Privacy policy

The short version

We keep your email address, the text of the answers you submit and the reviews we produce for them. Audio is turned into text and then discarded; we do not keep recordings. The reviews are written by an AI model running on an enterprise Microsoft service in the EU; nothing you say is used to train it or any other model. Payments are handled by Stripe. We use no advertising cookies and, unless you agree in the banner, no analytics cookies.

Who is responsible

Avlas Digital (registered business name No. 793798), Park House, The Square, Claremorris, Co. Mayo, F12 HE97, Ireland. Email: [email protected]. We are the data controller for the information described here.

What we collect and why

• Email address. To create your account, send one-time login links and codes, send receipts and answer your emails. Legal basis: performing our contract with you.
• Your answers. The text of every answer you submit for review, whether you typed it or spoke it, together with the question, the review and the estimated mark. Stored with your account so you can revisit and improve them (My Examples). Legal basis: performing our contract. For guests running the free demo, the answer and review are stored with a connection identifier rather than an account, and deleted after 30 days. If you log in within 24 hours from the same connection, those demo answers are moved into your account so they appear in My examples.
• Audio. When you record an answer, the recording is sent to our speech-to-text provider, converted to text and discarded. We do not store audio files and we do not use your voice for anything else.
• Payment records. Which plan you bought, when, how much, and Stripe’s identifiers for the payment and, for the monthly plan, the subscription. We never see your card number. Legal basis: contract and our legal duty to keep accounting records (kept 6 years).
• Technical logs. Rate-limit counters keyed by connection address and account, and error logs, kept for up to 30 days to keep the service running and stop abuse. Legal basis: our legitimate interest in running a secure service.
• Advertising click identifiers. If you arrive from a Google ad, the click identifier in the address may be kept with your account for up to 90 days so that a purchase can be attributed to the ad. It is not used for anything else. Legal basis: legitimate interest in measuring our advertising.
• Your interview date and how it went. Both optional. The date turns your account page into a plan for the days left; the outcome (got it, not this time, waiting) is the only way we can tell whether the marking here matches the room. Neither is shown to anyone or used to change a mark, and both go when the account does. Legal basis: the contract with you for the date; consent for the outcome, which you give by tapping it.
• Waitlist. If you ask us to build your grade, we keep your email and the grade until that grade is live and one email has gone to you, or for 12 months, whichever is first. Legal basis: consent.

The AI, plainly: what it does and does not do with your answer

The review is written by a large language model. It is not a person, and no person reads your answers unless you press the report button under a review or write to us about one.

• Where it runs. On Microsoft’s Azure OpenAI Service, an enterprise deployment we control, in an EU data centre (Sweden). It is not the public ChatGPT. Microsoft does not use what we send to train or improve its models, does not share it with OpenAI or with other customers, and may hold a copy for up to 30 days for abuse monitoring only, then deletes it.
• No training on your answers. Ever. We do not train, fine-tune or build any model on your answers, your reviews or your voice, and we do not let anyone else do so. Your story stays your story.
• What we keep, and why. Your answer and its review are kept with your account so you can come back to them; that is the product, and you can delete any of them at any time. To keep the marking honest we also keep three things that do not identify you: counts with no text in them (marks by grade, which indicators get missed, how long answers run); reviews you report to us, with the answer, for up to 12 months, so we can check the marker and fix it; and, when we change the marker, we may take a small sample of answers with the account, email and any names removed, held for up to 90 days, on which we re-run the marker, so a change that would mark you differently is caught before it goes live. Nothing from that sample is shown to other users or used to write questions about you.
• It can be wrong. A model can misread an answer. The mark is an estimate and the review says so. Report anything that looks unfair and a person will look at it.

A word about what you say in your answers

Interview examples describe real work. Please do not include other people’s personal data (a colleague’s name, a customer’s case details) in your answers. Boards do not want it either. Anything you do include is processed only to produce your review and is stored as part of your answer until you delete it.

Who processes data for us

• Cloudflare hosts the site and the database (EU region).
• Microsoft Azure, EU region (Sweden), provides the speech-to-text and the language model that produces the reviews, under Microsoft’s enterprise terms: not used to train models, not shared, held at most 30 days for abuse monitoring.
• Stripe processes payments and, for the monthly plan, runs the customer portal where you cancel or change your card. Stripe’s own privacy notice applies to what you enter on their pages.
• Amazon Web Services (Ireland region) sends our emails.
• Google Analytics, only if you accept the cookie banner, to see which pages get used. Without consent it runs cookieless.

Each processor acts on our instructions under a data processing agreement. Where a provider is outside the EU, transfers rely on the EU Standard Contractual Clauses or an adequacy decision.

How long we keep things

• Account, answers and reviews: until you delete them or the account. Accounts with no login for 3 years are deleted.
• Payment records: 6 years (tax law).
• Login links and codes: 15 minutes, then deleted. Sessions: 180 days.
• Question and review reports you send us, with the answer concerned: until resolved, then 12 months.
• Anonymised calibration sample (no account, email or names): 90 days.
• Waitlist email: until your grade is live and you have been told, or 12 months.
• Counts with no text (marks by grade, indicators missed): kept indefinitely; they cannot identify anyone.

Your rights

You can ask for a copy of your data, correct it, delete it, or object to processing based on legitimate interest. Delete individual answers from My Examples at any time; delete the whole account yourself from the Account page (“Delete my account”) and it is gone at once, with any subscription cancelled (payment records stay for the legal period). Or email [email protected] from the account address. You can complain to the Data Protection Commission, dataprotection.ie.

Cookies and local storage

One cookie keeps you logged in. Local storage remembers your theme choice, your cookie-banner answer and a copy of your login state so pages paint correctly. Analytics cookies are set only if you say yes in the banner.

Changes

Material changes are announced on this page with a new date and, for account holders, by email.