We ask for two things: your CV and your email address. We use the CV to write your roast and the email to send it to you. We delete the CV once you've got it. We don't sell anything to anyone, and nothing you send us is used to train an AI model.
You can send your CV anonymously — black out your name and contact details first, and we'll still be able to roast it. If you paste it as text instead of uploading a file, we strip out email addresses, phone numbers and links automatically before storing anything.
Want everything deleted? Email privacy@theredpen.app and it's gone within 30 days, usually the same week.
The Red Pen
Helsinki, Finland
Email: privacy@theredpen.app
We're based in Finland, and this policy follows the EU General Data Protection Regulation (GDPR).
Your CV. Either an uploaded file or text you paste. This may contain your name, contact details, work history, education, and anything else you chose to put on it. You control what's in it — redact whatever you like before sending.
Your email address. So we can send the roast and tell you when we launch.
The job you're targeting, if you tell us. It's a free-text field and it makes the roast better.
A referral code, and the code of whoever referred you, if you arrived through someone's link.
Basic technical data your browser sends automatically — IP address, browser type, page requested — recorded by our hosting provider for security and to keep the site running.
We don't run advertising trackers or third-party analytics, and we don't use cookies beyond what's needed for the site to function.
Consent covers your CV, your email and your target role. You gave it by submitting the form, and you can withdraw it at any time by emailing us — that means we stop and delete, though it doesn't undo anything we already did while consent was valid.
Legitimate interest covers the technical logs, which we need to keep the site up and defend it against abuse.
We use a small number of service providers. They process data on our instructions and nothing more.
Supabase (hosting / database / file storage) — stores the waitlist and uploaded files.
Cloudflare (frontend hosting & CDN) — serves the website.
OpenAI (AI provider) — the model that helps analyse your CV. Their API terms mean your content is not used to train their models.
Resend (email provider) — delivers the roast to you.
Some of these operate outside the European Economic Area. Where they do, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
We do not sell your data, share it with recruiters, employers or advertisers, or publish your CV. If we ever quote a CV as a public example, it will be with explicit permission and fully anonymised.
Uploaded CV files: deleted once your roast has been sent, and in any case within 30 days of upload.
Pasted CV text: stripped of contact details on arrival, then deleted on the same schedule as files.
Your email address and position on the list: kept until you ask us to remove it, or until the waitlist is closed and you've told us you're not interested.
Technical logs: kept by our hosting provider on their standard retention schedule, typically no more than 30 days.
Under GDPR you can ask us to: show you what we hold, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to processing. You can also withdraw consent at any time.
Email privacy@theredpen.app. We'll respond within 30 days and it's free. We may ask you to confirm which submission is yours — if you sent your CV anonymously, tell us the email address you used, since that's the only way we can find it.
If you think we've mishandled something, you can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi, or to the supervisory authority where you live.
We don't knowingly collect data from anyone under 16. If you're under 16, don't send us your CV.
Nothing you send is used to train an AI model, ours or anyone else's. If that ever changes it will be opt-in, and we'll ask you first rather than updating this page and hoping you don't notice.
We may update this policy. The date below is the version you're reading.
Last updated: 26 July 2026