Privacy Policy
Rigor — Privacy Policy
Effective date: September 12, 2026 Last updated: September 12, 2026
This policy explains how AYDC LLC, doing business as "Rigor" ("Rigor," "we," "us"), handles personal information in connection with the Rigor application at withrigor.co (the "Service").
1. Two roles, and which one applies to you
We handle personal information in two different capacities, and your rights differ depending on which applies.
As a controller. For information about the people who sign up for and administer accounts — name, email, organization, login records, support correspondence, and how the Service is used — we decide the purposes and means of processing. This policy describes that processing.
As a processor. For the content our customers put into the Service — scorecards, searches, goals, interview notes and transcripts, evaluations, and information about candidates — the customer organization decides what to collect and why. We process it on that customer's instructions. If you are a job candidate whose information is in Rigor, the employer or advisor who put it there is responsible for it, and Section 11 tells you where to direct your requests.
2. Information we collect
You give us:
- Account information — name, email address, authentication credentials handled by our authentication provider, and any profile details you add. We do not store or have access to your password in readable form.
- Organization information — organization name, email domain, member roles, engagement relationships with advisors, and any company description an organization chooses to provide.
- Content you create — scorecards, role definitions, searches, goals, notes, interview transcripts you upload or paste, and requests you submit for AI-assisted evaluation.
- Information about other people — most significantly, information about job candidates: names, contact details, resumes and career history, interview notes and transcripts, and evaluations and scoring.
- Communications — messages you send us for support, feedback, or sales.
We collect automatically:
- Usage information — pages and features accessed, actions taken, timestamps.
- Device and connection information — IP address, browser type, operating system, and similar technical data.
- Log and security information — authentication events, errors, and records used to detect abuse.
We receive from others:
- Authentication providers, if you sign in through one, which give us your email address and basic profile.
- Email delivery information from our email provider — for example, whether a message was delivered or bounced.
3. Cookies and similar technologies
We use cookies and local storage that are strictly necessary to operate the Service: keeping you signed in, maintaining session state, and protecting against fraud and abuse.
We currently use no analytics, product-analytics, or advertising cookies, and we do not permit third parties to track you across sites through the Service. If we introduce analytics in future, we will update this policy and, where the law requires it, obtain your consent before doing so.
You can control cookies through your browser, but disabling necessary cookies will prevent the Service from working.
4. Domain association — please read this
If your email address uses a domain that has been claimed and verified by an organization on Rigor, your account may be automatically associated with that organization when you sign up. This is how a team is kept together without individual invitations.
The consequence: administrators of that organization can see that you are a member, and the content you create inside that organization is organizational content, visible to others in the organization according to their roles. Content in a domain-associated organization should be treated as work product belonging to that organization, not as private to you. If you do not want this, use a personal email address to create a separate account, or ask an administrator to remove the association.
5. How we use information
We use personal information to:
- create and administer accounts, organizations, and memberships;
- provide the Service's functionality, including generating AI-assisted evaluations and other Output;
- send transactional email — invitations, notifications, password resets, and service announcements;
- provide support and respond to inquiries;
- monitor, secure, and troubleshoot the Service, and detect and prevent fraud and abuse;
- understand aggregate usage in order to improve the Service;
- test changes to the Service against existing customer content, described below; and
- comply with legal obligations and enforce our Terms.
Testing changes against existing content. Rigor's output is produced by applying our prompts and evaluation criteria to what a customer puts in. When we change those prompts — which we do often — the only way to know whether the change is an improvement is to run content that already exists in the Service against the new version and read the result.
This is done by our own personnel. It produces no output visible to any customer other than the one whose content was used, creates no record outside that customer's organization, and is never used to generate output for a different customer. We do not use customer content for any other development purpose, and we do not use it to train machine learning models (Section 6).
We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.
When acting as a controller, we do not use personal information to make decisions about you that produce legal or similarly significant effects. Where we act as a processor — most significantly, for candidate information — the employer using the Service decides how that information is used and makes any employment decision. See Section 11.
6. AI processing
Generating an evaluation or other Output means sending your inputs — which may include a scorecard, a role definition, interview notes, a transcript, and any company description your organization has provided — together with our prompt content to a third-party large language model provider, which returns generated text that we store in your organization.
Our commitments:
- We contract with our model provider so that your content is not used to train or improve their models.
- We do not use customer content to train any model of our own.
- We do not use one organization's candidate information to generate Output, produce matches, or inform recommendations for any other organization. Candidate records are scoped to a single organization and are not pooled across customers.
- AI Output is advisory. It can be wrong, and it should not be the sole basis for any hiring or personnel decision.
Our current model provider is listed in Section 8.
7. Legal bases (EEA and UK)
Where the GDPR or UK GDPR applies to processing for which we are the controller, we rely on:
- Contract — to create your account and provide the Service you or your organization requested.
- Legitimate interests — to secure the Service, prevent abuse, understand aggregate usage, and communicate about the product. We balance these against your rights.
- Legal obligation — where retention or disclosure is required by law.
- Consent — where we ask for it, which you may withdraw at any time.
Where we act as a processor, the customer organization is responsible for establishing a legal basis for its processing, including for candidate information.
8. Who we share information with
Service providers (subprocessors). We use the following to operate the Service:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage | All account and customer content |
| Lovable | Application hosting and delivery | Requests, IP addresses |
| Mailgun | Transactional email delivery | Names, email addresses, message content |
| Anthropic | AI-assisted evaluation and generation | Content submitted for generation |
We engage each of these under agreements intended to restrict their use of the information to providing services to us and to require them to protect it. Where these providers process information outside the United States, Section 13 applies. We will update this list before adding a subprocessor that processes customer content.
Within your organization. Content is visible to members of your organization according to their roles, and to any advisor your organization has granted access.
Legal and safety. We may disclose information where required by law, to respond to lawful requests, or to protect the rights, safety, or property of Rigor, our customers, or others. Where we are permitted to do so, we will notify the affected customer before disclosing their content.
Business transfer. If we are involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction, subject to this policy.
9. Retention
We retain information for as long as an account and organization remain active, and afterward as follows:
| Category | Retention |
|---|---|
| Account records | Duration of the account, then 30 days after closure |
| Organization content, including candidate records | Duration of the organization, then available for export for 30 days, then deleted from active systems |
| Backups | Retained on a rolling basis by our infrastructure provider and purged in the ordinary course |
| Security and access logs | 12 months |
| Records required for legal, tax, or accounting purposes | As required by law |
Customers can delete or archive most content within the Service. Where a category of content cannot yet be deleted through the interface, a deletion request to us is honored within 30 days, except where retention is legally required.
Following any deletion, we remove the content from active systems in accordance with our standard deletion procedures. Residual copies may remain in backups until those backups are overwritten or deleted in the ordinary course.
Candidate information should not be kept longer than the customer's own retention policy and applicable law allow. Customers are responsible for setting and applying that policy.
10. Security
We use technical and organizational measures appropriate to the Service, including encryption in transit, encryption at rest for stored data, database row-level access controls that scope records to a single organization, role-based permissions, and access controls over administrative accounts. We review access and monitor for anomalous activity.
No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for safeguarding your credentials. If we become aware of a breach affecting personal information, we will notify affected customers without undue delay, consistent with applicable law.
11. If you are a job candidate
If your information is in Rigor, it is because an employer or their advisor is considering you for a role and entered it. We process it on their behalf and cannot, on our own authority, disclose it, correct it, or delete it.
To access, correct, delete, or object to the processing of your information, contact that employer directly — they hold the information and they decide what happens to it.
If you write to us at hello@withrigor.co and identify the employer, we will forward your request to them and support them in responding to it. We cannot search for you across our customers. Records are scoped to a single organization by design, and we have no ability to look up an individual across organizations — which is the same protection that keeps your information from being visible to any employer other than the one that entered it.
Rigor is a decision-support tool. Evaluations and other Output provide information for consideration by a human reviewer. They do not make an employment decision and are not a recommendation to hire, decline, promote, terminate, or take any other employment action. The employer is responsible for independently reviewing the Output, for making all employment decisions, and for providing any disclosures the law requires it to make to you.
12. Your rights
All users. You may access and update your account information in the Service, or contact us at hello@withrigor.co.
United States. For personal information that Rigor processes as a controller — principally account and organization records — and depending on your state, you may have the right to know what personal information we collect and how we use and disclose it; to access and obtain a copy of it; to correct inaccuracies; to delete it; and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no opt-out to offer. We do not use or disclose sensitive personal information for purposes requiring a right to limit. You may designate an authorized agent to make a request; we will verify the request and the agent's authority.
EEA, UK, and Switzerland. You may have the right to access, correct, delete, restrict, or object to processing, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your supervisory authority.
To exercise any right, write to hello@withrigor.co. We will verify your identity and respond within the time required by law — generally 45 days in the US and one month under the GDPR. We may decline a request where an exception applies, and will explain why.
13. International transfers
We are based in the United States and process information there. If you are outside the United States, your information will be transferred to and processed in the United States and other countries where our providers operate, which may have different data protection laws. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, and equivalent mechanisms. A copy of the relevant safeguards is available on request.
14. Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. Customers must not submit information about individuals under 16. If you believe we have such information, contact hello@withrigor.co and we will delete it.
15. Changes to this policy
We may update this policy. We will post the updated version with a new effective date, and for material changes we will give notice by email or in-product notice at least 30 days in advance where practicable.
16. Contact
AYDC LLC (doing business as "Rigor") hello@withrigor.co