Try for free

Privacy Policy

Effective Date: October 28, 2026

At InterviewStep, we take your privacy seriously. This Privacy Policy explains how InterviewStep ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our AI interview copilot.

1. Company Information

This service is operated by:
InterviewStep
c/o M. Brenner
Weinbergstrasse 45
8006 Zurich
Switzerland
Email: help@interviewstep.io

2. Information We Collect

2.1 Information You Provide to Us

We collect information that you voluntarily provide when using InterviewStep:

  • Account Information: Name, email address, password (encrypted), and authentication data through Firebase Authentication
  • Resume and CV Content: Employment history, education, skills, work experience, achievements, and other professional information
  • Interview Details: Roles, companies, job descriptions and job links you add for an interview
  • Interview Audio: During a call, the audio you share is transcribed live so Ally can follow the conversation. We do not record or store the audio; we keep the transcript so you can review the interview
  • Prepared Answers and Stories: Questions, answers and stories you write, speak or let Ally draft
  • Communication Data: Messages, feedback, and correspondence with our support team

2.2 Automatically Collected Information

When you use InterviewStep, we automatically collect certain information:

  • Technical Data: IP address, browser type, device type and operating system, as needed to deliver the service
  • Usage Data: How you use InterviewStep: the pages you visit, the buttons you click, the sign-up steps you complete and the answers you choose there, the interviews you start and the purchases you make. We collect this with PostHog (see Section 4.4)
  • Cookies and Similar Technologies: Session cookies and authentication tokens, analytics cookies and local storage from PostHog, and advertising cookies from Google Ads (see Section 9)
  • Log Data: Server logs, API requests and system events

2.3 Information from Third Parties

  • OAuth Providers: If you sign in with Google, we receive your name, email address and profile information
  • Job Postings: When you add a job link, we read the public job posting to prepare your interview

3. How We Use Your Information

We use your information for the following purposes:

3.1 Core Service Delivery

  • Live Interview Help: Transcribe your interview in real time and show suggested answers based on your CV, stories and prepared answers
  • Preparation: Draft answers, stories and summaries from your CV and job descriptions using OpenAI models
  • Mock Interviews: Ask you practice questions and show you strong answers
  • Interview Records: Store your interviews, transcripts and summaries so you can review them

3.2 Account Management and Authentication

  • Create and manage your account via Firebase Authentication
  • Verify your identity and prevent unauthorized access

3.3 Product Improvement and Analytics

  • Understand how people use InterviewStep, for example where they stop during sign-up and which features they use, with product analytics from PostHog
  • Measure how our ads perform and show our ads to people who visited InterviewStep, with Google Ads
  • Fix problems and improve features using server logs and the feedback you send us
  • Generate aggregate statistics (never sold to third parties)

3.4 Communication

  • Send transactional emails (account verification, password resets)
  • Provide customer support and respond to inquiries
  • Send product updates and important service announcements (with opt-out option)

3.5 Legal and Security

  • Comply with legal obligations and regulatory requirements
  • Detect and prevent fraud, abuse, and security threats
  • Enforce our Terms of Service and protect user rights
  • Maintain audit logs for security and compliance purposes

4. Third-Party Services and Data Sharing

We work with trusted third-party service providers to deliver InterviewStep. Your data may be shared with:

4.1 AI and Content Processing

  • OpenAI: Processes your CV, job descriptions, interview transcripts and questions to suggest answers, stories and summaries. Data sent to OpenAI is not used to train their models. OpenAI is based in the US. OpenAI Privacy Policy
  • Speechmatics: Transcribes the audio of your interview in real time. Speechmatics is based in the United Kingdom. Speechmatics Privacy Policy

4.2 Infrastructure and Storage

  • Cloudflare R2: Stores your uploaded documents (such as your CV) with encryption at rest. Cloudflare operates globally with data centers in Europe. Cloudflare Privacy Policy
  • Railway: Hosts our servers and the PostgreSQL database that stores your account, interviews, questions and transcripts. Railway Privacy Policy

4.3 Authentication

  • Firebase Authentication: Manages sign-in, including Google sign-in. A Google service with global infrastructure. Firebase Privacy Policy

4.4 Product Analytics

  • PostHog: Product analytics. Receives your usage data (pages, clicks, the sign-up steps you complete and the answers you choose there, interviews you start, purchases), your browser and device information, your IP address and your account ID, and, once you have given them to us, your name and email address. PostHog may also record how you move through our app (session replay) to help us find usability problems; text you type into form fields is masked. PostHog is based in the US. PostHog Privacy Policy
  • Google Ads: Advertising. When you visit InterviewStep, Google's tag (gtag.js) receives the pages you visit, your browser and device information, your IP address and cookie identifiers, to measure whether a visit came from one of our ads and to show our ads to people who visited our website. Google is based in the US. Google Privacy Policy

4.5 Legal Disclosure

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

5. Data Storage and Security

5.1 Where We Store Your Data

  • Primary Data Storage: PostgreSQL database hosted via Railway
  • File Storage: Cloudflare R2, including EU regions
  • Encryption: All data is transmitted over HTTPS (TLS). Files are stored with encryption at rest
  • Authentication: Firebase tokens for secure session management

5.2 Security Measures

  • Industry-standard encryption for data in transit and at rest
  • Regular security audits and vulnerability assessments
  • Access controls and role-based permissions

While we implement robust security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

6. International Data Transfers

InterviewStep is operated from Switzerland, and your data is primarily stored in EU regions. However, some of our third-party service providers are based in the United States and other countries outside the European Economic Area (EEA).

When we transfer your data internationally, we ensure appropriate safeguards are in place:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Service providers certified under relevant data protection frameworks
  • Encryption and pseudonymization of data before transfer
  • Contractual commitments requiring equivalent protection levels

Services outside Switzerland and the EU that we use include OpenAI, Google (Firebase and Google Ads) and PostHog (US) and Speechmatics (United Kingdom). We have evaluated these providers' security practices and data protection measures.

7. Your Privacy Rights

Depending on your location, you have various rights regarding your personal data:

7.1 GDPR Rights (European Economic Area)

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate or incomplete data
  • Right to Erasure: Request deletion of your data ("right to be forgotten")
  • Right to Restrict Processing: Limit how we use your data
  • Right to Data Portability: Export your data in a machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent for data processing at any time
  • Right to Lodge a Complaint: File a complaint with your local data protection authority

7.2 CCPA Rights (California Residents)

  • Right to know what personal information is collected
  • Right to know if personal information is sold or disclosed
  • Right to opt-out of the sale of personal information (Note: We do not sell personal information)
  • Right to request deletion of personal information
  • Right to non-discrimination for exercising CCPA rights

7.3 Swiss Data Protection Rights

As a Swiss company, we comply with Swiss Federal Data Protection Act (FADP), which provides rights similar to GDPR.

7.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at help@interviewstep.io. We will respond within 30 days. You may also manage some settings directly in your account dashboard.

8. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

  • Active Accounts: Data retained while your account is active
  • Deleted Accounts: Most data deleted within 30 days of account deletion. Some data retained in backups for up to 90 days for security and legal compliance
  • Analytics Data: Usage data collected with PostHog is retained for up to 2 years
  • Advertising Data: Google Ads cookies expire after up to 90 days; Google keeps ad measurement data according to its own retention policy
  • Payment Records: Retained for 7 years to comply with tax and accounting regulations
  • Legal Hold: Data may be retained longer if required by law or for legal proceedings

You can request deletion of your data at any time by contacting help@interviewstep.io or deleting your account in the dashboard.

9. Cookies and Tracking Technologies

We use cookies and similar technologies (such as your browser's local storage) to provide and improve our services:

9.1 Essential Cookies

  • Authentication cookies (Firebase session tokens)
  • Security cookies (CSRF protection)
  • Load balancing cookies

9.2 Analytics Cookies

We use PostHog to understand how InterviewStep is used. PostHog stores a random identifier in a cookie and in your browser's local storage (names starting with "ph_") to recognize your browser across visits and to link your usage to your account. These cookies are not used for advertising and are not shared with advertisers. You can block or delete them in your browser settings; InterviewStep keeps working without them.

9.3 Advertising Cookies

We use Google Ads to measure how our ads perform and to show our ads to people who visited InterviewStep. Google's tag sets cookies (such as "_gcl_au") and may use Google's own cookies to recognize your browser. You can turn off personalized ads in Google's ad settings and block or delete these cookies in your browser settings; InterviewStep keeps working without them.

10. AI and Automated Decision-Making

We use AI (OpenAI GPT models) to suggest answers, draft stories and summarize your interviews. Important notes:

  • No Automated Decisions: We do not make automated decisions that significantly affect you without human oversight
  • AI as a Tool: AI suggestions are recommendations only. You review and control all final content
  • Training Data: Your data is not used to train OpenAI's models per our agreement
  • Human Review: You can always edit or reject AI-generated content

11. Children's Privacy

InterviewStep is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe we have collected information from a child, please contact us at help@interviewstep.io.

12. Do Not Track Signals

Some browsers support "Do Not Track" (DNT) signals. We currently do not respond to DNT signals as there is no industry standard for how to interpret them. We may revisit this as standards evolve.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

  • Update the "Effective Date" at the top of this policy
  • Notify you via email (if you have an account)
  • Display a prominent notice in the application
  • Provide a summary of significant changes

Your continued use of InterviewStep after changes indicates acceptance of the updated policy. If you do not agree with changes, you may delete your account.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: help@interviewstep.io
Mail:
InterviewStep
Data Protection Officer
c/o M. Brenner
Weinbergstrasse 45
8006 Zurich
Switzerland

Data Protection Authority:
If you are in the EU/EEA and believe we have not addressed your concerns, you may lodge a complaint with your local supervisory authority or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

15. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your data based on the following legal grounds:

  • Contract Performance: Processing necessary to provide InterviewStep services you requested
  • Consent: Where you have given explicit consent (e.g., marketing communications, analytics)
  • Legitimate Interests: For fraud prevention, security, and product improvement where not overridden by your rights
  • Legal Obligation: To comply with laws, regulations, and legal processes

16. California Privacy Rights (CCPA Details)

Categories of Personal Information Collected

  • Identifiers (name, email, IP address)
  • Professional information (CV content, work history)
  • Internet activity (usage data)
  • Audio information (interview audio, transcribed live and not stored)

Business Purposes for Collection

  • Providing career optimization services
  • Product improvement and analytics
  • Security and fraud prevention
  • Customer support

Sale of Personal Information

We do not sell your personal information to third parties. We share data with service providers only as necessary to deliver our services.

Last updated: October 28, 2026