← Back

Privacy Policy

Last updated: 17 September 2026

Data controller

PassPrep is the data controller for PassPrep.io. Contact: hello@passprep.io. Postal address available on request — email us and we will provide the current registered address.

1. What we collect

  • Account data: email and authentication identifiers.
  • Content you upload: CVs, job descriptions, interview answers.
  • Usage data: matches and interview sessions, scores, timestamps.
  • Billing data: handled by Stripe — we store only customer IDs and subscription state, never card numbers.

2. How we use it & legal basis

  • Run CV matching and interview scoring — legal basis: performance of our contract with you (Art. 6(1)(b) UK/EU GDPR).
  • Manage your subscription and billing — contract and legal obligation (tax records).
  • Prevent abuse, secure the service, debug — our legitimate interests.
  • Product improvement — legitimate interests, using aggregated/anonymised data.
  • Marketing emails — only with your consent at signup; you can withdraw at any time.

We do not sell your data and we do not use your content to train third-party AI models.

3. AI processing & automated decisions

PassPrep uses AI models to extract text from your CV, score your CV against a job description, generate interview questions, and score your interview answers. Your CV text, job description text and interview answers are sent to our AI providers (Lovable AI Gateway, which routes to Google Gemini and OpenAI; ElevenLabs for voice transcription and speech).

Scores and feedback are generated automatically. Under Art. 22 UK/EU GDPR you have the right to request human review of any AI-generated score that you believe is inaccurate or unfair — email hello@passprep.io.

AI outputs are guidance only and may contain mistakes. They are not a guarantee of interview outcomes or employment.

4. Processors & international transfers

  • Supabase (database, auth, file storage) — EU/US hosting.
  • Stripe (payments) — global, US-headquartered.
  • Lovable (hosting & AI Gateway) — EU/US.
  • Google (Gemini models via AI Gateway) — US.
  • OpenAI (models via AI Gateway, where used) — US.
  • ElevenLabs (voice transcription and TTS) — US.

Where data is transferred outside the UK / EEA, we rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses as the transfer safeguard, and each provider acts as a data processor under a Data Processing Agreement.

5. Retention

  • Account & profile: until you delete your account.
  • CVs and uploaded files: until you delete them in-app, or immediately on account deletion.
  • Interview voice recordings: automatically deleted 7 days after the interview (the listen-back window), or sooner if you delete the session. Recordings are used only to transcribe and score that interview; we do not use voice data to identify you.
  • Interview transcripts, scores and feedback: up to 1 year, or until you delete them.
  • Match sessions: up to 1 year, or until you delete them.
  • Server logs (errors, security): up to 90 days.
  • Billing records (Stripe invoices): retained for 7 years to meet UK/EU tax law.

You can delete your account at any time from Settings → Account. This permanently removes your profile, CVs, uploaded files, recordings, match sessions, interview sessions and usage history, and removes the personal linkage from any referral records.

6. Your rights

Under UK / EU GDPR you have the right to:

  • Access your data — use "Export My Data" in Settings.
  • Rectify inaccurate data — edit your name in Settings or email us.
  • Erase your data — use "Delete Account" in Settings.
  • Portability — the export is provided as machine-readable JSON.
  • Object to processing based on legitimate interests.
  • Restrict processing while a query is investigated.
  • Withdraw consent (e.g. marketing emails) at any time.
  • Human review of automated AI scoring decisions.
  • Lodge a complaint with your local supervisory authority — in the UK, the ICO.

Email hello@passprep.io for any data request. We will respond within one month.

7. Security

Data is encrypted in transit (HTTPS) and at rest. CV file storage is private and protected by row-level security so only you can access your files. Access to production systems is restricted. If we become aware of a personal data breach affecting you we will notify the relevant supervisory authority within 72 hours and you without undue delay where required.

8. Cookies & local storage

We use strictly necessary cookies and browser local storage to keep you signed in and remember basic preferences. These cannot be switched off because the service will not work without them.

We do not currently run any advertising, analytics or tracking cookies. Our cookie banner also lets you allow or refuse optional analytics and marketing cookies in advance — if we ever add them, they will load only where you have given that permission. You can change your choice at any time using the "Cookie preferences" link in the footer, and your choice and its date are stored in your browser.

9. Referrals and recruiter links

We record the referral link used, its owner, the purchased plan, conversion status, discount and related payment reference so we can apply the offer, prevent duplicate use, verify genuine paid conversions and administer rewards. One referral relationship is permitted per customer account.

When you use a recruiter link, we ask you to acknowledge a specific notice before checkout. The recruiter may then see only your display name, chosen plan, referral status, conversion date, and aggregate totals of matches and interviews completed. This information is shown to the recruiter for 90 days from the date you convert to a paid plan, after which your details drop from their view while an anonymised record is kept for audit and anti-abuse purposes. Recruiters cannot see your email address, CV, job descriptions or titles, employers, agencies, scores, reports, interview questions or answers, transcripts, recordings, or individual session history.

A friend who refers you sees only anonymous conversion and reward status. They do not see your name, email, plan, or product activity. We process referral attribution to fulfil the discount and our agreement with the link owner, prevent fraud, and administer the programme. Referral and reward records are retained for up to seven years where needed for financial, fraud-prevention and legal records. Your access, objection, restriction and deletion rights described below also apply to referral data.

10. Children

PassPrep is not intended for users under 16. Do not create an account if you are under 16.

11. Changes to this policy

We will notify you in-app or by email of material changes. Continued use after a change means you accept the updated policy.

12. Contact

Email hello@passprep.io for any privacy question or data request.