Effective September 1, 2026. This Policy explains what personal information InterviewOS collects across our website, apps, and API, why we use it, who receives it, how long we keep it, and the choices and rights available to you. Sections 2, 3, and 8 of this Policy serve as the notice at collection for jurisdictions that require one.
1. Scope and key choices
This Policy applies to individual users who use InterviewOS. It does not apply to third-party sites we link to, such as OAuth sign-in providers or an employer's own systems.
InterviewOS is an individual resume and interview-practice tool. It is not a job marketplace: we do not automatically apply to jobs on your behalf, disclose your profile to employers you have not connected with, or sell resume content.
If you publish a career-site page (Section 5), only the fields you choose become public; your email and phone number are never shown on that page regardless of theme or plan.
2. Personal information we collect
Identifiers and account information
Name, email, password (stored only as an Argon2id hash, never in plain text), OAuth provider identifiers (Google, GitHub, or X), profile photo, session and device identifiers, and two-factor authentication status. Collected from you and, where you choose social sign-in, from that provider.
Career, resume, and interview content
Resumes and their versions, career-profile data (work history, education, skills, projects, certifications, links), imported resume files, job descriptions you add, AI-generated tailoring suggestions and ATS analysis, interview questions and your submitted answers, evaluation scores, feedback, and consolidated reports.
Career-site publishing data
If you publish a career site, we store your chosen handle (slug), selected theme, branding preference, publish status, and any certificate documents you upload. See Section 5.
Optional voice-recorded answers
If you record an interview answer instead of typing, the audio clip is sent once to our configured AI provider to produce a text transcript, subject to that provider's own data-handling terms (see Section 4). InterviewOS itself never stores the audio — only the resulting reviewed text transcript and basic duration, word-count, and filler-word metrics are saved to your account.
Billing information
Plan, subscription status, invoices, and payment status from Razorpay. InterviewOS does not receive or store full card, UPI, or bank account numbers; Razorpay handles payment instruments directly.
Usage, device, and security records
IP address, browser and device information, authentication events, rate-limiting and abuse-prevention signals, structured request logs (method, path, timing, and a sanitized principal — never tokens, cookies, passwords, or email addresses), and support communications.
Sensitive information
Credentials and, where you choose to include them in a resume, career profile, or interview answer, information you voluntarily disclose such as demographic details. We do not solicit this information and do not use it for scoring, ranking, or advertising. Section 6 limits its use further.
3. Why we use personal information
We use personal information to: create and operate your account and sessions; generate, store, and let you export or tailor resumes; run interview sessions, score answers, and produce reports; publish and serve your career site if you choose to publish one; authenticate users and enforce two-factor authentication; detect and prevent fraud, abuse, and security incidents; process subscription billing through Razorpay; send account, security, and transactional emails through Resend; respond to support requests; and comply with legal obligations. We keep records of the consent and deletion choices you make.
4. AI-assisted features
InterviewOS uses a configured AI provider (OpenAI, Azure OpenAI, Anthropic, Google Gemini, or AWS Bedrock, depending on deployment configuration) to generate resume tailoring suggestions, ATS and skills analysis, interview questions, answer evaluation, and feedback. Relevant resume, job, or interview content is sent to that provider only when required to produce the output you requested.
AI outputs are probabilistic suggestions, not verified facts. You remain responsible for reviewing and editing AI-assisted content before relying on it. Evidence-preserving writing actions do not invent skills, employers, metrics, or credentials that you have not already provided. InterviewOS does not use facial recognition, voiceprints, or other biometric identifiers. When you choose to record an interview answer, the audio is sent to the configured AI provider only to produce a text transcript and is not analyzed for identity, emotion, or biometric traits.
5. Public career sites
You may optionally publish a career profile summary as a public page at a URL you choose. Publishing is opt-in and off by default; you control the handle, theme, and whether it is published at all, and you can unpublish it at any time from Settings.
The public page never displays your email address or phone number, regardless of theme, plan, or branding settings — visitors instead see a generic contact option. If you upload certificate documents, visitors can preview them inline once your career site is published; there is no direct download link, though a visitor could still capture what is shown on screen. Certificate files you upload are malware-scanned before storage. Removing the "Powered by InterviewOS" footer is available on paid plans; the underlying entitlement is re-checked at page-render time, so a plan change takes effect immediately.
6. Sensitive and voluntary self-identification information
InterviewOS does not include mandatory demographic, disability, or health-related questions in its interview flow or resume builder. If you voluntarily include such information in a resume, career profile, or interview answer, it is stored and processed like any other content you submit, is never used for scoring, ranking, matching, or advertising, and is excluded from the public career-site projection described in Section 5.
7. How we disclose personal information
Service providers
Your configured AI provider (OpenAI, Azure OpenAI, Anthropic, Gemini, or AWS Bedrock) processes relevant content to generate the output you requested. Resend processes transactional and account emails. Razorpay processes subscription billing, invoices, and payment status. Google, GitHub, and X process the OAuth sign-in flow you choose to use and return only the profile fields you authorize. Cloudflare Turnstile may verify that certain requests are not automated. ClamAV performs malware scanning of uploaded files. Private object storage (self-hosted or S3-compatible, such as Supabase Storage) stores uploaded documents, avatars, and certificate files.
Legal and safety
We may disclose information where reasonably necessary to comply with legal process, investigate fraud or security incidents, enforce our terms, or protect rights, property, or safety.
InterviewOS does not sell personal information and does not disclose it for cross-context behavioral advertising. We do not operate advertising pixels, ad-tech SDKs, or third-party marketing analytics on the product.
8. US state privacy disclosures and choices
InterviewOS does not sell personal information for money or other valuable consideration, and does not share personal information for cross-context behavioral advertising. Because we do not run advertising technology on the Service, there is no applicable opt-out link required for sale, sharing, or targeted advertising.
Depending on where you live, you may have rights to know, access, correct, delete, or port your personal information, and to appeal a denial of a rights request. Use the export and deletion tools in Settings, or contact us using Section 14. We do not use browser Do Not Track signals because no uniform standard has been finalized; where legally required, we honor recognized universal opt-out signals such as Global Privacy Control for any covered processing, though today that has no practical effect since we do not sell or share personal information or serve targeted advertising.
9. Cookies and similar technologies
InterviewOS uses a single HttpOnly, rotating session cookie for authentication, plus any cookie strictly required by Cloudflare Turnstile when CAPTCHA protection is enabled. We do not use third-party advertising cookies, tracking pixels, or general-purpose analytics SDKs. Authenticated and API content is excluded from PWA caching.
10. Data retention and account deletion
We retain personal information only as long as reasonably necessary for the purposes in this Policy, for the life of your account, or as required for fraud prevention, security, accounting, tax, or other legal obligations. Requesting account deletion in Settings schedules a grace period (shown in Settings, up to 90 days) during which the request can be canceled. When the grace period ends: your login credentials, OAuth links, and sessions are removed; your career profile and any uploaded certificate documents are deleted; resumes are marked deleted and their extracted text and structured content are cleared; and your account identity is anonymized.
Security, billing, and audit records may be retained beyond account deletion where required for fraud prevention, accounting, or legal obligations.
11. Your rights and choices
Settings provides a machine-readable data export covering your account, career profile, certificate documents, resumes, job postings you created, interviews, consent records, and invoices; an optional marketing-consent toggle; and an account-deletion request with a visible grace period. For a request that cannot be completed in Settings, contact us using Section 14; we will authenticate the request only to the extent reasonably necessary and respond within the period required by applicable law.
12. Security
We use administrative and technical safeguards appropriate to the sensitivity of the data involved, including Argon2id password hashing, rotating server-side sessions, optional two-factor authentication, same-origin and rate-limit enforcement on mutating requests, and malware scanning of uploads where configured. No system is completely secure, and this statement is not a guarantee against incidents. Use a unique password and contact us promptly at the address in Section 14 if you suspect your account has been compromised.
13. International users
InterviewOS operates from and processes data in the jurisdiction where it is deployed. If you access the Service from a region with different data-protection laws, your information may be transferred to and processed in a jurisdiction whose laws differ from your own; we take reasonable steps consistent with applicable law before doing so.
14. Contact us and changes to this Policy
For privacy questions or a request that cannot be completed in Settings, contact privacy@interviewos.ai. We identify each version of this Policy by its effective date and provide notice of material changes as required by law; a materially new purpose or data category is not applied to previously collected information without the additional notice this requires.