Privacy policy

1. Who we are

RateMyColleague operates RateMyColleague and is the controller of the personal data described here. Contact us at trust@ratemycolleague.example. [Add registered address and, where required, EU/UK representative and data protection officer contact details.]

2. Information we collect

From people who use the site

• Account data from Google sign-in: your name, e-mail address and a Google account identifier. We do not receive your Google password or contacts.
• Profile settings: the display name you choose. By default it is your first name and last initial.
• Content you submit: reviews and their edit history, responses, reports, disputes, appeals, correction and removal requests, and profile claims including any evidence you describe.
• Technical data: your IP address is used when you submit content to limit abuse and to run Cloudflare Turnstile bot checks. We store only a keyed, one-way hash of it, for at most 90 days, to detect coordinated manipulation. We use essential cookies to keep you signed in. We do not use advertising cookies.
• Analytics: if enabled, we use a privacy-friendly analytics service that does not use cookies or collect personal identifiers and reports only aggregate statistics.

About professionals who are reviewed

• The public LinkedIn profile URL, name, current job title and company, and, where appropriately sourced, a short summary.
• Sources: members who add the profile, licensed professional-data providers (only for the exact LinkedIn URL requested), our moderators, and the professional themself. We do not scrape LinkedIn.
• Reviews written by people who worked with them, and any responses they publish.

3. How and why we use personal data

• To provide the service (performance of our contract with you): accounts, publishing reviews and responses, notifications, and your dashboard.
• To keep the platform safe and lawful (legitimate interests and legal obligations): automated and human moderation, fraud and spam prevention, enforcing our terms, handling disputes, appeals and legal requests.
• To publish professional reputation information (legitimate interests, ours and the public's, in sharing firsthand professional experiences). We balance this against the interests of the people reviewed by limiting profiles to professional information, moderating every review, offering a right to respond, and handling correction, objection and removal requests.
• To improve the service (legitimate interests): aggregate, non-identifying usage statistics and error monitoring.

Automated moderation. Submissions are screened by automated rules and, if enabled, an AI moderation service. These checks route content (publish, hold for a person, or ask you to fix something). They are never treated as proof that a claim is true or false, and you can always appeal a decision to a human.

4. Anonymity of reviewers

You can post reviews anonymously. Your e-mail address is never shown publicly. Moderators can see which account wrote a review so that we can enforce our rules. We disclose a reviewer's identity to a third party, including the reviewed professional, only when compelled by valid legal process or where necessary to prevent imminent harm, and where permitted we will tell you first so you can object.

5. Who we share data with

We do not sell personal data. We share it only with:

• Service providers acting on our instructions: database, authentication and hosting (Supabase, Vercel), bot protection (Cloudflare Turnstile), AI moderation (OpenAI, if enabled), background jobs (Trigger.dev), error monitoring (Sentry), and a licensed professional-data provider (if enabled).
• The public, for content you choose to publish (reviews, responses and your display name on non-anonymous reviews).
• Authorities or courts, where required by law.
• A successor in a merger or acquisition, subject to this policy.

6. International transfers

Our providers may process data outside your country. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses. [Confirm hosting regions and list safeguards.]

7. How long we keep data

• Account data: until you delete your account.
• Reviews and responses: until you delete them or your account, or until we remove them.
• Network hashes used for abuse detection: up to 90 days. Rate-limit counters: up to 2 days.
• Moderation and audit records: kept to show how decisions were made, without your identity or written content after you delete your account.
• If an account is deleted while suspended or banned, a keyed hash of its e-mail address is kept to prevent ban evasion.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or CCPA/CPRA), you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent. You can:

• download your data and delete your account from Settings;
• edit or delete your reviews at any time;
• if you are a reviewed professional, claim your profile, request a correction or object to and request removal of your profile;
• contact us at trust@ratemycolleague.example. We respond within the time required by law.

You also have the right to complain to your data protection authority.

9. Security

We use encryption in transit, row-level access controls in our database, least-privilege staff access, audit logging of sensitive actions, and bot protection. No system is perfectly secure; tell us at trust@ratemycolleague.example if you discover a vulnerability.

10. Children

RateMyColleague is for adults with professional experience. You must be at least 18 to create an account.

11. Changes

We will post updates here and, for material changes, notify signed-in users.