Privacy Policy

OWNER LEGAL TEXT PENDING — FOR OWNER AND COUNSEL REVIEW ONLY. NOT LEGAL ADVICE. DO NOT PUBLISH AS APPROVED TEXT.

Effective date for each document: [OWNER INPUT: EFFECTIVE_DATE].

A. Privacy Policy — DRAFT

A1. Who is responsible and how to contact us

[OWNER INPUT: LEGAL_ENTITY_NAME], trading as OperatorRank (“we”, “us”), provides OperatorRank. Our registered address is [OWNER INPUT: REGISTERED_ADDRESS]. We determine the purposes and means of processing for our account administration, service operation and security activities.

For privacy requests, questions or support, contact support@operatorrank.com. Cloudflare Email Routing forwards messages addressed to this support address. Include enough information to identify your account and request, but never send your password, login code or session token. Review note: document the destination mailbox provider, responsible person and that provider’s applicable processing/retention terms, and verify receipt; Email Routing identifies the forwarding service, not the destination mailbox. If a data protection officer or local representative is required, add their applicable contact details before the relevant processing begins.

Where an organization invites you to a mission or receives information about you, it may separately determine how that information is used for recruitment or another stated purpose. Its notice also applies to its processing. Review note: counsel must confirm the controller/processor allocation and any company agreement; this draft does not label OperatorRank a processor for every activity.

A2. Information we collect and where it comes from

We receive information you provide, information generated by your use of the service, and information from sign-in providers or an organization interacting with you through the service:

Category	Information and source
Account and authentication	Email, account identifiers, verification and account-status records, password credentials stored as protected credential records, and session/security records. Google sign-in is optional; if you choose it, we receive identity information through the openid, email and profile scopes.
Profile	Information you enter, including date of birth for the adult requirement, display name, headline, avatar, language, time zone, education, work history, skills, languages, and GitHub/LinkedIn/website links. Which fields are required depends on the particular form.
Uploaded content	CVs/resumes, profile images and files/images you attach or submit through available features, including filenames, file types and related storage/verification records.
Mission and AI records	Mission/attempt identifiers, prompts and AI replies, task context, agent/tool actions, terminal commands and output, edited/submitted files, timestamps, progress and execution events, automated check results, defense conversations, evaluation reports, generated interview-preparation material and related evidence. These records concern work inside OperatorRank’s environment.
Organization and sharing records	Organization/group membership, invitations, assignments, access grants, selected shared profile/CV information and records of sharing/access, where you use those features.
Credits and service use	Credit grants, balances, reservations, debits/adjustments, AI token/cost/usage records and related service/account references. This draft does not represent that a paid checkout is active.
Security and technical information	IP address, browser user agent, selected browser/security headers, device-cookie identifier, a keyed fingerprint derived from browser information and a network prefix, security events, access outcomes and operational/error logs. These are used for service protection and abuse prevention.
Communications	Information you choose to send to support@operatorrank.com, your request and information needed to investigate it. Cloudflare Email Routing handles forwarding; the destination mailbox and its retention terms must be documented separately.

Do not upload passwords, private keys, session tokens, national identification documents/numbers, full payment-card information, unrelated third-party personal data, or sensitive information such as health details unless a specific authorized process requests it. An instruction not to upload such information is not a guarantee that a CV, prompt or file has had it automatically removed. Review content before sending it to AI.

A3. Purposes and proposed legal bases

The following bases are proposed for counsel approval under Thailand’s PDPA; they are not a statement that all processing requires consent. PDPA, particularly sections 19, 23–26.

Purpose	Proposed basis and consequence
Create/authenticate accounts; provide missions, AI assistance, checks, results and credit accounting	Contract or steps requested before a contract (section 24(3)). Without necessary account, authentication or mission inputs, the relevant feature cannot operate.
Protect accounts/infrastructure; investigate misuse, free-credit abuse and incidents	Legitimate interests (section 24(5)), subject to balancing and safeguards. Required security checks may refuse or limit access.
Answer support requests and resolve service disputes	Contract and/or legitimate interests, according to the request.
Optional CV-to-AI profile suggestions and optional sharing	A separate affirmative choice for the relevant feature; counsel must confirm consent and any other applicable basis. Declining optional processing prevents that feature, rather than requiring blanket consent to unrelated purposes.
Meet an identified legal obligation or preserve a justified legal claim	The applicable legal basis, limited to the necessary records. No indefinite, general-purpose retention is authorized by this sentence.

We do not use the described browser storage for advertising or third-party behavioral marketing. No sale of personal data is part of the reviewed product flow. Review note: confirm the business-wide no-sale/no-advertising position, including support and infrastructure vendors, before making an unconditional public promise.

A4. AI processing and automated checks

AI assistance sends the messages and work context needed for the selected feature to OpenRouter and the model-serving providers it routes to. This may include code, tool output, conversation history and attachments. If you choose CV autofill, the supported CV file itself is sent through the AI gateway after the explicit file-send choice; AI proposes fields for you to review before saving.

Where enabled, interview preparation can send the authorized mission/work-evidence context to AI to generate a question pack for a human interviewer. The recipient, purpose and context scope must be included in the approved feature disclosure.

Named providers and purposes: [OWNER INPUT: AI_PROVIDERS]. OpenRouter routes AI requests to the model-serving providers behind the catalog models: GLM 5.3 Flash, GPT-6 Luna, Claude Haiku 5.5 and DeepSeek V4.1 Flash; GPT-6.1 Sol and Claude Sonnet 5.5 are optional selections. The recipient depends on the selected model and actual endpoint route; the model developer and endpoint operator may be different entities. These recipients process the feature context described above. The placeholder remains for owner/counsel approval of the final recipient disclosure; a suggested value appears only in PLACEHOLDER-VALUES.md. Do not infer an additional live model or staff AI service from a historical source pin.

Production AI settings: training and publishing are OFF for the OpenRouter/catalog-model use described above, according to the owner’s 19 October update. This describes the current configuration; it does not establish zero data retention, no operational logging or caching, a provider-wide contractual prohibition, or EU-only inference. OpenRouter and downstream providers have separate data-handling controls and retention terms. Review note: record the actual endpoint operators, countries, contracts and retention terms for each admitted feature; this lane has not accessed provider accounts or independently audited those settings. OpenRouter data collection, provider policies.

Mission results include automated checks and evaluation processing. Security controls can automatically limit requests. AI text and automated results can be incomplete or wrong. An organization makes its own employment decisions; OperatorRank does not guarantee employment, suitability or a particular result. Contact support to request investigation of a technical result or restriction. Review note: do not claim every result or refusal is reviewed by a human before it takes effect; confirm the available review procedure and applicable employment/automated-decision requirements in each market.

A5. Recipients, support access and international processing

The processors/services in use are Hetzner, for dedicated hosting of the control services, self-hosted PostgreSQL 17 database and sandbox hosts in Falkenstein, Germany (FSN1, EU); Cloudflare, for DNS, Turnstile bot checks, R2 object storage including backups and logs, and Email Routing for support@operatorrank.com; Resend, for transactional email; OpenRouter and the model-serving providers behind the catalog selections in A4, for AI processing with training/publishing OFF; and Google, for optional sign-in with openid, email and profile scopes. Encrypted pgBackRest database backups are stored in a Cloudflare R2 bucket in Europe with a 14-day PITR retention window. The Europe location statement concerns that backup bucket; this notice does not assign an unconfirmed region to other R2 objects/logs or to every Cloudflare, email, Google or AI operation. See A6 for the distinction between PITR retention and record deletion.

Authorized personnel may inspect relevant account, mission and support records to investigate a request, incident or abuse. Any use of AI for support/operations must have an approved purpose and data scope and identify the actual recipient under A4; this notice does not assert a separate unlisted staff AI service is in use. Review note: confirm redaction/access procedures and any additional recipient before that use. Do not claim universal access logging, mandatory human approval for every action, or guaranteed exclusion of every secret from the old draft alone. Staff must not send passwords, session credentials/tokens, system keys, full card data or national ID information to support AI; approved handling must account for accidental inclusion in user-supplied material.

Where you share information or take part in an organization-assigned mission, the authorized recipient may receive the relevant profile, selected CV or mission evidence within that feature’s scope. This notice does not make all your files or full mission replay public. Information may also be disclosed when required by applicable law or necessary for a lawful claim, with the scope reviewed for the specific request.

Users may access OperatorRank from around the world. The production control, database and sandbox hosts process data in Falkenstein, Germany (FSN1, EU), and the encrypted database backup bucket is in Europe. Data sent from Thailand to those hosts is processed outside Thailand. Cloudflare services, Resend, Google and OpenRouter/downstream model providers may also process information outside Thailand, outside your country or outside the EU/Europe; their full processing-country lists have not been established in this lane. German hosting and a European backup bucket do not establish EU-only processing for the service. Review note: counsel must approve the applicable transfer basis/safeguards and recipient-country disclosures; a website visit or agreement to Terms is not blanket transfer consent. Hosting in Germany does not itself select governing law or establish worldwide legal compliance. PDPA sections 28–29.

A6. Retention and deletion

The database backup/PITR facts below are supplied by the owner. Other record-retention choices remain unresolved review text; the 14-day PITR window does not select their periods or promise complete erasure after 14 days. Confirm approved schedules and operational handling before publication.

Record class	Draft position for decision
Raw server/operational logs, including R2 log copies	Cloudflare R2 is used for log storage. OWNER MUST CHOOSE 90 DAYS OR 30 DAYS. The older inline product legal text says 90 days; the s13b RUNBOOK proposes 30 days without deletion approval. The new hosting/backup facts do not resolve this conflict. Confirm the period, start time and coverage of local/R2 copies. Local journal size limits may remove entries earlier; the 14-day database PITR window is not a log-object expiry rule.
IP/device/security event records	Older owner-intent legal text says 12 months. In the inspected s13b working-tree source, cleanupSecurityEvents uses a 12-calendar-month SQL default when no day override is supplied and excludes legal holds; the RUNBOOK still describes an older 180-day default. A function is not proof of a running deletion schedule. Confirm the approved period, trigger, overrides and actual operation before promising deletion. The 24-hour device cookie is a separate browser lifetime; the database PITR window is also separate.
Mission/attempt records	[OWNER INPUT: ATTEMPT_RECORD_RETENTION]. Decide separately for conversations, events, submitted files, evidence/results and archives; state the clock and what remains after an archive expires.
Full submission archives	RUNBOOK describes an intended 12-month policy for submission-archives/ only, pending Q4’s calendar-month versus storage-age rule and legal holds. submission-files/ are retained separately and excluded from that lifecycle. This is not a 12-month promise for every mission record.
Account/profile, CV/avatar, sharing, credit/accounting and support records	Keep for the stated service purpose while needed, then delete or anonymize under the owner-approved schedule and applicable law. Review note: specify category periods/criteria, closure/deletion handling and any legally required financial retention before publication; do not promise immediate or unconditional erasure on request.
Database backups and provider copies	The self-hosted PostgreSQL 17 database uses encrypted pgBackRest backups to Cloudflare R2 in Europe with a 14-day PITR retention window. pgBackRest manages backup/WAL expiry and may retain an older full backup and the WAL needed to span that window; this is not a promise that every backup object or deleted record disappears exactly on day 14. Backup retention does not select the retention of active mission/account records, separate R2 logs/files, email or AI-provider copies. Review note: document handling of deletion/restriction requests after restore, scoped holds and each other provider’s retention; no universal provider-erasure deadline is asserted.

Any lawful hold must have a specific basis, limited scope and review/end condition; it is not a reason to keep everything forever. A deletion request may be subject to lawful exceptions. Where particular records must be retained, explain the reason and restrict unnecessary use. Review note: define how an approved deletion or restriction is preserved or reapplied if a database backup is restored before publication; no completed restore-erasure workflow is certified here. Browser storage lifetimes in C and the 14-day PITR retention window do not determine the retention of active server records.

A7. Your rights and requests

Subject to applicable conditions, you may request access/copies, correction, deletion, restriction, objection and portability, and withdraw consent where processing relies on it without undoing earlier lawful processing. You may complain to Thailand’s data protection authority or another competent local authority. MDES/PDPC public guide.

Use the confirmed support contact in A1. We may verify identity proportionately. We will address requests within the legally applicable period and explain any lawful refusal; a PDPA access/copy request ordinarily must be completed without delay and within 30 days where it cannot lawfully be refused. This is not a universal 30-day deadline for every right. PDPA section 30.

Review note: confirm the responsible person and actual request, deletion, restriction and escalation processes before publication. A request endpoint or security event named “delete request” does not prove completed erasure. For organization-controlled processing, route the request to the responsible organization without disregarding OperatorRank’s own obligations.

A8. Security, adults and updates

The source provides authentication/access checks, mission isolation and private storage boundaries. No system is completely secure; this notice makes no certification or absolute security guarantee. Contact support promptly about suspected misuse. Review note: counsel and operations must confirm the incident procedure and any required notices rather than treating this draft as proof of readiness.

The intended service is for people aged 18 or above. If a user may be under 18, contact support for review and appropriate handling. The service’s 18+ product rule does not itself establish contractual capacity in every jurisdiction; counsel must address users who are still minors under applicable law, including Thailand’s capacity/consent rules.

We will publish approved changes with an effective date and provide additional notice or obtain a new choice where required. Availability worldwide does not mean the service is approved for every regulated employment use or jurisdiction. Mandatory local rights remain applicable. Review note: identify the initial permitted markets/use cases and required supplemental notices; no worldwide legal-compliance claim is made.