Privacy policy

1. Data and operation

When you request practice, CV text, the job description, your answers and generated context are sent to our servers and the AI provider identified in the current services panel: Anthropic or the compatible service configured by the operator. PDFs are read in your browser, but the extracted text needed for practice is transmitted.

Optional dictation sends audio to the identified transcription provider (Groq or a compatible service). Read-aloud may send generated text to the identified voice provider (Azure Speech, ElevenLabs or a compatible service), or use browser/device voices. That text may contain your application details; browser voices may themselves rely on system services.

The contact form, when available, processes an optional name, email and message. Infrastructure also processes IP addresses, request metadata and technical data to deliver the service and prevent abuse. There are no customer accounts or active credit purchases.

2. Purposes and legal bases

Necessary processing delivers the practice you request (GDPR Article 6(1)(b)). Before processing a CV, we request explicit consent for any special-category information it may contain (Article 9(2)(a)). Avoid unnecessary health, membership, belief and third-party information.

Optional analytics relies on consent (Article 6(1)(a)). Abuse prevention and responding to enquiries rely on legitimate interests in operating the service and replying to you (Article 6(1)(f)), subject to your rights. Rights requests and legal obligations are handled under Article 6(1)(c). Contact messages are not used to send advertising.

3. Statistics and security

First-party pageviews, source attribution and Vercel Web Analytics start only after you accept Analytics. Our counter uses a keyed cryptographic function to derive, from technical data, a pseudonymous identifier that changes every calendar month (UTC); only approximate counts from which no identifier can be extracted are stored. It lets us estimate distinct people per month on the site and in the app, and it cannot link activity across different months. Routes, approximate country, device and source support aggregate statistics.

Operational action and cost counters are aggregated. To prevent a retry from counting an interview or contact twice, a fingerprint of its random identifier is kept for up to seven days; it does not identify the person or contain a CV, answers or email address. Interviews are counted by language, difficulty, mode and length. Security controls and IP-based limits may retain an IP address or network prefix in Redis for their window, usually up to 24 hours. We do not claim that all infrastructure data is anonymous.

Signing in to the admin panel excludes the operator browser for eight hours using a technical cookie; the operator can also change that choice in the panel. This does not establish that all remaining activity comes from external users.

With analytics consent, the tab retains the entry source and a limited set of source, medium, campaign and post labels. They survive navigation, expire after 30 minutes of inactivity and are renewed when you arrive through another tagged campaign. Withdrawing consent deletes them. They support aggregate attribution of views, interview starts, evaluations and contacts. If you submit the contact form with that consent, the email received by the operator also includes these labels to identify the inquiry source, never the full referring URL. The form works without analytics consent and then attaches no source.

4. Providers and international processing

The current services panel identifies the configured AI, voice and dictation destinations by name and domain and also appears before CV consent. An OpenAI-compatible protocol does not necessarily mean OpenAI is the provider. The interface asks for consent again if it detects changed identification before starting new practice. Vercel (hosting and consented analytics), Upstash (counters and controls) and Resend (contact delivery) are also used where available. Each service receives the content needed for its function.

Some providers may process data outside the EEA, including in the United States. Processing, retention and international safeguards depend on the service, region and applicable contract. Contact us for information and a copy of applicable safeguards; provider documentation is linked below. We do not claim every provider has the same certification or retention arrangements.

5. Retention and erasure

The app stores practice in tab storage, not its own CV database. New interview resets the practice. A stored copy is rejected when loaded more than 24 hours after its last save. Browsers normally remove it when the tab closes, but may restore sessions.

Local history retains up to 20 results (score, difficulty, role and company), pruning results older than 90 days when read. The local CV consent receipt expires after 360 days. Erase my data removes these browser records and preferences.

Daily metric series, including the approximate counts of people per month, expire according to configuration: 400 days by default, no more than 730. Cumulative counters may be retained longer. Contact messages are kept while handled and, where needed, for obligations or claims. Provider retention is independent of browser erasure.

6. Data and model use

The app has no function to train or fine-tune models with your CVs, audio or answers. Each provider’s data-use terms and settings are separate; this is not a promise of zero retention or absence of third-party security processing.

Your data is not offered as a candidate database or published through use of the simulator. A sale of the software does not itself authorise transferring personal data for other purposes.

7. Security and decisions

HTTPS connections, access controls, validation and request limits are used. Browser storage also depends on device security; do not share an open session containing personal information.

Feedback is a training simulation. The service does not decide whether you are hired or send an assessment to employers. Do not use its scores to make employment decisions about others.

8. Your rights

You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent without affecting prior lawful processing. Contact the operator; proportionate identity information will only be requested where necessary.

Withdraw analytics through Cookie settings and CV consent through privacy controls. You may complain to Spain’s AEPD (aepd.es) or another competent authority. The service is for adults aged 18 or over; contact us if a minor’s data has been supplied.