Rolechia", "we", "us") —
the data controller for the Rolechia service at rolechia.com (the
"Service") — collects, uses, and protects your personal data. We build a
résumé product, which means we handle personal data by design; we take
that seriously, and this policy describes exactly what we do and do not
do.
For users in the Kingdom of Saudi Arabia, we process personal data in
accordance with the Saudi Personal Data Protection Law (PDPL) and its
implementing regulations. This Policy is published in English and
Arabic; in case of discrepancy, the **Arabic version prevails**.
**The short version:** we collect what you give us to build your
résumés, we use it only to provide the Service, we do not sell it or
share it with advertisers, sharing a résumé publicly is entirely your
choice, and you can delete your account and your data at any time.
## 1. Data we collect
**Account data.** Your email address (used for sign-in links and
essential account messages) and the name you provide.
**Résumé content.** The information you enter to build your résumés:
name, job title, contact details, work history, education, skills, and
any other fields you choose to fill, in either or both languages.
**Imported documents.** If you use import, the CV file you upload (PDF
or Word) or the text you paste, and the structured data extracted from
it. Extraction results are stored so you can review and re-apply them;
nothing is applied to your profile without your confirmation.
**Preferences and settings.** Your interface language and product
settings.
**Usage data.** Records of product events (for example: signing in,
creating a résumé, exporting a PDF) linked to your account, used in
aggregate to understand and improve the Service. These records are
designed not to contain your résumé content or free-text personal
details.
**Public link view data.** If you enable a public link, we record coarse
information about views of that link — approximate country and a
non-identifying technical fingerprint — to show you view statistics. We
do not store the raw IP addresses of your résumé's viewers in these
statistics.
**Legal acceptance records.** When you accept our Terms or this Policy,
we record the version accepted, the time, and technical evidence of the
acceptance (such as IP address and browser information), as proof of
agreement.
**Technical logs and error reports.** Standard server logs (including IP
addresses) for security, abuse prevention, and troubleshooting, retained
for a limited period; and error-monitoring reports that may include
technical identifiers when something goes wrong.
**Cookies.** We use strictly necessary cookies only: a session cookie to
keep you signed in and a preference cookie for your chosen language. We
do not use advertising or cross-site tracking cookies.
## 2. What we use data for
- **Providing the Service** — storing your résumé content, extracting
data from documents you import, rendering previews and templates,
generating PDF exports, and serving public links you enable. (Legal
basis: performance of our contract with you.)
- **Account communication** — sending sign-in links and essential
service/security messages. These are transactional; we do not send
marketing email without your separate, explicit consent. (Legal basis:
contract; consent for any marketing.)
- **Security and abuse prevention** — rate limiting, log analysis,
protecting accounts. (Legal basis: legitimate interest / legal
compliance.)
- **Improving the Service** — aggregate analysis of usage data. We look
at patterns, not at individuals' résumés. (Legal basis: legitimate
interest.)
- **Legal compliance** — maintaining acceptance records and responding
to lawful requests. (Legal basis: legal obligation.)
**What we do not do:** we do not sell your personal data. We do not
share it with advertisers or data brokers. We do not use your résumé
content for advertising. Our staff do not browse your résumé content;
access to it is restricted, logged, and limited to what is necessary
(for example, resolving a support issue at your request). Automated
extraction proposes data for your review — the Service does not invent
content on your behalf.
## 3. Sharing and processors
We share personal data only with service providers ("processors") who
help us run the Service, under terms that restrict their use of the data
to providing their service to us:
- **Email delivery** — Amazon Web Services (Amazon SES): sends our
sign-in and account emails; your email address is processed on AWS
infrastructure in the European Union (Stockholm region).
- **Website hosting** — Vercel Inc.: hosts the Service's web
application.
- **Application infrastructure** — our server infrastructure
provider(s) hosting the Service's API and database.
- **Network and security** — Cloudflare, Inc.: DNS, content delivery,
and security in front of the Service. Cloudflare provides us the
approximate country of requests; we do not perform our own IP
geolocation.
- **Document extraction** — Google Cloud (Vertex AI): when you import a
CV, the document content is processed by Google Cloud's AI services to
extract structured data, solely for that purpose.
- **Error monitoring** — Functional Software, Inc. (Sentry): receives
error reports that may include technical identifiers, to help us fix
failures.
We may disclose data if required by law or a valid order of a competent
authority, or to protect the rights, safety, or property of our users or
the Service. If you enable a **public link**, the résumé you share is
disclosed to whoever you give the link to — that disclosure is under
your control, and you can disable the link at any time.
## 4. International transfers
Our users are primarily in Saudi Arabia and the Gulf, and our processors
operate infrastructure in multiple countries (including the European
Union and the United States, as described above). Where personal data of
users in Saudi Arabia is transferred across borders, we do so consistent
with the PDPL's requirements for cross-border transfer, using providers
with strong contractual and security commitments, and limiting each
transfer to what the relevant processing requires.
## 5. Retention
- **Résumé content, imported documents, and account data** — kept while
your account is active. When you delete a résumé, it is removed from
the Service; when you delete your account, your résumé content,
uploaded files, extraction results, and profile are deleted.
- **Legal acceptance records** — retained after account deletion in a
form linked to the fact of the agreement (as evidence), consistent
with legal requirements.
- **Technical logs** — retained for a limited period for security, then
deleted or anonymized.
- **Aggregate usage statistics** — retained without personal
identifiers.
## 6. Your rights
Subject to applicable law — including, for users in Saudi Arabia, the
PDPL — you have the right to: **know** what personal data we hold about
you and how we process it; **access** and obtain a copy of your personal
data; **correct** inaccurate or incomplete data (you can edit your
résumé and account data directly in the Service at any time); **delete**
your personal data (you can delete résumés or your entire account from
your settings); and **withdraw consent** where processing is based on
consent, without affecting prior processing.
To exercise any right that isn't available directly in the product,
contact us at **support@rolechia.com**. We will respond within the
timeframes required by applicable law. Users in Saudi Arabia may lodge a
complaint with the Saudi Data & Artificial Intelligence Authority
(SDAIA) as the competent authority.
## 7. Security
We protect your data with technical and organizational measures,
including encryption in transit, access controls and audit logging on
administrative access, isolation of our internal services from the
public internet, and security review of the systems that handle your
content. No system is perfectly secure; if a breach affecting your
personal data occurs, we will notify you and the competent authority as
required by applicable law.
## 8. Children
The Service is not directed to children and we do not knowingly collect
personal data from anyone under 18. If you believe a child has provided
us personal data, contact us and we will delete it.
## 9. Changes to this Policy
We may update this Policy. Each version is numbered and dated. For
material changes we will notify you and, where required, ask you to
review and accept the updated Policy before continuing, with a summary
of what changed.
## 10. Contact
**Modern Technology Co. Ltd.**
Al-Mandara District, Block 5/11, Property No. 63, Khartoum, Republic of
Sudan
**support@rolechia.com**