Privacy Policy

VeilPrep ("we," "our," or "us") is committed to protecting the privacy of our users ("you" or "your"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the VeilPrep desktop application and related services (collectively, the "Service"). By using VeilPrep, you consent to the practices described in this policy.

VeilPrep is a desktop application that transcribes interviews in real time, generates AI-powered answers, lets you rehearse with an AI interviewer that speaks, prepares you with a match analysis and a question bank, and writes a structured report after each round. We have designed our architecture to minimize data collection and prioritize your privacy. Please read this policy carefully to understand how we handle your information.

Data controller. The controller responsible for your personal data is [À compléter : nom légal / legal name], SIRET [À compléter : SIRET], [À compléter : adresse / registered address], France (see our Legal Notice). For any privacy request, contact privacy@veilprep.com.

1. Information We Collect

a) Account Information

When you create a VeilPrep account, we collect the following information through Supabase Auth:

• Email address and full name, provided during registration or obtained via Google Sign-In (OAuth).
• OAuth profile data from Google, including your display name, email, and profile identifier, used solely for authentication purposes.
• Payment information is processed exclusively by Stripe, which is PCI DSS Level 1 compliant. We do not store your credit card number, CVV, or full payment details on our servers. We retain only a Stripe customer identifier and credit balance.
• Your confirmation of age and acceptance of the Terms: the date and the version of the Terms you accepted, recorded on your account when you confirm them in the application.
• Your recording-consent attestation: for each live interview round, the time at which you confirmed in the application that you are responsible for any consent the recording laws of your jurisdiction require (see the Terms, section 2). It is stored with the round.
• Network address, hashed: to limit automated abuse, our servers keep a salted one-way hash of the IP address of each request to the AI and update endpoints, in hourly counters that are deleted after seven days. The address itself is not stored and the hash cannot be reversed without the salt, which is held separately. Our hosting provider also derives the country of the request from its address to apply the geographic restrictions in the Terms; the country is not stored.

b) Usage Data

To manage your account and credit balance, we track the following usage data:

• Credit balance (available interview credits remaining)
• Credit transaction history (purchase dates, amounts, credit pack purchased)
• Interview session records (start time, duration, credit consumed, whether the session was a live interview or a mock interview)
• Service log: for each request the application makes to our API, our servers record the endpoint called, the result (the HTTP status and, on failure, a short fixed label such as "over_budget"), how long it took and the account that made it. No request content is recorded. Entries are deleted 90 days after they are written.
• Cost records: for each call our servers make to an AI provider on your behalf, we record the provider, the model, the feature, the tokens or seconds of audio it consumed, what it cost us and the round it belonged to, with your account id. These are our accounting records; they hold no prompt, transcript or text you wrote. They are kept with your account.
• Spend-ceiling counters: to stop automated abuse, we keep an hourly count of your AI requests per account, weighted by their cost. Counters are deleted after seven days. (The hashed per-address counters are described in 1a.)

These records are transactional data only. We do not log the content of your transcriptions or AI interactions alongside usage data.

c) Audio & Transcription Data

• Microphone audio: Your voice is captured locally on your device and streamed in real time to Deepgram's servers via a secure WebSocket connection for transcription. The raw audio is never saved to disk, uploaded to VeilPrep servers, or retained after the streaming session ends.
• System audio: Audio from your system output (used for speaker separation and interviewer transcription) is streamed to Deepgram in the same manner. It is processed in real time and NOT stored by VeilPrep.
• Mock interview audio: During a mock interview, your voice is streamed in real time to OpenAI so that the AI interviewer can hear you and reply with speech, and the interviewer's spoken questions are streamed back. Warm-up questions are read aloud through OpenAI's text-to-speech. The audio is processed in real time and NOT stored by VeilPrep.
• Transcripts and reports: Transcribed text is displayed within the application interface during your session. When an interview round ends, the transcript, the AI-generated report (as text and as a structured copy: scores, per-question assessments, strengths, improvements and action items) and the answers the assistant offered during the round are stored in your Supabase account so you can review them later. The transcript and the assistant's answers are kept for 90 days (see section 4); the report and its structured copy stay until you delete the round. They are associated with your account and protected by Row-Level Security (only you can access them). You may delete them at any time by deleting the associated round or application.
• Preparation material you create: The job descriptions, CV text, notes, question-bank cards, STAR stories, scheduled rounds and coach notes you add or generate are stored in your account under the same protection, so they are available across sessions.

d) AI Interaction Data

• Interview questions: Detected interview questions are sent to Anthropic's Claude API to generate suggested answers. These prompts are transmitted over encrypted connections and discarded after the response is received. The suggested answer is shown to you and saved with the round (see 1c).
• Resume text, job descriptions and preparation material: If you provide a resume or job description, this text is included in the API requests to Anthropic that generate answers, the match analysis, the question bank, extracted STAR stories, practice questions and the interview report, and in the request to OpenAI that sets up a mock interviewer. Your saved STAR stories, prep notes and coach notes are included as well. This material is used solely to make the output relevant to you. Before your resume or job description is sent, the application removes the contact details they contain: email addresses, telephone numbers, postal addresses, web links and profile URLs, and the name line of a resume. The models do not need them to help you. Our servers repeat this removal on the resume and job description in the request that sets up a mock interviewer; the other requests are relayed to the provider as the application sends them. The removal is not applied to your STAR stories, prep notes, coach notes or transcripts, which are sent as written, so do not put contact details in them that you would not want a provider to receive. It is sent under each provider's standard API terms, which means it is not used to train their models; they may hold it for a short period for abuse monitoring under their own published retention policies. VeilPrep keeps only what is described in 1c and 1e.
• Mock interviewer: The AI interviewer's voice conversation runs through OpenAI's Realtime API (see 1c). The written transcript of the mock is saved to the round like a live interview's.
• Screen captures: When you use the coding or system design analysis, VeilPrep captures your whole primary display at that moment, not a selected window, and sends that image to Anthropic to be analysed. Whatever else is on screen is in that image, so close anything you would not want to send before using it. The image is not saved to disk and is not retained by VeilPrep after the response arrives. The written analysis it produces is saved with the round like an answer (see 1c).

e) Coach Notes

VeilPrep keeps a short list of "coach notes" about how you answer interview questions: for example the length and structure of your answers, how specific they are, recurring strengths, preferences you set, and goals you choose. Each interview report may add up to three notes, and you can add notes yourself. Notes only ever describe how you answer. They never describe personality, emotions, health, origin, or any other personal characteristic, and the AI provider is instructed accordingly.

• What they are used for: Notes are included in the AI requests that generate live answers, mock interviews, interview reports and question banks, so that these fit the way you answer and what you are working on. They are never used to rank you, shared with anyone, or used for advertising.
• Control: You can read, edit and delete every note in Settings, and turn coach notes off, which stops new notes from being kept or used. The app keeps at most twelve notes.
• Legal basis: Performance of the contract (providing the coaching Service). This processing is a form of profiling under the GDPR; it does not produce any decision with legal or similarly significant effects on you.

f) Automatic Updates

The VeilPrep desktop application checks for a new version when it starts and every few hours while it runs. The check is a request to our own update service at veilprep.com, and it carries only your IP address, the platform you are on and the version you have installed, which our server needs in order to answer. No account data, transcript or prep material is sent with it, and we do not use these requests to build a profile of you.

g) Calendar Links

A scheduled round offers calendar buttons. Google Calendar, Outlook and Microsoft 365 open that provider's own website in your browser with the round's title, time and notes filled in, so the details reach the provider only when you choose that button, and only under that provider's privacy policy. The calendar file option writes an .ics file on your own computer and opens it in your calendar application; nothing leaves your device. VeilPrep never contacts a calendar service on its own, and it does not read your calendar.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide core functionality: Deliver real-time transcription, speaker diarization, and AI-powered answer generation as part of the VeilPrep Service.
• Manage credits and billing: Process one-time credit purchases through Stripe, track your credit balance, and maintain transaction records.
• Enforce session limits: Deduct credits when interview sessions are started and enforce the per-session limit (60 minutes for a live round, 45 for a mock interview).
• Understand usage at the account level: Read the credit ledger and the cost records (see 1b), which record that a session happened, when, and what it cost. We run no analytics product, record no behavioural events (no page views, clicks or feature usage), and never analyze your content, transcripts or AI interactions for product improvement.
• Communicate with you: Send account-related notifications including purchase confirmations, payment receipts, credit balance alerts, and material changes to our policies.
• Ensure security: Detect and prevent fraudulent activity, abuse, or unauthorized access to the Service, using the service log and the spend-ceiling counters described in 1a and 1b.
• Personalize coaching: Use your coach notes (see 1e) to shape live answers, mock interviews, reports and question banks to the way you answer. You can turn this off at any time.

3. Third-Party Services

VeilPrep relies on the following third-party services to deliver its functionality. Each service receives only the minimum data necessary for its specific purpose:

We encourage you to review the privacy policies of these third-party services to understand how they process your data. We select partners that maintain strong data protection practices and do not use your data for purposes beyond the services they provide to us.

4. Data Retention

We retain different categories of data for different periods, always guided by the principle of data minimization:

• Audio data: NOT stored. Audio is streamed in real time and discarded immediately after processing. No recordings are created or retained.
• Transcripts: Stored in your account after each interview round, associated with your user ID. Because a transcript also contains the words of the other participants, it is kept for a limited time: 90 days after the round was created, the transcript text, including the answers the assistant offered and any coding analyses saved with it, is permanently deleted by an automated job. Your report, scores, notes and any STAR stories you extracted from it are kept for as long as you keep the round. Deleting a round or application removes everything, including the transcript, immediately.
• Account data: Retained for as long as your account remains active. Upon account deletion, your personal information (email, name, authentication records) will be permanently deleted within 30 days, except records we are legally required to keep (see transaction records below).
• Credit and transaction records: Your credit ledger lives in your account and is deleted with it. The underlying invoices and payment records are held by our payment processor, Stripe, and are retained there for 10 years as required by French accounting and commercial law (Code de commerce); that legal obligation overrides the right to erasure for those records, which contain your email address and the amounts paid, not your interview content.
• Service log: each entry is deleted 90 days after it was written, by an automated job; entries also cascade away with your account.
• Cost records: kept for as long as your account exists and deleted with it. Deleting a round detaches its cost records from that round but does not delete them.
• Spend-ceiling counters: deleted after seven days.
• AI interaction data: Prompts are NOT stored; they exist only during the request-response cycle. AI outputs saved to your account are kept as follows: suggested answers and coding analyses are deleted with the transcript 90 days after the round; reports, match analyses and question-bank cards are kept until you delete the round, application or card; coach notes are kept until you delete them (see 1e). Everything is deleted with your account.
• Coach notes: Stored in your account for as long as you keep them. Each note can be deleted individually in Settings, and all notes are permanently deleted with your account.

5. Data Security

We implement robust security measures to protect your data in transit and at rest:

• Encryption in transit: All API communication between VeilPrep and our third-party services uses TLS 1.2 or higher encryption. Audio streams are transmitted over secure WebSocket connections (WSS).
• Minimal attack surface: By design, VeilPrep never stores audio, and AI prompts are not retained on our servers. What you keep (transcripts, reports, preparation material, coach notes) lives in your account database under Row-Level Security, so only your authenticated session can read it.
• Database security: Our Supabase database employs Row-Level Security (RLS) policies, ensuring that users can only access their own account data. Database access requires authenticated API keys.
• Application security: We release regular security updates for the VeilPrep application and promptly address reported vulnerabilities. Our Electron application follows security best practices including context isolation and restricted permissions.
• Access controls: Internal access to production systems is restricted to authorized personnel, protected by multi-factor authentication and audit logging.

While no method of electronic transmission or storage is completely secure, we strive to use commercially reasonable measures to protect your personal information. If you discover a security vulnerability, please report it responsibly to security@veilprep.com.

6. Your Rights

a) GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: Request a copy of the personal data we hold about you.
• Right to erasure: Request deletion of your personal data ("right to be forgotten"). We will comply within 30 days, subject to legal retention obligations.
• Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to object: Object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Our legal bases for processing your data include: performance of a contract (providing the Service), legitimate interests (keeping the Service secure and preventing abuse, and knowing what the Service costs us to run), and consent (where applicable). For GDPR inquiries, you may contact us at privacy@veilprep.com.

Right to lodge a complaint. If you are in France or the EU/EEA, you may lodge a complaint with your national data-protection authority. In France this is the CNIL (Commission Nationale de l'Informatique et des Libertés), www.cnil.fr.

b) CCPA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to deletion: Request that we delete your personal information, subject to certain exceptions.
• Right to opt-out: Opt out of the sale of your personal information. We do NOT sell your personal data to any third party, and we have never done so.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights. You will not receive different pricing or quality of service.

Exercising Your Rights

You can delete your account and all associated data at any time directly in the app, under Settings → Account → Delete account. This permanently and immediately erases your account, transcripts, reports, and credit history (unused credits are forfeited). Individual transcripts can also be removed by deleting the associated round or application.

You can also download a copy of your data at any time under Settings → Account → Export your data. This writes one JSON file containing everything your account can read: profile, applications, rounds with their transcripts and reports, stories, question bank, coach notes, credit history, cost records and spend-ceiling counters. The service log (see 1b) is held separately and is not in the file; email us and we will add it to your copy.

To exercise any other right described above, or to request deletion by hand, please email us at privacy@veilprep.com with the subject line "Data Rights Request." We will verify your identity and respond to your request within 30 days. If we need additional time (up to 60 days total), we will notify you of the extension and the reason.

7. Cookies & Tracking

VeilPrep is a desktop application and does not use browser cookies in its primary functionality. Specifically:

• Desktop application: VeilPrep does not place cookies on your system. Your sign-in session is held in the application's own local storage on your device, in the same way a browser holds a login. It is not synchronised anywhere and is cleared when you sign out.
• Landing page (veilprep.com): Our website sets no cookies and runs no analytics, tracking scripts, advertising pixels or cross-site tracking. Fonts and flag icons are served from our own domain rather than a content delivery network, so loading a page, including these legal pages inside the app, sends your IP address to us and to nobody else.
• No behavioral tracking: We do not build behavioral profiles of our users, track browsing activity across websites, or use fingerprinting techniques.

8. Age Requirement and Minors

VeilPrep is designed for professional use by adults preparing for job interviews. The Service is reserved for users aged 18 or over. Every user must confirm this expressly when creating an account, and the confirmation is recorded; without it the Service does not function. We do not knowingly collect personal data from anyone under 18, and in particular from children below the age of digital consent in their country (15 in France, 13 to 16 elsewhere in the European Union, 13 in the United States under COPPA).

If we become aware that a minor has created an account, we will close the account and delete its data. If you believe a minor has provided us with personal data, please contact us at privacy@veilprep.com so we can promptly address the situation.

9. International Data Transfers

VeilPrep is operated from France. Our database and operational dashboards are hosted in the European Union. Several of our service providers (Deepgram, Anthropic, OpenAI, Vercel, Google, Stripe and GitHub) are established in the United States or process data there. As a result, some of your data is transferred to and processed in the United States, regardless of your location.

For users in the European Union or European Economic Area, these transfers are conducted under appropriate safeguards, including:

• EU-US Data Privacy Framework: Where a provider is certified under the Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023 for transfers to it.
• Standard Contractual Clauses (SCCs): Otherwise, we rely on the European Commission's Standard Contractual Clauses included in each provider's data processing agreement.
• Adequacy decisions: Where applicable, we rely on adequacy decisions issued by the European Commission.
• Supplementary measures: We implement additional technical and organizational safeguards (such as encryption) to ensure your data receives an adequate level of protection.

By using VeilPrep, you acknowledge that your data may be processed in jurisdictions with different data protection laws than your country of residence.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:

• Material changes: We will notify you via the email address associated with your account at least 14 days before the changes take effect. Material changes include new categories of data collection, new third-party data sharing, or changes to your rights.
• "Last Updated" date: The date at the top of this policy will be revised to reflect the most recent modification.
• Continued use: Your continued use of VeilPrep after being notified of changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you may discontinue use of the Service and request account deletion.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us:

• Privacy inquiries & data rights: privacy@veilprep.com
• General support: support@veilprep.com
• Security vulnerabilities: security@veilprep.com

We aim to respond to all inquiries within 5 business days. For formal data rights requests under GDPR or CCPA, we will respond within 30 calendar days as required by law.