How your data is handled
You are being asked to upload your entire professional network to a website you had not heard of this morning. This page is the specific, technical answer to what happens to it, written so you can decide before you upload, not after.
What you send us
Two things: your email address, and the Connections.csv file LinkedIn exports for you. Nothing else. We do not ask for a password, we never connect to your LinkedIn account, and no software of ours touches LinkedIn at any point.
That file contains six columns for each connection: first name, last name, profile URL, email address (blank for most people), company, and job title, plus the date you connected. That is the entirety of what LinkedIn puts in the export and the entirety of what we receive.
Where it is processed and stored
Your upload is stored on a server in Frankfurt, Germany, inside the EU. It is written to a database that is not reachable from the public internet, only the application itself can read it.
The analysis itself is performed by Anthropic's Claude models, and this is the part worth understanding properly. To judge whether a connection is worth contacting, the model has to see them. We send, per connection: the person's name, their job title, their employer, and the year you connected. We do not send email addresses, profile URLs, or your own identity.
Under Anthropic's commercial API terms, inputs and outputs are not used to train their models. They retain API data for a limited period for abuse monitoring and then delete it. Inference may take place outside the EU.
Web research on your strongest matches
For a small number of your highest-ranked matches, we run a web search to find publicly available information, a recent role change, a funding round, a public statement. That search query contains the person's name and employer, and is performed through Anthropic's search tool. It reads only public web pages. Any finding in your report is shown with its sources so you can check it yourself.
Who else receives anything
- Anthropic: names, job titles, employers and connection years, to perform the analysis. Not used for training.
- Stripe: your email address and payment details, if you buy a report. We never see or store card details.
- Google (Gmail SMTP): your email address, to deliver the link to your report.
- DigitalOcean: hosts the server in Frankfurt where the data sits.
- Google Analytics and Google Tag Manager: page views on the marketing pages only. Report pages are deliberately excluded, so the private link to your results is never sent to Google.
- Meta (Facebook): if you arrived from an advert. Your email address is sent as an irreversible SHA-256 hash, never in plain text, so Meta can tell whether their advert worked without learning from us who you are. Report pages are excluded here too.
That is the complete list. We do not sell, rent, share or syndicate your data to anyone, and we do not buy contact data from anyone else to add to it.
When it is deleted
For a paid report, the connections you uploaded are deleted as soon as the report is complete, on the next cleanup pass. That runs every five minutes.
A free scan produces only part of the report. If you buy later, we need your upload still present to finish the job. So an unpaid upload is kept for seven days and then deleted whether or not you bought anything. This is the one place where the deletion is not immediate, and it is why.
The report holds its own copy of the matches it found: name, title, employer and connection year for the people it surfaced. That is what lets your link keep working after the upload is gone. Ask us and we will delete it.
A research finding about a named person is cached for up to 30 days so the same search is not repeated. After that it expires.
Headcount bands and industries for employers are kept and reused. This is information about companies, not people, and contains nothing about you or your connections.
Deleting everything, now
Email privacy@rolomine.com from the address you used, and we will delete your upload, your report and your email address, and confirm when it is done. You do not have to give a reason and there is no retention period we will hold you to.
If you are in the UK or EU, you also have the right to a copy of what we hold, to correct it, and to complain to your data protection authority. Same address.
What we will not do
- We will not connect to your LinkedIn account. Not now, not with a future feature. The export is the only route in.
- We will not scrape LinkedIn to enrich your file. It breaches their terms and it is not what you agreed to.
- We will not message anyone on your behalf. The report gives you a draft; sending it is entirely yours.
- We will not pool your connections into a database sold or shown to other customers. Company information is shared; people are not.