Privacy Policy

We are the controller for the data of our own customers: your account, workspace, billing and support correspondence, and website analytics.

You are the controller and we are the processor for the data of the people you invite into a simulation — candidates, sellers and trainees. You decide who is invited, what the simulation asks, and how long results are kept. We process that data only on your documented instructions, which are the settings you choose in the product plus this policy and the Terms. Section "Processing terms (DPA)" below sets out the processor commitments; we will sign a standalone DPA on request.

• Account: name, work email, password credentials handled by our auth provider, workspace name, role, language and branding settings.
• Usage: simulations created, calls run, feature usage, log data (IP, timestamp, user agent) for security and troubleshooting.
• Billing: plan, subscription status, invoices and Stripe customer id. Card details are handled by Stripe — we never see or store them.
• Support: messages you send us and, if you use the in-app assistant, the questions you ask it.

• Identity: name and email address you add manually, upload in bulk, or import from Teamtailor.
• CV and job material: the CV you upload (or the candidate uploads themselves) and the job ad, script or recorded call used to build the scenario. These are analysed to calibrate the scenario and difficulty.
• Voice recording: the audio of the simulation call, including the warm-up check where applicable.
• Transcript: the text of the conversation, with timestamps.
• Scores and reports: stage scores, behavioural stress-test results, ranking, strengths, weaknesses, coaching drills and the exported PDF.
• Call metadata: attempt number, duration, difficulty applied, device/browser diagnostics and connection quality.

Voice recordings can constitute biometric-adjacent data in some jurisdictions. We do not perform voice identification, emotion inference for legal purposes, or biometric matching of any kind. Candidates are told before the call that it is an AI role-play and that the conversation is recorded, transcribed and scored, and they must actively start the call.

• To provide the service to you — performance of a contract, Art. 6(1)(b).
• To run, transcribe and score simulations — processed for you; your lawful basis towards the candidate is typically legitimate interest in assessing suitability, Art. 6(1)(f), or pre-contractual steps, Art. 6(1)(b). You are responsible for identifying and documenting that basis and for informing the individual.
• Security, abuse prevention and service improvement in aggregate — legitimate interest, Art. 6(1)(f).
• Billing and accounting records — legal obligation, Art. 6(1)(c).
• Product emails and marketing to customers — consent or soft opt-in; you can unsubscribe at any time.

• Cloudflare — application hosting and edge delivery.
• Supabase (AWS, EU region) — database, file and recording storage.
• Clerk — authentication and session management.
• ElevenLabs — realtime speech-to-text and text-to-speech for the AI prospect.
• Google (Gemini) — scenario generation, transcription of uploaded calls, scoring and report generation.
• Teamtailor — only if you connect it, for job and candidate sync.
• Stripe — payments and subscriptions.
• Resend — transactional email.
• Google Drive — only if you connect it, for files you choose to attach.

We have a data processing agreement with each subprocessor. We will give notice before adding a new subprocessor so you can object.

• Recordings, transcripts, scores and CVs: kept for as long as your workspace keeps them, up to a default maximum of 12 months, then deleted. You can delete any candidate, trainee or result immediately from the dashboard — the recording, transcript and score go with it.
• Account and workspace data: for the life of the account, then deleted within 30 days of closure.
• Invoices and accounting records: retained up to 7 years where legally required.
• Security logs: up to 12 months.