Privacy Policy

This Privacy Policy explains how personal data is handled when you use Interview4You — the marketing site at interview4you.com, the product at app.interview4you.com, and the voice interview that runs in a candidate's browser. Please read it together with our Terms.

1. Two different relationships

Interview4You is used by two kinds of people, and our role under data protection law is different for each.

• Recruiter account holders (the “Customer”). If you sign up, create interviews and are billed, we are the data controller of your account and billing data and this policy applies to you directly.
• Candidates. When a Customer invites you to an interview, that organisation chooses the questions, decides to run the interview and decides what happens with the result. For that interview data the Customer is the data controller and Interview4You is a data processor acting on the Customer's documented instructions. This policy tells you what we do with your data on the Customer's behalf; section 11 explains how to exercise your rights.

2. Who we are

Interview4You is operated by [LEGAL ENTITY NAME incl. Rechtsform], [REGISTERED ADDRESS — Straße Nr., PLZ Ort], Germany (“Interview4You”, “we”, “us”). It is the controller within the meaning of Art. 4(7) GDPR for the processing described in section 1 for which we are the controller. Full company details are in our Impressum.

For any privacy question, contact privacy@interview4you.com. Our data protection officer (Datenschutzbeauftragter) is [DATENSCHUTZBEAUFTRAGTER — Name, Anschrift, E-Mail].

3. Information we collect

3.1 From recruiter account holders

• Identity and contact: your name, work email address, employer or team name, and job title if you provide it.
• Credentials: a salted hash of your password and the session tokens that keep you signed in. We never store your password in readable form.
• Billing: your plan, subscription status, billing email, and payment metadata returned by Stripe. Card details are entered directly with Stripe and never reach our servers.
• Content you create: interviews, questions, expected answers, evaluation criteria, and the settings you choose for each interview (including whether recording is on and the retention period).
• Product logs: actions you take, timestamps, IP address and browser type, kept for security and troubleshooting.

3.2 From candidates

When a Customer invites you and you take part in an interview, we process the following on that Customer's behalf:

• The name you enter on the start screen.
• Microphone audio for the length of the interview, streamed in real time so the AI interviewer can hear and respond to you.
• A transcript of the conversation — each line tagged with the speaker, a timestamp, and the question it relates to.
• An audio recording of the interview, only if the Customer has enabled recording for that interview. If it is being recorded, you are told on the start screen before you choose to begin.
• Evaluation outputs about your answers: scores, notes on concepts covered or missed, follow-up decisions and a summary report. Some evaluation features are still in development and may not be active for every interview.
• Technical session data needed to run and secure the interview: your IP address, browser and device type, the result of the microphone test, connection-quality and timing events, and the one-time invitation token.

The interview questions, expected answers and evaluation criteria stay on our server. They are never sent to the candidate's browser.

3.3 From website visitors

The marketing site is a static site served from a different origin to the product. It sets no advertising or cross-site tracking cookies. Standard server logs (IP address, user agent, timestamp) may be kept for a short period for security and diagnostics.

4. Cookies and similar technologies

• Product app: a strictly necessary session token that keeps you signed in.
• No advertising, profiling or cross-site tracking on either the marketing site or the product.
• If we add analytics in future, this policy will be updated and, where the law requires it, your consent will be requested first.

5. How we use information, and our legal bases

We process personal data under the GDPR, supplemented by the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). We rely on the following bases:

• Providing recruiter accounts and running the product — performance of our contract with the Customer (Art. 6(1)(b) GDPR).
• Conducting an interview and producing the transcript and evaluation — carried out on the Customer's instructions as its processor (Art. 28 GDPR). The Customer's own basis as controller is typically the assessment of applicants for an employment relationship (§ 26(1) BDSG), steps taken at the applicant's request prior to a contract (Art. 6(1)(b) GDPR), or its legitimate interest in filling a role (Art. 6(1)(f) GDPR).
• Recording interview audio — only where the Customer switches it on. The candidate is notified beforehand, and the Customer is responsible for obtaining consent where its jurisdiction requires it.
• Billing for paid plans — performance of a contract; retaining invoices and tax records — legal obligation (Art. 6(1)(c)).
• Securing the service, preventing abuse and debugging — our legitimate interests (Art. 6(1)(f)).
• Responding to lawful requests from authorities — legal obligation.

6. Voice, recordings and AI processing

Running a spoken interview requires third-party AI services. You should understand exactly what leaves our servers:

• During the interview, the candidate's microphone audio is streamed in real time to OpenAI, which powers the voice interviewer and converts speech to text.
• After the interview, transcripts and answers may be sent to OpenAI's models to evaluate the answers and generate a report, on the Customer's behalf.
• OpenAI acts as our subprocessor under its API terms and data processing addendum. Data sent through the OpenAI API is not used to train OpenAI's models.
• We do not use candidate audio, transcripts or evaluations to train our own models.
• Recording is off by default and is controlled per interview by the Customer. When it is on, the candidate sees a notice on the start screen before choosing to begin.

7. Automated evaluation and human decisions

The interviewer and the evaluator are AI systems. They generate a score, notes and a recommendation. This is decision support, not a decision.

• Any screening or hiring decision is made by the Customer's own staff, who review the full transcript alongside any scores. Interview4You does not make decisions about candidates, and our Terms require the Customer to have a person review the output rather than rely on it alone.
• If you are a candidate and want to contest an evaluation, request human review or put your side of things, contact the organisation that invited you — it is the controller. We will support it in responding.
• AI output is probabilistic and can be inaccurate or incomplete.

8. Who we share information with

Subprocessors. We use the following providers to process personal data on our behalf:

Provider	Purpose	Data involved	Location
OpenAI, L.L.C.	Real-time voice interviewer, speech-to-text transcription, and AI evaluation of answers	Interview audio, transcripts, questions and evaluation criteria, candidate answers	United States
Railway Corp.	Cloud hosting, application compute, managed PostgreSQL database and Redis	All application data at rest and in transit within the platform	United States
Stripe, Inc.	Subscription billing and payment processing for recruiter accounts	Billing contact, subscription and payment metadata (card data is handled by Stripe directly)	United States
[EMAIL DELIVERY PROVIDER — if configured]	Transactional email such as interview invitations and account notifications	Recipient email address, name, interview link	[PROVIDER REGION]

We also share information with:

• The Customer that invited the candidate. The Customer receives the transcript, the recording where enabled, and the evaluation — this is the purpose of the interview.
• Professional advisers and auditors under confidentiality, where necessary.
• Authorities where we are legally required to, after reviewing the request.
• A successor entity in connection with a merger, acquisition or asset sale, under terms consistent with this policy.

We do not sell personal data.

9. International transfers

Our subprocessors are located in the United States. For each transfer we rely on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, together with additional technical and organisational safeguards, and — where the provider is certified — the EU–US Data Privacy Framework under the Commission's adequacy decision of 10 July 2023.

10. How long we keep data

• Interview audio recordings: deleted automatically after the retention period set by the Customer for that interview — 30 days by default. A portion of low-level real-time audio may be retained briefly for reliability tuning and is deleted on the same schedule or sooner.
• Transcripts and evaluation results: kept while the Customer's account is open, or until the Customer deletes the interview or its data. After account closure they are deleted or anonymised within 30 days.
• Recruiter account data: kept for the life of the account and deleted within 30 days of closure, unless we must keep it longer.
• Billing and tax records: kept for the period required by applicable law (commonly six to ten years).
• Security and product logs: typically 12 months.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you, and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw any consent you have given, without affecting prior processing;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

If you are a candidate: the organisation that invited you is the controller of your interview data. Please send your request to that organisation first. If you contact us, we will forward your request to the relevant Customer and assist it in responding. We cannot, for example, delete an interview result on our own initiative against the Customer's instructions, except where the law requires it.

If you are a recruiter account holder: contact privacy@interview4you.com. Most account data can also be edited directly in the product.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence or place of work. The authority competent for us is the [LANDESDATENSCHUTZBEHÖRDE des Sitz-Bundeslands]. We aim to respond to requests within one month, extendable by up to two further months for complex requests (Art. 12(3) GDPR).

12. Security

We protect personal data with measures that include:

• encryption of data in transit (TLS);
• keeping the OpenAI API key on our backend only — candidates receive short-lived credentials scoped to their own session;
• single-use, time-limited invitation links that expire on first use;
• server-side interview timers that end a session even if the candidate's tab stays open;
• limiting access to production data to staff who need it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Minors

The service is for professional recruitment and is not directed to children. We do not knowingly process the personal data of anyone under 16, the age of digital consent under Art. 8 GDPR as it applies in Germany. If you believe a minor has used an interview link, contact us and we will delete the data.

14. Changes to this policy

We will post any changes on this page and update the date above. We will notify recruiter account holders of material changes by email or in the product. For candidates, the version of this policy in force at the time of your interview applies to that interview.

15. Contact

---

This document is a draft prepared for Interview4You and is not legal advice. Highlighted values are placeholders that must be completed, and the whole policy should be reviewed by a German lawyer (Fachanwalt für IT-Recht) before launch.