Privacy Policy
[LAWYER REVIEW] Retention periods, the legal entity, the EU representative (if required) and the subprocessor list must be confirmed before the closed beta opens to users outside the operator’s own testing.
1. Controller and contact
The controller is [LEGAL ENTITY], [REGISTERED ADDRESS]. Privacy questions and rights requests: hello@interviewchallenger.com.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Email, username, full name, hashed password, OAuth identity, plan | Create and secure the account, provide the plan |
| Offer and generated content | Job-offer URL or text, uploaded PDF/DOCX text, company name, generated pages, quiz answers | Generate the preparation site and keep it available |
| Site credentials | Site and editor password (stored as a Cloudflare/GitHub secret, never shown to us in clear text after creation) | Protect the published site |
| Usage and logs | IP address, request id, timestamps, job status, errors | Operate, debug and secure the service |
| Support | Messages you send us | Answer your request |
We do not ask for special-category data. Please do not put it in an offer or chat message.
3. Why we process it (legal bases)
- Contract — create the account, generate and host the site, provide support.
- Legitimate interests — secure the service, prevent abuse, debug and improve reliability.
- Consent — optional product emails, where offered. You can withdraw it at any time.
- Legal obligation — tax, accounting and lawful requests, when applicable.
4. Retention
Proposed periods, to be confirmed in the [LAWYER REVIEW]:
- Account: while the account is active, then 30 days after a deletion request (backups included).
- Offer and generated site: until you delete the site or account, or 12 months after the last activity on that site.
- Application logs: 30 days.
- Security and audit records: 12 months where needed to investigate abuse.
- Billing records (when paid plans launch): the period required by tax law.
5. Where the data is hosted
The API and worker run on Hetzner infrastructure in the EU. Secrets are managed with Infisical (EU). Generated sites are stored in private GitHub repositories and served by Cloudflare Pages, which may process data outside the EU under its standard contractual clauses. The landing and app are served through Cloudflare.
6. Subprocessors
| Processor | Purpose | Location |
|---|---|---|
| Hetzner | API, worker, database and Redis hosting | EU |
| Cloudflare | Pages hosting, CDN, DNS and edge | Global / EU where configured |
| GitHub | Private site repositories and deploy secrets | US / global |
| Infisical | Secret management | EU |
| [EMAIL PROCESSOR] | Verification and reset emails | [REGION] |
When Stripe is enabled for paid plans, Stripe will be added here before any payment is taken. The current beta does not process payments.
7. No training on your content
We do not use your offers, generated sites or chat messages to train our own models. The model provider processes the prompt to produce the output for your request; we do not grant it a separate training licence.
8. Your rights
Under the GDPR you can request access, correction, deletion, restriction, portability and objection, and you can withdraw consent. Use the contact address above; we answer within one month. You can also complain to your local supervisory authority. Account deletion is available in the app once the account settings screen ships; until then, contact us.
9. Cookies and local storage
We use a refresh cookie for authentication, and local/session storage for the access token, theme, session run ids and (for the open tab only) the site passwords shown after a publish. We do not use advertising cookies in the beta.
10. Security
Access is role-limited, secrets are stored outside the repository, traffic is encrypted in transit, and backups are access-controlled. See the security page for the current controls and how to report a vulnerability.
11. Changes
We update the version and effective date at the top. Material changes are announced in the app or by email. Questions: hello@interviewchallenger.com.