Privacy Policy
Last updated: October 9, 2026
This Privacy Policy explains how Rigel Signal, Inc. (“Rigel”, “we”, “us”) collects, uses and protects personal data when you use rigelsignal.com and the Rigel platform (the “Service”). It is written to meet the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and similar laws. If something here is unclear, email privacy@rigelsignal.com.
1. Who we are
The controller of your personal data is Rigel Signal, Inc., a Delaware corporation, 2077 Yorkshire Way, Mountain View, CA 94040, United States. Contact: privacy@rigelsignal.com.
EU representative (Article 27 GDPR): to be appointed.
UK representative: to be appointed.
Until they are, people in the EU, EEA and UK can contact us directly at privacy@rigelsignal.com, and we will update this section when the representatives are in place.
We have not appointed a Data Protection Officer, as we are not currently required to. Privacy questions are handled by the founders at the address above.
2. What data we collect
You give us:
- Account data: name, email, role (candidate or recruiter), company name (recruiters), and your password, which we store only as a secure hash.
- Your CV and candidate profile: the file you upload and the structured profile we extract from it (contact details, summary, education, work experience, skills and other sections you include). You review the profile and can edit it before it is used.
- Guest applications: if you use Quick Apply without an account, your name, your email, your CV and the profile we extract, linked to that one job.
- Job data (recruiters): job title, location, employment type, required and preferred skills, experience and education requirements, scoring weights and visibility threshold.
- Messages you send us, or send to other users through the Service.
- Demo bookings: if you book a demo, the details you enter in the booking form (see Section 5).
We collect automatically:
- Usage data: pages viewed, actions taken, timestamps and referrer.
- Device data: IP address, browser and operating system. For Quick Apply we keep only a one-way hash of your IP address, to limit repeated applications.
- Cookies and similar technologies: see Section 8.
Sensitive data. We don’t ask for sensitive data such as health, religion, ethnicity, sexual orientation, political opinions, date of birth or a photo, and our matching doesn’t use it. Please leave it out of your CV. We don’t extract photos, and our profile has no fields for these categories. If your CV contains such information anyway, it stays in the file and in the text we read from it, and could appear in free-text sections of your profile, which you can edit or remove before you confirm it.
Providing your CV is not required by law, but we can’t match you to jobs without it.
3. How we use your data and why it’s lawful
| What we do | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and run your account, sign you in, verify your email | Account data, device data | Contract — needed to provide the Service you signed up for |
| Read your CV into a profile you review and confirm | CV, profile | Contract |
| Score your confirmed profile against published jobs and show results to you and to recruiters (see Section 4) | Profile, job data | Contract — matching is the Service |
| Process a guest Quick Apply for one job | Guest name, email, CV, profile | Contract — steps you asked us to take |
| Let recruiters publish jobs, set weights and review ranked, anonymised matches | Job data, recruiter account data, candidate profiles | Contract |
| Send service emails: email verification, “you’ve been shortlisted”, new-message notifications | Email, account data | Contract |
| Keep the Service secure and prevent abuse, including limiting repeated Quick Apply attempts | Usage, device, account data, hashed IP | Legitimate interest in protecting users and the platform |
| Improve the Service, including matching quality, using usage data and aggregated statistics | Usage data, aggregated match outcomes | Legitimate interest in a better, fairer product |
| Keep application logs and processing records for troubleshooting, for 30 days (they are designed not to contain the content of your CV) | Technical logs | Legitimate interest in a working, accurate Service |
| Keep anonymous scores after an account is deleted, for up to 12 months, to answer questions and audit fairness | Scores and statuses only, with no link to the person | Legitimate interest in accountability |
| Warn and then close candidate accounts nobody has signed in to for 24 months, so we don’t keep CVs indefinitely | Email, last sign-in date | Legitimate interest in not keeping data longer than needed |
| Arrange demo calls | Booking details | Steps you asked us to take |
| Meet legal obligations (tax, accounting, lawful requests) | As required | Legal obligation |
Where we rely on legitimate interest, you can object at any time (Section 9). You can ask us for the balancing test we performed.
We do not sell or rent your personal data, and we do not use your CV or profile to train third-party AI models. We don’t send marketing emails or newsletters.
4. Matching, profiling and what recruiters see
Rigel is a matching service, which means it profiles candidates against jobs. Here is exactly what happens.
- Automatic scoring. Once you confirm your profile, it is scored against every published job. When a recruiter publishes a new job, it is scored against every candidate who has matching turned on. You don’t need to apply.
- How scores work. Scores are calculated by fixed rules from your confirmed skills, experience and education against the job’s requirements, using weights set by the recruiter. Recruiters see how each score was built. You see the skills, experience and education scores for jobs you’re shortlisted for, your average breakdown in Insights, and you can ask us for the full breakdown of any score. One exception: when a recruiter describes the relevant experience in their own words, an AI model judges which of your past roles count. We save each judgement, so the same profile always gets the same result for that job. Details: AI Transparency.
- Automatic applications. If your score for a job reaches the recruiter’s visibility threshold (60 out of 100; a recruiter can raise it for a job but not lower it), an application is created for you automatically. If it doesn’t, that recruiter won’t see you for that job.
- Anonymous until shortlist. Recruiters see matching candidates without name or contact details. They do see your skills, experience and education, including employer names. For education they see your degree and where you studied (the country, or the US state), not the name of the school. You see the job title and your score, not the company or the full job description. If a recruiter messages you before shortlisting, the conversation shows the job title, not the company. When a recruiter shortlists you, the introduction happens: you see the full job and company, and the recruiter sees your name and your school names. You can then decline that job with one click.
- Quick Apply is the one case where you apply to a specific job yourself. Your application is shown to the recruiter anonymised, like any other, until shortlist.
- Who decides. Rigel does not make hiring decisions. Recruiters review the ranked list and decide who to shortlist, interview and hire.
Your controls. You can turn matching off at any time in Settings with “Participate in matching”: your profile then won’t be scored against any job. You can also edit your profile, decline a job you’ve been shortlisted for (“Decline this match”), or ask for a person at Rigel to review a score, give your point of view and contest it (email privacy@rigelsignal.com).
5. Who we share data with
- Recruiters, as described in Section 4: anonymised until shortlist, identified after. Once a recruiter’s organisation receives your identified profile, it becomes responsible (a separate controller) for how it uses your data in its hiring process, under its own privacy notice.
- Service providers who process data only on our instructions, under data processing agreements:
| Provider | What they do | Location |
|---|---|---|
| Google Cloud (Google LLC) | Hosting, database, file storage, CV text extraction, the AI models we use (Gemini on Vertex AI), application logs | United States (us-central1) |
| Vercel Inc. | Website and app hosting; privacy-friendly page analytics (Vercel Web Analytics) | United States (global edge network) |
| Resend (which sends through Amazon Web Services) | Sending service emails | United States |
| Mux | Playing the product videos on our website (viewer tracking switched off) | United States |
| Calendly | Demo booking on our “Book a demo” page | United States |
- Legal requirements: if the law requires it, or to protect the rights and safety of users or others.
- Business transfers: if Rigel merges or is acquired, your data may move to the new owner, which must keep honouring this Policy. We’ll tell you before that happens.
6. International transfers
Rigel is based in the United States, and your data is stored and processed there (Google Cloud region us-central1). If you are in the EU, EEA or UK and give us your data directly, it is processed in the US under this Policy, and the GDPR still applies to it.
Where GDPR transfer rules apply — for example when a recruiter’s organisation in the EU shares data with us, or when data moves on to our service providers — we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum). Our US providers rely on the Data Privacy Framework and/or Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
7. How long we keep data
| Data | How long |
|---|---|
| Candidate profile and CV file | While your account is active. |
| Inactive candidate accounts | If you don’t sign in for 24 months, we email you. If you still haven’t signed in 30 days after that email, we delete your account, following the timeline for deleted accounts below. |
| Deleted accounts | Hidden from recruiters and signed out immediately. Your CV, profile and account are permanently deleted 30 days after your request; until then you can cancel by emailing privacy@rigelsignal.com. Copies leave our backups within a further 7 days. |
| Guest Quick Apply data | 90 days after your last application, unless you create an account with the same email — then it becomes your profile. |
| Match results and applications | While both your profile and the job exist. When an account is deleted, we keep only anonymous scores and statuses, with nothing that identifies you, for up to 12 months, then delete them. |
| Recruiter accounts | While the account is active. A recruiter who deletes their account in Settings is signed out immediately; 30 days later we remove their name, email and sign-in details. Their organisation’s jobs and messages stay with the organisation. |
| Recruiter jobs | While the job exists. A deleted job disappears immediately from the recruiter’s dashboard, from candidates’ matches and from matching. 12 months later we permanently delete it, together with its applications, scores and message threads. |
| Quick Apply abuse-prevention records (email and hashed IP) | 90 days. |
| Application logs and processing records | 30 days. |
| Backups | 7 days, then overwritten. Deleted files stay recoverable in storage for 7 days. |
| Records we must keep by law | As long as the law requires. |
8. Cookies
We use only essential cookies: to sign you in and to keep the Service secure. They don’t need consent.
We measure site usage with Vercel Web Analytics, which doesn’t use cookies or track you across sites. We do not use advertising cookies.
Two pages embed services from other companies. The product videos use the Mux player with viewer tracking switched off; it may remember in your browser whether you muted a video. The “Book a demo” page embeds Calendly, which uses its own cookies and asks for your consent in its own banner.
9. Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you and get a copy.
- Correct inaccurate data. Most of it you can edit yourself in your profile.
- Delete your account and data: from Settings (“Delete account”), or by email. Deletion follows the timeline in Section 7.
- Export your data in a machine-readable format: “Download my data” in Settings gives you one JSON file with your account, profile, CV, applications, scores and messages. For anything it doesn’t include, email us.
- Restrict processing while a complaint is looked at.
- Object to processing based on legitimate interest, and to profiling. Turning off “Participate in matching” in Settings stops all scoring of your profile.
- Not be subject to a purely automated decision with significant effects: ask a person at Rigel to review a result, give your view and contest it.
- Withdraw consent where we rely on it, without affecting earlier processing.
Email privacy@rigelsignal.com to use any right. We reply within one month (extendable by two months for complex requests, in which case we’ll tell you). We may ask you to confirm your identity.
Complaints. You can complain to the data protection authority where you live or work (list of EU authorities; in the UK, the ICO). We’d appreciate the chance to fix things first.
California residents have the rights above under the CCPA, including to know, delete and correct, and not to be discriminated against for using them. We don’t sell or share personal information for cross-context advertising.
10. Security
We encrypt data in transit and at rest, and limit access to the people who need it. No system is perfectly secure. If a breach puts your data at risk, we’ll notify the relevant authority within 72 hours where required, and tell you without undue delay if it’s likely to seriously affect you.
11. Children
The Service is for people aged 18 and over. We don’t knowingly collect data from children; if you think we have, contact us and we’ll delete it.
12. Changes
We’ll tell you about material changes by email or in the Service at least 30 days before they take effect. The date at the top shows the latest version.
13. Contact
Rigel Signal, Inc. · 2077 Yorkshire Way, Mountain View, CA 94040, USA · privacy@rigelsignal.com