Legal

Privacy Policy

Last updated: 7 August 2026

inroad ("we", "us", "our") is committed to protecting your personal information. This policy explains what data we collect, how we use it, and your rights.

Who we are

inroad is operated by Inroad Careers Ltd, registered in England and Wales (company number 17298134), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for the personal data described in this policy.

You can reach us about any privacy matter through our contact page.

1. What we collect

When you use inroad we may collect:

• Account information — your email address, first name, and university.
• Profile preferences — target industries, company size preference, and a short bio you provide.
• Usage data — which cards you view, whether you send outreach emails, and whether you receive replies.
• Technical data — browser type, device, IP address, and session cookies.
• Billing data — if you subscribe to a paid plan, we store your subscription status, plan, and renewal date. Card details are collected and held by Stripe, our payment processor. We never see or store your card number.
• Professional contact data — names, job titles, and company affiliations of professionals at target companies, identified through publicly available web sources. Alongside these we hold a work email address for each contact. These addresses are constructed from the standard email format used by the person's employer rather than taken from any personal data record. We then check them with a third-party deliverability service, which tells us whether the mailbox appears to exist, and we store that result so we can show you how reliable an address is likely to be. We do not collect or store personal (non-work) email addresses.
• Microsoft account connection — if you choose to connect your Outlook or Microsoft 365 account, we store OAuth tokens (access token, refresh token, and expiry time) to enable one-click email sending on your behalf. We do not store the contents of your inbox or any emails beyond those you explicitly send through inroad. You can disconnect your Microsoft account at any time from the dashboard, which immediately removes all stored tokens.

2. How we use your data

• To match you with relevant internship and graduate opportunities.
• To identify relevant professionals at target companies using publicly available web data, to construct work email addresses from standard company email formats, and to check whether those addresses are deliverable.
• To generate personalised email drafts. Your profile details (name, university, target industries, and bio) are sent to our language model provider to produce the draft.
• To send you service emails: sign-in links, billing confirmations, and the listing alerts and opportunity digests you have chosen to receive.
• To send outreach emails on your behalf when you use the one-click send feature via your connected Microsoft account.
• To improve our matching, ranking, and product quality.

We do not send you promotional or marketing email. We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

3. Microsoft OAuth and email sending

If you connect your Microsoft account, inroad uses the Microsoft Graph API to send emails directly from your address when you click Send on a match card. We request only the minimum permissions required: Mail.Send and offline_access. We do not read, store, or process any emails in your inbox.

Your OAuth tokens are stored securely and used solely to send emails you have explicitly approved. You may disconnect your Microsoft account at any time from the dashboard, which revokes our access and deletes all stored tokens. Revoking access through your Microsoft account settings will also prevent further sending.

4. Legal basis for processing

Your data. We process your account information, profile preferences, and usage data to perform our contract with you under UK GDPR Article 6(1)(b), so that we can operate your account, rank opportunities for you, and draft outreach on your request. We rely on your consent under Article 6(1)(a) for the listing alerts and opportunity digests you switch on, and for connecting your Microsoft account. You can withdraw either at any time from Settings without losing access to the rest of the service. Where we use aggregate usage data to improve ranking and product quality, we rely on our legitimate interests under Article 6(1)(f). Billing data is processed to perform our contract and to meet our legal obligations under Article 6(1)(c), including tax and accounting records.

Third-party professional data. Where we process personal data relating to professionals at target companies (names, job titles, company affiliations, and constructed work email addresses), we do so on the basis of legitimate interests under UK GDPR Article 6(1)(f). Our legitimate interest is in enabling students and early-career professionals to make personalised career outreach to relevant contacts at companies they are targeting. We have assessed that this interest is not overridden by the rights of the individuals concerned, given that the information is limited to professional context, is sourced from publicly available web sources, is used only to enable individual person-to-person outreach and never for bulk marketing or onward sale, and that individuals can request removal at any time.

5. Where your data is held

Our infrastructure is hosted in the United Kingdom and the European Economic Area. We use a number of service providers to operate inroad, including for hosting, email delivery, payment processing, and generating email drafts. Each acts as our processor and handles data only on our instructions. Some are based in the United States, which means your personal data may be transferred outside the UK. Where that happens we rely on the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or on UK adequacy regulations where the provider is certified under the UK Extension to the EU-US Data Privacy Framework. You can request details of our providers and a copy of the safeguards we rely on through our contact page.

6. Data retention

We retain your account data for as long as your account is active. Outreach history is anonymised after 90 days. You can delete your account at any time from the Settings page, which permanently removes all your data including any stored Microsoft OAuth tokens.

Billing records are the one exception. Where you have made a payment, we keep the transaction record for six years after the end of the relevant financial year, because UK tax law requires it. This is limited to the record of the transaction and does not include your profile or usage data.

7. Your rights

Under applicable data protection law (including UK GDPR) you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and all associated data.
• Receive a copy of the data you provided to us in a portable format.
• Withdraw consent at any time where we rely on it, including for digests and for your connected Microsoft account. Withdrawing consent does not affect processing carried out before you withdrew it.
• Object to processing carried out on the basis of our legitimate interests.
• Request removal from our contact dataset — if you are a professional whose name or work email address appears on inroad and you would like it removed, please contact us via our contact page. We will action removal requests within 30 days.

To exercise any of these rights, please visit our contact page.

8. Cookies

We use the following first-party cookies. We do not use advertising cookies or any third-party tracking cookies.

• inroad_session — strictly necessary. Keeps you signed in for up to 30 days. Set on login, deleted on logout.
• inroad_refresh — strictly necessary. Used to re-issue your session without requiring you to log in again. Set on login, deleted on logout.

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email. Continued use of inroad after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related enquiries, please contact us at our contact page.