RaguDave ("we", "us", "our") operates the website at ragudave.com. For privacy enquiries contact us at support@notemyquote.com.
| Data type | Why we collect it | When |
|---|---|---|
| Email address | Account creation and login | At signup |
| Password (hashed) | Authentication — never stored in plain text | At signup |
| Profile information | To populate your handle and generate AI outputs | When you add it |
| IP address | Security, rate limiting, and analytics | On each request |
| Usage events | Product analytics (profile views, API calls, downloads) | As you use the service |
How RaguDave uses AI (RAG). RaguDave uses retrieval-augmented generation (RAG): when you use an AI feature, we retrieve only the relevant fields from your own profile and include them in that single request. Your data is never used to train AI models, each request contains only your own data (never other users' profiles), and deleting your account removes it everywhere we store it. RaguDave does not build a separate search index or "embeddings" copy of your profile.
When data is sent. Only when an AI feature runs — for example an AI-Enhanced résumé, a cover letter, a bio, a Background Report, AI Polish, Resume Import, sorting skills we don't recognise into categories (only the skill names are sent), or (for RaguDave ATS employers) "Rank with AI" on applications you submitted. Nothing is sent to AI in the background. We send only the profile content needed for that task plus any target role or job description you entered. We do not attach your account ID, email address or any tracking identifier to AI requests, and we never send your password or payment details. For Resume Import, email addresses and phone numbers in your résumé are replaced with placeholders before the text is sent, and restored in your profile afterwards, so they never reach the AI provider.
Who processes it. OpenAI (GPT models) and Anthropic (Claude models), through their business APIs. We use one and automatically fall back to the other if it is unavailable.
No model training. Under the providers' API terms, data sent through their APIs is not used to train their models unless the customer opts in. RaguDave has not opted in, and RaguDave does not train AI models on your data.
Retention by AI providers — not zero retention. RaguDave does not currently use Zero Data Retention (ZDR) arrangements. Under standard API terms, OpenAI and Anthropic temporarily keep API requests for up to 30 days for abuse and misuse monitoring — a safety measure that lets them detect and investigate misuse of their AI (such as fraud, spam or malware) — and then delete them. This temporary copy is access-restricted and is not used for training. Either provider may keep data longer only if it is flagged for violating their usage policies or if the law requires it. ZDR is an approval-only arrangement typically used for regulated data such as health records or payment card data, which RaguDave is not designed to hold.
What RaguDave keeps. We do not store the prompts sent to AI. We keep only the results you choose to save (such as a saved AI résumé or a cover letter on a share link) and a usage record per AI action (feature, model and token count — no content) to count your monthly AI credits.
Your own API key. If you save your own Claude or OpenAI key, AI requests for your account run under your own agreement with that provider. Saved keys are encrypted at rest and never displayed back.
Support Assistant. The in-app help assistant answers only from RaguDave's public documentation and cannot see your account. Your question is sent to an AI provider under the terms above; we do not save the conversation.
AI features only run when you (or, for ATS ranking, the employer you applied to) choose to use them — if you don't use them, no profile data is sent to an AI provider.
Your RaguDave handle is a public identifier. When someone (or an AI system) requests data via your handle URL, the fields you have marked as Public in your privacy settings are returned. Fields marked as Private are never exposed via the handle API.
You control exactly which fields are public. Review your privacy settings in the dashboard at any time.
We do not sell your personal data. We share data only with:
Subprocessors — the companies that process personal data on our behalf:
| Subprocessor | Purpose | Data involved |
|---|---|---|
| OpenAI | AI text generation (primary) | Only the content needed for the AI feature you use |
| Anthropic | AI text generation (backup) | Only the content needed for the AI feature you use |
| Stripe | Payments and subscriptions | Name, email, billing details (card details are held by Stripe, never by us) |
| Microsoft 365 (Exchange Online) | Sending account emails | Your email address and the email content |
| Microsoft Azure | Cloud hosting of our server and database | All account data (our server and database run here; Azure encrypts its disks at rest) |
We will update this list before adding a new subprocessor.
Your data is retained for as long as your account is active. When you ask us to delete your account, it is locked immediately and permanently deleted 30 days later (the grace period lets you change your mind). Permanent deletion removes your profile, share links, job applications you submitted, uploaded photos and videos, saved AI results, AI usage records, API tokens and activity records. Uploaded résumé files used for Resume Import are deleted as soon as their text has been read. Stripe keeps its own billing records as required by law, and AI providers delete their copies on the schedule in section 4. Anonymous aggregate statistics may be kept.
Depending on your location you may have the right to:
To exercise any of these rights, email support@notemyquote.com with the subject line "Privacy Request".
RaguDave keeps your sign-in token in your browser's local storage rather than in cookies. We do not use advertising cookies, third-party trackers, or analytics pixels. Stripe may set its own cookies on its checkout pages.
Passwords are hashed using bcrypt. Data is transmitted over HTTPS. The database is not reachable from the internet — only the application server can access it. API keys you save are encrypted at rest (AES-256-GCM). RaguDave staff administration tools are not exposed on the public internet, require two-step verification, and staff actions are recorded in an audit log. Uploaded photos and videos are stored with random, unguessable file names, but anyone given a file's link can open it — only upload media you are comfortable sharing. We recommend using a strong, unique password and not reusing it elsewhere.
RaguDave is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it promptly.
RaguDave is operated from Wyoming, United States. If you access the service from the EEA or UK, your data is transferred to and processed in the US. By using the service you acknowledge this transfer. We apply GDPR-equivalent data protection principles regardless of your location.
We may update this policy periodically. Material changes will be notified by email or a notice on the site. The "Last updated" date at the top of this page reflects the most recent revision.
Privacy questions or requests: support@notemyquote.com · Subject line: "Privacy Request"