Privacy policy

rufl is a tool professionals, such as recruiters, real estate agents and travel agents (“customers”), use to send their clients (“recipients”) a deck of options to review. This policy explains what we collect, why, who helps us run the service, and the choices you have. It covers rufl.io, the app, deck links, and decks shown on a customer's own domain.

Who decides about your information

When customers add information about their own clients, candidates, listings or trips, the customer decides what to collect and why. We store and process it for them, following their instructions. If you received a deck, the professional who sent it is your first contact for questions about your information. We'll help them, and you can always write to us at support@rufl.io.

What we collect

• Customer accounts: name, email address and sign-in details, organization name and branding, and any contact details you add, such as the name, email and phone number shown to your clients.
• Custom plan requests: the name, email address, company, team size and message sent through the form on our pricing page, used only to reply about a plan.
• Deck content: what customers put on cards (for example skills and experience, listing details or trip details), photos and videos, and resumes or links sent for an automatic summary. When a customer summarizes a link, our servers also visit that page and download the photos on it, so the customer can pick which to add. Photos they keep are stored like ones they upload; the rest are discarded.
• Support messages: what you send through the Support button in your account, with your email address, organization, plan and the page you were on, used only to answer you.
• Recipient details: the name, email address and phone number a customer enters for each recipient, and whether the recipient agreed to receive text messages.
• Recipient responses: choices made on each card (Interested or Not a fit), requests sent, notes added, and when a link was opened.
• Technical information: basic server logs, and a scrambled code made from your internet address that we use only to stop abuse. We never store the address itself, and we delete the code within a day. On our homepage and pricing page we count visits (which page, the referring site, and the type of device) without cookies, and the steps of signing up and choosing a plan.

Recruiting decks are built to leave out photos, full names, age, gender and other protected characteristics. Automatic summaries drop them too.

Cookies

Customers who sign in get cookies that keep them signed in, and choosing a plan on the pricing page sets one that remembers it until checkout. Deck links need no account and set no tracking cookies. On our website and sign-up pages we use the Meta Pixel, an advertising cookie from Meta, to see whether our ads on Facebook and Instagram lead to sign-ups. It never runs on deck links, and inside the app it only reports that a new customer finished checkout. It stays off if your browser sends a Global Privacy Control signal. We also keep a small cookie of our own for 30 days that remembers how you first arrived (for example, from an ad or a search), so we can see which ones lead to sign-ups. With it we count a few steps on our website, such as opening the pricing page or swiping a sample deck, with no personal details. Your account also remembers a few settings, such as light or dark mode, and your browser keeps small reminders, such as tips you've closed.

How we use it

• To run the service: show decks, save responses, and send links, reminders and alerts by email or text when a customer asks us to.
• To keep it secure: prevent abuse, keep each organization's data separate, and fix problems.
• To support customers and, once paid plans are available, to bill them.
• To remind people who started signing up but didn't finish, at most twice, with a link to stop.

We don't sell personal information. Apart from the Meta Pixel described under Cookies, we don't use it for advertising, and we don't use customer or recipient data to train AI models.

Services that help us run rufl

These companies process information for us, only as needed to provide their part of the service:

• Clerk: customer sign-in.
• Supabase: database and file storage.
• Vercel: hosting, and counting visits to our homepage and pricing page without cookies.
• Cloudflare: domain and network services.
• Resend: email delivery.
• Quo: text message delivery.
• Anthropic: automatic summaries of resumes and links, when a customer uses that feature.
• Stripe: payments.
• Meta: measuring our ads on Facebook and Instagram (the Meta Pixel), on our website and sign-up pages only.

We may also share information if the law requires it, or with a buyer if rufl is sold, under this policy.

Text messages

We use a phone number only to send messages a customer starts (such as a deck link or a reminder) or alerts a customer turned on for themselves. Customers must have the recipient's consent before we text them.

We do not share or sell mobile phone numbers or text messaging consent with third parties or affiliates for marketing or promotional purposes. Message and data rates may apply, and how often you get messages varies. See the text messaging terms.

How long we keep it

We keep information while the customer's account is active. Customers can delete cards, recipients and decks at any time, set decks to delete themselves after the client responds, and make links expire or close once a client responds. Deleting a deck also deletes its photos, videos, links and responses. Copies in our backups are removed on a short schedule after that. When an account closes, we delete its data within a reasonable time.

How we protect it

Everything travels over encrypted connections. Each organization's data is kept separate by database rules that we test automatically. Photos and videos are stored privately and shown through short-lived links. Deck links are long random codes, and repeated wrong attempts are blocked.

Your choices

You can ask to see, correct, export or delete your information. Customers can do most of this in the app. Recipients can ask the professional who sent the deck, or write to us at support@rufl.io. We'll respond within 30 days and won't treat you differently for asking.

To turn off ad tracking, turn on Global Privacy Control in your browser, or change your ad settings on Facebook or Instagram.

Children

rufl is for businesses and isn't meant for anyone under 16. We don't knowingly collect their information.

Changes and contact

If we change this policy, we'll update the date above and, for important changes, tell customers by email or in the app. Questions: support@rufl.io.