Last updated: 3 September 2026
InterviewRoomAI processes voice in real time to generate interview simulations. We use the OpenAI Realtime API. Voice audio is streamed for inference and is not permanently stored in our own databases.
We may process text transcripts, answers, session timing, selected interview settings, usage metrics, and AI-generated reports to run interview sessions, provide your history and feedback, calculate credits, and improve the reliability and safety of the service. Do not include confidential information or personal data that you are not authorised to provide.
We use Supabase for account and service records, including name, email, authentication identifiers, profile settings, subscription status, credit balances, linked account metadata, consent records, and account deletion status. Referral relationships and reward eligibility are also calculated in our database.
When you use Interview DNA, Recruiter Mirror, Objection Lab, interview history, or reports, we store the relevant session-derived text, scores, generated insights, and timestamps needed to show the feature in your account. When you save a CV, we store its file and related metadata or extracted text in protected storage so it can be used in your interview setup until you delete it or your account is deleted.
All card payments are handled by Stripe Checkout. We do not store full card numbers or card security details on our systems.
Before creating a subscription or top-up checkout, users must confirm a refund-policy checkbox. We store the confirmation status and timestamp in checkout metadata for audit and dispute handling.
We process payment references, plan information, refunds, billing status, and payment-related timestamps supplied by Stripe to provide paid services, reconcile payments, process refunds, and prevent fraud. Stripe processes personal data under its own privacy policy.
To apply refund rules consistently, we process usage data and consumed credits. Basic plans and credit boosts use a consumed-credit percentage scale (up to 3% = 100%, up to 10% = 90%, up to 20% = 75%, up to 30% = 60%, up to 40% = 50%, up to 50% = 40%). Pro and Intensive plans use fixed minute bands (0-3, 4-10, 11-20, 21-40, 41-60, above 60 minutes).
We also retain limited refund-request and payment-audit information to apply rules consistently, resolve disputes, detect duplicate or abusive claims, and meet legal obligations.
Where UK GDPR applies, we process data to perform our contract with you, comply with legal obligations, pursue legitimate interests such as keeping the service secure and preventing fraud, and where required, with your consent. You can request access, correction, export, restriction, deletion, or object to certain processing, subject to applicable exceptions and verification of your identity.
We use strictly necessary cookies for sign-in, security, and session continuity. Optional analytics or marketing cookies are enabled only after consent in the cookie banner. Consent choices are logged.
We use authentication controls, access restrictions, session controls, security logging, rate limits, payment-webhook verification, usage checks, and account or refund reviews to help protect the platform, payments, and users. These controls may process technical information such as account identifiers, request metadata, timestamps, usage patterns, and relevant payment or refund references.
We do not disable essential security, fraud-prevention, authentication, billing-verification, or legal-retention controls at an individual request where they are necessary to protect the service or comply with law.
We keep account data while your profile is active. Interview history and saved CV data remain available until deleted by you or erased through account deletion, subject to the limits described below. You can request a machine-readable export of your personal data and initiate account deletion from your profile dashboard; these requests are authenticated and logged for compliance.
Account deletion includes a 30-day reactivation period. After deletion is finalised, we delete or anonymise applicable account data within our operational processes. We may retain limited billing, tax, payment-dispute, consent, security, and fraud-prevention records for as long as required or reasonably necessary for those purposes.
When data is transferred outside the UK/EU through trusted providers, we rely on safeguards such as Standard Contractual Clauses (or equivalent mechanisms) and review subprocessors periodically.
We may update this policy as the service or applicable law changes. The current version and update date are shown on this page. For privacy questions or to exercise your rights, use the Contact page.