Privacy policy

RecomBuilder is operated by DigitVibe Corporation ("DigitVibe", "we", "us"), a federal Canadian corporation based in Calgary, Alberta, Canada. DigitVibe is responsible for the personal information handled through RecomBuilder (under the GDPR, we are the "controller"). This policy explains what information RecomBuilder handles, why, who receives it, how long it is kept, and your rights.

In short: RecomBuilder has no database and no accounts. What you type is used to write and email your letter, and then it is discarded. We do not sell your information, use it for advertising, or let anyone use it to train AI models.

We keep a public aggregate count of successful letter drafts in Replit App Storage. It contains only a total and counter dates—not names, email addresses, answers, letters, or identifiers. This count persists across deployments and does not require analytics cookies.

What we collect and why

• Your answers. Your name, your email address, your recommender's name, and what you tell us about your relationship, the position or program, and your accomplishments. We use them only to write your letter and email it to you. Giving them is your choice, but we cannot write a letter without them.
• Revision requests. If you ask for changes, we send your free-form request and the version of the letter being revised to the selected AI provider alongside your current form answers. They follow the same no-storage and zero-data-retention rules as a new draft.
• Files and links (premium drafts only). A job description, your CV, and links you add. Our server reads them and passes the text to the AI model with your answers. We do not search the web beyond the links you give us.
• Payment details (premium drafts only). Stripe collects your card and billing details directly; we never see your card number. Our server reads your billing country and province or postal code from Stripe to determine any Canadian sales tax included in the price. We record only the resulting Canadian province or territory, or that the billing location is outside Canada, alongside the payment status, amount, and receipt email; we do not store your full billing address.
• Technical information. Your IP address and the information your browser sends with every request. We use them to deliver pages and to prevent abuse, such as too many requests.
• Analytics, only if you accept. See "Cookies and similar technologies" below.

Sensitive information. Please do not include sensitive information, such as health, religion, sexual orientation, or immigration status, unless it is essential to your letter. If you include it, we use it only to write your letter, based on your explicit consent, which you give by submitting it.

Information about other people. Your letter names your recommender and may mention other people. Only include it if you are allowed to share it. We use it only to write your letter, and it is discarded with everything else. Anyone named in a request can contact us about their rights.

How long we keep it

• Your answers, files, links, and letter: held in our server's memory only while your letter is written, usually a minute or two, then discarded. They are never saved to a database or a file, and never written to our logs.
• Abuse prevention: your IP address and email address are turned into scrambled codes with a secret key that is replaced every 7 days, and the request counts are deleted within 7 days. The raw addresses are not kept.
• Server logs: record only which page was requested, the result, how long it took, the AI model used, and its cost. They contain no IP address, email address, or anything you typed.
• Email: SendGrid holds the message only as long as needed to deliver it, and keeps delivery records, such as your email address and whether the message arrived, for up to 37 days.
• Payments: Stripe keeps payment records for as long as tax, accounting, and anti-fraud laws require. The record includes the amount, any sales tax and the province or territory it was based on, your email address, the model you chose, the language, and a one-way fingerprint of your answers that makes sure the paid draft matches what you paid for. The fingerprint cannot be turned back into your answers.
• Aggregate letter count: retained in Replit App Storage for the lifetime of the counter. Only the total and counter dates are stored; no personal information or letter content is included.
• Analytics: Google Analytics deletes visit data after at most 14 months.
• Emails you send us: kept only as long as needed to answer you and keep a record of your request.

Who receives your information

We share your information only with the service providers below, and only for the purposes described. They are not allowed to use it for their own purposes, except Stripe and Google as described.

• Replit, Inc. (United States) hosts and runs the website, so every request passes through it.
• OpenRouter, Inc. (United States) passes your answers to the AI model you choose and returns the letter. It does not store prompts or responses. It screens requests for child sexual abuse material and may keep flagged content for review.
• The AI provider that runs the model you choose, such as Anthropic, OpenAI, Google, or xAI, or a cloud service that hosts their models (mainly in the United States). We only use providers with zero data retention: they do not use your information for training and do not keep it after your letter is written. Sources: OpenRouter zero data retention and OpenRouter data privacy (checked November 6, 2026).
• Twilio SendGrid (United States) emails your draft to you. We turn off open and click tracking.
• Stripe processes premium payments. Stripe also uses payment information for its own purposes, such as fraud prevention and legal compliance, as described in Stripe's privacy policy.
• Google (Google LLC in the United States, or Google Ireland Limited for visitors in Europe) provides Google Analytics, only if you accept it.

We may also disclose information if the law requires it, or to a buyer if DigitVibe's business is sold, in which case this policy still applies.

International transfers

DigitVibe is in Canada, and most of our providers process information in the United States. The European Commission and the United Kingdom recognize Canada as providing adequate protection for personal information. When information goes to a provider in the United States, it is protected by the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, or by standard contractual clauses approved by the European Commission and the UK. Information sent to providers outside Canada may be accessible to authorities there under their laws. You can ask our privacy officer for written information about our service providers outside Canada.

Legal bases (GDPR and UK GDPR)

• Writing and emailing your letter, and taking payment: necessary to provide the service you ask for (Article 6(1)(b)).
• Sensitive information you choose to include: your explicit consent (Article 9(2)(a)).
• Preventing abuse and keeping the service secure: our legitimate interest in keeping RecomBuilder safe and available (Article 6(1)(f)).
• Keeping payment records and charging sales tax: our legal obligations under tax and accounting laws (Article 6(1)(c)).
• Analytics: your consent (Article 6(1)(a)), which you can withdraw at any time.

RecomBuilder does not make decisions about you that have legal or similarly significant effects. The AI writes a draft; people decide what to do with it.

Cookies and similar technologies

• Your cookie choice is saved in your browser's local storage (rb-analytics-consent) so we do not ask again. It stays until you clear your browser data. It is strictly necessary and sends nothing to us.
• Stripe, if you choose a premium model, sets the cookies __stripe_mid (1 year) and __stripe_sid (30 minutes) to prevent payment fraud. They are strictly necessary for payments.
• Google Analytics, only if you click "Accept", sets the cookies _ga and _ga_ followed by our ID, which expire after at most 13 months. It measures how RecomBuilder is used, such as visits, the pages viewed, how long people stay, and how they arrived. It receives the pages you view, the site that sent you, your device, browser, operating system, and language, and your approximate location, which Google works out from your IP address without storing the address. It never sees what you type in the form or your letter. We turn off Google signals and ad personalization. Depending on our Google Analytics data sharing settings, Google may also use this information to provide and improve its own services, as explained in How Google uses information from sites that use its services.

If you click "Decline", Google Analytics is not loaded. You can change your choice at any time with "Cookie settings" at the bottom of every page; withdrawing consent deletes the Google Analytics cookies. If your browser sends a Global Privacy Control signal, we treat it as "Decline".

Your rights

Depending on where you live, including the European Economic Area, the United Kingdom, Switzerland, Canada (including Quebec), California and other US states, and Brazil, you have the right to:

• know what personal information we hold about you and get a copy;
• have it corrected or deleted;
• restrict or object to how we use it, including uses based on our legitimate interests;
• receive it in a portable format;
• withdraw your consent at any time, without affecting earlier use;
• not be treated differently for using your rights.

To use these rights, email info@digitvibe.com. You can also use an authorized agent. We may need to confirm your identity, and we reply within 30 days. Because RecomBuilder keeps nothing in a database, we usually hold nothing about you, but we will tell you what our providers may hold and help you reach them.

You can also complain to a data protection authority, such as your local authority in the European Economic Area, the UK Information Commissioner's Office, the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, Quebec's Commission d'accès à l'information, the California Privacy Protection Agency, or Brazil's National Data Protection Authority (ANPD). We would appreciate the chance to help first.

Notice for California and other US states

In the past 12 months, RecomBuilder collected these categories of personal information: identifiers (name, email address, IP address); professional, employment, and education information you include in your answers; commercial information (premium purchases); internet activity (only with analytics consent); and sensitive information only if you chose to include it. We collect it from you and your browser, for the purposes and with the providers listed above, and keep it for the periods listed above. We do not sell or share personal information for cross-context behavioral advertising, including that of people under 16, and we use sensitive information only to write your letter.

Security

All traffic is encrypted with HTTPS. We keep no database of your information, our logs exclude personal information, and our providers are bound by data protection terms. If a breach affecting your personal information occurs, we will notify you and the authorities as the law requires.

Children

RecomBuilder is not meant for children under 13, and we do not knowingly collect their information. If you are under 16, ask a parent or guardian before you accept analytics cookies or buy a premium draft.

Privacy officer and contact

Our privacy officer is responsible for how DigitVibe handles personal information and can answer questions about it: Privacy Officer, DigitVibe Corporation, Calgary, Alberta, Canada, info@digitvibe.com.

Changes

We may update this policy. The date below shows the latest version, and we will explain significant changes on this page.

Last updated: November 7, 2026.

Back to RecomBuilder