Privacy policy
1. Who is responsible
The data controller is Arthur Boillot EI, [postal address], the contact form.
2. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Google account data: name, email, Google ID, profile photo | Create and secure your account | Contract | Life of the account |
| Your CV (file and extracted text) | CV analysis; personalising mock interviews | Contract | Until you delete it or your account |
| Mock interview transcripts, scores and feedback | Run interviews, give feedback, track progress | Contract | [24 months] after the interview, or until account deletion |
| Learning progress and quiz results | Unlock levels, suggest next steps | Contract | Life of the account |
| A short internal summary of your preparation (goals, strengths, areas to improve) | Let the AI interviewer adapt to your level | Contract | Life of the account |
| Payment and billing data (handled by Stripe; we never see full card numbers) | Billing, accounting | Contract and legal obligation | 10 years for invoices (French accounting law) |
| Technical logs | Security, debugging | Legitimate interest | [12 months] |
3. Voice input
When you speak to the AI interviewer, speech recognition runs on your own device, in your browser. Your audio is not sent to our servers or to any third party; only the resulting text is sent.
4. Artificial intelligence
Interviews, feedback and CV analysis are generated by an AI model (Google Gemini API, paid tier). The text you write or dictate, the case content and the relevant parts of your profile are sent to the model to produce answers. Under the paid-tier terms, Google does not use this content to train its models. Scores are training feedback only: no decision with legal or similarly significant effect is made about you.
5. Who receives your data
| Provider | Role | Location / safeguards |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | London, United Kingdom (eu-west-2, covered by an EU adequacy decision); Data Processing Agreement |
| Render Services, Inc. | Application hosting | Frankfurt, Germany (EU); Data Processing Agreement; Standard Contractual Clauses if outside the EU |
| Google (Gemini API) | AI model | Data Processing Terms; Standard Contractual Clauses / EU-US Data Privacy Framework |
| Stripe | Payments | Stripe Payments Europe; independent controller for payment data |
| Google (Sign-in) | Authentication | Google privacy policy |
We never sell your data.
6. Your rights
You can access, correct, delete, export and restrict the processing of your data, and object to processing based on legitimate interest. Your CV and account can be deleted at any time from the Account page. For any request, use the contact form (reason: Other). You can also complain to the CNIL (www.cnil.fr).
7. Security
Data is encrypted in transit and at rest by our providers. Access to personal data is restricted to the publisher and logged.
8. Minors
The Service is not intended for people under 16.
9. Changes
We will inform you of material changes to this policy by email or in the app.