PRIVACY POLICY

1. PERSONAL DATA WE COLLECT

Depending on how you use the Services, we may collect:

• Account and profile data: name, email address, password hash, account status, language, a profile photo or avatar that you upload, bio, profile links, roles, and account creation details.
• Authentication and security data: access and session information, sign-in method, email verification, password-reset events, legal-document versions and acknowledgment timestamps, security signals, and records needed to prevent misuse.
• Assessment and learning data: selected tests and categories, required labels, answers, scores, progress, time spent, test sessions, target roles or complexity levels, explanations, and feedback.
• Subscription and transaction data: plan, billing period, amount, currency, payment status, provider and invoice references, checkout and payment dates, failure or refund information, and receipt records. Payment card details are entered directly with the payment provider; we do not store your full card number or CVV.
• Communications: support requests, emails, feedback, and other messages you send us.
• Technical and usage data: IP address, browser and device information, operating system, visited pages, navigation events, timestamps, referring URLs, diagnostics, errors, performance data, and session-replay information used to investigate product issues.
• AI feature data: prompts, questions, answers, code, context, and generated output when you use a feature that relies on an AI or translation provider.

We do not intentionally request sensitive personal data. Please do not include health, biometric, financial account, government identifier, or other sensitive information in answers, code, prompts, or support messages.

2. HOW WE COLLECT DATA

We collect personal data:

• directly from you when you register, update your profile, take a test, subscribe, or contact us;
• automatically through cookies, local storage, server logs, and diagnostic technologies;
• from Google when you choose Google sign-in, such as your name, email address, and basic profile information, subject to your Google settings;
• from payment providers, including Monobank acquiring or another provider displayed at checkout, through payment confirmations, webhooks, receipts, refunds, and fraud-prevention signals.

3. WHY WE USE PERSONAL DATA

We process personal data to:

• create and secure accounts, authenticate users, and provide the Services;
• run test sessions, save answers and progress, calculate results, and personalize learning;
• manage subscriptions, payments, receipts, cancellations, and refunds;
• provide support and send service, security, and account communications;
• operate AI-assisted and translation features requested by you;
• monitor reliability, debug errors, prevent fraud and abuse, and improve the Services;
• comply with accounting, tax, consumer-protection, legal, and regulatory obligations;
• establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in operating and protecting the Services, and consent where we request it. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

4. WHEN WE SHARE PERSONAL DATA

We may disclose only the data reasonably necessary to:

• Cloud and communications providers, including Amazon Web Services for infrastructure, storage, email, logging, and payment-receipt storage;
• Authentication providers, including Google when you choose Google sign-in;
• Payment providers, including Monobank acquiring or another provider shown at checkout, to initiate and confirm payments, issue receipts, and handle refunds or disputes;
• Diagnostics providers, including Sentry for error reporting, performance monitoring, and sampled session replay. Optional browser diagnostics are activated only after your consent. Replay text and form inputs are masked and media is blocked. Server-side reliability and security logs are processed separately;
• AI and translation providers, including OpenAI and DeepL, when the relevant feature requires processing content or context;
• professional advisers, auditors, insurers, and authorities where legally required;
• a successor in connection with a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and legal requirements.

We do not sell personal data for money and do not knowingly use it for cross-context behavioural advertising. Service providers may use personal data only to provide their services to us or as otherwise permitted by law and their applicable privacy terms.

5. AI-ASSISTED FEATURES

Some features use third-party AI models. When you use such a feature, the content and context needed to respond may be sent to an AI provider. Do not submit confidential, proprietary, or sensitive personal data. AI output may be incomplete or inaccurate and should be reviewed before you rely on it. We may store relevant inputs and outputs to provide the feature, investigate misuse, resolve support issues, and improve the Services, subject to the retention rules below.

6. COOKIES AND LOCAL STORAGE

We use cookies and similar storage for authentication, language preferences, navigation continuity, cookie choices, and other functions necessary to operate the Site. For guest test sessions, answers may be stored temporarily in your browser's local storage so the session can continue. Optional Sentry error reporting, performance monitoring, and sampled session replay in your browser remain disabled until you consent. Server logs needed to operate, secure, and maintain the Services are processed separately under our legitimate interests and applicable law.

You can control cookies through your browser. Blocking required cookies or storage may prevent sign-in, test sessions, locale preferences, or other features from working. See our Cookie Policy for more information.

7. INTERNATIONAL DATA TRANSFERS

Our providers may process personal data outside Ukraine, the European Economic Area, the United Kingdom, or your country of residence, including in the United States. Data-protection laws in those locations may differ. Where required, we use transfer mechanisms available under applicable law, such as adequacy decisions or contractual safeguards, and assess appropriate technical and organizational measures.

8. DATA RETENTION

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy. The period depends on the type of data, whether your account or subscription remains active, our need to provide the Services, security and dispute risks, and applicable accounting, tax, consumer-protection, and limitation rules. Payment and receipt records may be retained for legally required periods. Logs, diagnostics, and backups are removed or overwritten according to operational retention and backup cycles. When data is no longer needed, we delete or anonymize it unless the law requires continued retention.

9. DATA SECURITY

We use reasonable technical and organizational safeguards designed to protect personal data, including access controls, encrypted network transport, hashed account passwords, monitoring, and restricted production access. No method of transmission or storage is completely secure. You are responsible for using a strong password, protecting your credentials, and notifying us if you suspect unauthorized access.

10. YOUR PRIVACY RIGHTS

Depending on your location and subject to legal exceptions, you may have the right to access, receive a copy of, correct, delete, or restrict the processing of your personal data; object to certain processing; request data portability; and withdraw consent. You may also object to direct marketing at any time.

Residents of certain US states may additionally have rights to know the categories and sources of data, request correction or deletion, obtain a portable copy, and opt out of sale, targeted advertising, or qualifying profiling where applicable. We will not discriminate against you for exercising a privacy right.

To make a request, email support@interviewboom.com. We may ask for information needed to verify your identity and authority. You may also complain to the data-protection authority in your country. EEA and UK residents may lodge a complaint with their local supervisory authority.

11. SERVICE AND MARKETING COMMUNICATIONS

We may send messages necessary to operate your account or subscription, including verification, security, payment, receipt, and policy notices. These are not marketing messages. Where we send marketing communications, you may unsubscribe through the message or by contacting us. We may still send essential service messages.

12. CHILDREN

We do not knowingly collect personal data from a child who cannot lawfully consent to processing in their jurisdiction without valid authorization from a parent or guardian. If you believe a child provided personal data unlawfully, contact us so we can investigate and take appropriate action.

13. AUTOMATED RESULTS

The Services automatically score answers and may recommend content or complexity levels. These features are for learning and interview preparation and are not intended to make legal or similarly significant decisions about you. Contact us if you believe an automated result is incorrect.

14. THIRD-PARTY LINKS AND SERVICES

The Services may link to third-party websites or services. Their privacy practices are governed by their own notices, and we are not responsible for their content or practices. Review the relevant third-party policy before providing personal data.

15. CHANGES TO THIS POLICY

We may update this Policy to reflect changes to the Services, providers, or law. We will post the revised Policy with a new "Last updated" date and, where required, provide additional notice. Material changes apply prospectively from their effective date.

16. CONTACT US