Privacy policy

• ·Account information from your sign-in provider: email address, name, profile photo, and an internal account id.
• ·Interview material you provide: job postings, links, resumes, answers, notes, plans, scores, feedback, and application documents.
• ·Account and service information: study preferences, time zone, target role, usage counters, subscription status, and billing identifiers.
• ·A device digest, sent only when you claim the free plan: a one-way hash of your browser and hardware shape (screen size, locale, time zone, graphics renderer and similar). It identifies the device rather than you, and it is used so that one browser cannot claim the free plan twice — which is a check on a value your own browser supplies, not a secure identification of you. If a claim was made in error, support can clear it.
• ·Files you choose to upload, including avatars and saved documents.
• ·Support and privacy requests you send to us.

• ·To create and secure your account and authenticate you through your chosen sign-in provider.
• ·To generate the interview analysis, practice plans, notes, documents, scores, and feedback you request.
• ·To save your work, enforce account ownership, measure usage, provide support, and prevent abuse.
• ·To process subscriptions, payments, refunds, and invoices through Stripe.
• ·To investigate failures, maintain the service, and protect users and the service from security threats.

We share only what an operation needs, and only with these categories of provider. We do not sell or rent your information, and we do not share it for advertising.

• ·Cloud hosting, database and file storage providers that run the service and hold your account data. The database is in the United States (Google Cloud's us-central1 region).
• ·AI model providers that generate the analysis, plans, notes, documents and feedback you ask for. The material a step works from - the posting text, your resume, your interview answers - is sent to the provider that answers that step. One of those providers is TypeSafe, whose Jev service produces a typed second opinion on a grading decision; it receives the same grading material and is used only to compare that opinion with the grading the product already produced.
• ·When tracing is enabled for a deployment, that same material may also be sent to an observability provider, under the same terms. It is used to inspect what a step was sent and how it answered, and for nothing else.
• ·Speech providers, when you dictate an answer or play a question aloud: they receive the audio, or the text being read.
• ·Search providers, for company research: they receive the company name, the role title and the technologies named in the posting.
• ·Our payment processor, which takes payment and holds the card details, invoices and subscription record. We hold its customer and subscription identifiers, never a card number.
• ·Email and infrastructure providers we use to answer support mail and keep the service running.

Some of this happens outside Canada. The service runs in the United States, and at least one AI provider we use processes and stores data in the People's Republic of China. Where information is processed outside your country, the laws of that country apply to it, and it may be accessible to its authorities.

The free path is the least private one, and worth reading twice. When a step runs on a free-tier model, that provider logs the submitted content for security and may use it to improve its services. The paid path uses providers that do not train on your content by default, but the default paid provider may still retain inputs for as long as an account exists. That is why the same advice appears in the terms: do not submit confidential, privileged or regulated material to either path.

Rehearsea stores account data in Google Cloud Firebase services in the United States, in the us-central1 region. Your data remains in your account until you delete it or ask us to delete it, subject to records a payment provider must retain for its own legal and accounting obligations.

Deleting your account removes its Rehearsea documents, files, and sign-in record. The payment provider may retain its own invoices and subscription records.

• ·Access or correct information in your account and request information about what we hold.
• ·Delete your account and the Rehearsea data associated with it from the account screen.
• ·Ask questions or make a privacy request by contacting the address below.

The person responsible for personal information is Ali Rezaei. Contact[email protected] with any question or request, including a request for the information we hold about you. We answer within 30 days.

If we cannot resolve a concern, you may complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner (priv.gc.ca); in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca); in the EU or UK, your national authority. Complaining to us first usually gets it fixed faster, but it is not a condition of complaining to them.

What we hold is protected by encryption in transit, access rules that keep every account document to its owner, least-privilege access to production systems, and agreements with the providers that process data for us. Backups exist, and access to production is limited to the person who runs the service.

No internet service can promise absolute security, and this one is run by one person. What we can promise is that a breach creating a real risk of significant harm is reported to you and to the relevant regulator, as PIPEDA and Quebec's Law 25 require. The terms describe the same commitment and what we ask of you.

We update this policy when the service or its data practices change, and the effective date at the top shows which version is current. A change that materially affects what happens to your information is announced in the product before it takes effect.