This notice explains what personal data PrepHint AI collects, why, who receives it, and what you can do about it. It applies to the PrepHint AI website, web app and related services.
1. Who is responsible
PrepHint AI is responsible for your personal data (“we”, “us”).
Privacy contact: hello@prephint.ai
2. What we collect
Account. Your email address and, if you sign in with Google, the name and email Google gives us. We use these to create your account and sign you in. We do not use passwords.
Content you add. Resumes, other documents, job details (such as job title and company), and your settings. Resume and document files are stored in private cloud storage.
Your calls. When you run a live call or a mock interview, your browser sends sound to a speech-to-text provider (and, for mock interviews, to a voice provider), and text goes to an AI model to write suggested answers. We do not save the audio. We save the transcript, your questions and the answers, and a short summary after a mock, unless you switch saving off for a call. A live call can contain what another person said (for example an interviewer). Your duties towards that person are in our terms.
Resume Maker voice input. If you press the microphone in the Resume Maker, your browser sends the sound to our speech-to-text provider, and the text it returns goes into the box you are writing in. We do not save the sound. We record how many seconds you used, to apply the daily limit.
Payments. Paddle takes your payment. We receive the status of your purchase and subscription (plan, dates, payment succeeded or failed, refunds). We do not receive your card number.
Usage records. How much live time and how many mock interviews you used, when calls started and ended, and whether they worked. We need this to apply your plan and refunds.
Technical data. Logs and measurements about how the service performs: request times, error reports, which provider and model answered, and how long it took. These contain ids, lengths, counts and durations. They never contain the words of your calls, your resume, your email address, or your audio.
Device and error data. To serve you better and to find and fix errors, our apps send us error and crash reports and general technical facts about the app and the device it runs on. We never send what is said or shown in your calls, your computer’s name or user name, or your files. Usage analytics (which features you use) are on by default; you can turn them off at any time in Settings, under Privacy and data, and we stop sending them from then on.
Visits to our website and app, cookies and advertising. When you visit our website or app we count the visit: the main language your browser is set to (for example “French”), the country your connection comes from, and which kind of page it was. We keep no name, email address, IP address, cookie or browser details for this count, it is not linked to your account, and it runs whether or not you accept cookies, because we use it to decide which languages to add next. To stop it in the app, switch off “Count my visits” in the app’s Settings, under Privacy and data. A browser that sends the Global Privacy Control signal is never counted, on the website or in the app.
On our website we also use PostHog to see how people find and use the site, and to measure our own advertising on Google: which advertisement a visitor came from, and whether that visit led to a sign-up or a purchase. We do not show advertisements on our site. In the European Economic Area, the United Kingdom and Switzerland, PostHog sets no cookie until you press Accept on the small cookie card, and records only anonymous page views, clicks and page speed before that. Elsewhere it sets its cookie as soon as you arrive, and you can decline with “Cookie settings” at the bottom of any page. With a cookie, we also record how you move around the site (clicks and a recording of the page with everything you type masked) and, when you create an account, the web app links your first visit to your account so we know which advertisement led to it. A browser that sends the Global Privacy Control signal is treated as having declined. Each cookie, what it does and how long it lasts is on our cookie notice.
When you email us. Your address and what you write.
Employer requests. If you email us to ask that PrepHint AI not be used in your company’s hiring, we keep your email and what it says (the company name, its web addresses and job sites, and how long you want the block to last) to handle your request and to reply to you. There is no form for this; you write to hello@prephint.ai.
Terms acceptance. A record of which version of our terms you accepted, and when.
Mac app notice. If you leave your email address in the box for the Mac app on our download page, we keep that address, and nothing else about you, to send you one message when the Mac app is available. We use it for no other message. You can ask to be removed at any time by writing to hello@prephint.ai.
3. Why we use it, and on what basis
| Purpose | Basis (for people in the EU or UK) |
|---|---|
| Run your account and the service you asked for | Performing our contract with you |
| Take payments, keep records, give refunds | Performing the contract, and our legal obligations (tax and accounting) |
| Keep the service secure and working; find and fix errors; measure speed | Our legitimate interest in a safe, working service |
| Answer your emails | Our legitimate interest in answering you (performing the contract when you are a customer) |
| Send you the one Mac app message you asked for | Your request when you leave your address (you can ask us to remove it at any time) |
We do not sell your personal data. We do not use your transcripts, resumes or answers to show you advertising.
4. Who receives your data
We share your data only with service providers that help us run PrepHint AI, and each gets only what its job needs. Paddle handles the sale as its own controller (see its row below). The others handle data on our behalf, and we choose providers that commit to protecting the data they handle for us.
| Type of provider | What they do for us | What they may receive |
|---|---|---|
| Payments (Paddle) | Paddle is our Merchant of Record: it sells our plans, takes payment, and handles tax, invoices and refunds | Your email, billing details and payment details at checkout |
| Hosting and storage | Run our website, app, server and database, store your files, and forward email sent to our addresses | Page requests (including your IP address), what is stored in your account, and emails you send to hello@prephint.ai |
| Speech to text | Turns the sound of your calls, and what you say to the Resume Maker by voice, into text | Call audio and Resume Maker voice input, and the job title and company of a call session |
| AI models | Write your answers and run the AI mock interviewer | Recent call text, your resume and documents as needed, and the sound of mock interviews |
| Sends sign-in codes and service emails | Your email address and the message | |
| Company suggestions | Suggests company names and logos as you type | The company name you type, sent from our server with nothing that identifies you. Your browser loads each logo directly from this provider, so it sees your IP address and which companies’ logos are requested, not the page you are on |
| Error and performance monitoring | Helps us find and fix errors and serve you better, and shows which features are used, unless you turn this off | Ids, counts, timings, error codes and general technical facts about the app and your device, never your call content. Your IP address is not stored. Usage analytics unless you turn them off in Settings |
| Website analytics (Cloudflare) | Measures how fast our website loads and how many people visit, and counts the language and country of visits | Page requests, including your IP address; Cloudflare’s page-speed tool sets no cookie |
| Website analytics and advertising measurement (PostHog) | Shows how people find and use our website and which of our Google advertisements led to a sign-up or purchase | Page views, clicks, page speed and, once cookies are allowed, a recording of the page with everything you type masked; the campaign tags of the link you arrived by (for example the advertisement’s name and Google’s click number); a random visitor id kept in a cookie once cookies are allowed. It is not sent what you type |
You can ask us for the current list of the companies we use, and where they handle data, by emailing hello@prephint.ai.
We may also share data when the law requires it, to protect our rights, or with a buyer if the business is ever sold.
5. Data sent outside your country
Some of our providers handle data outside your country, including outside Kenya, the European Union and the United Kingdom (for example in the United States). Where that happens, we rely on safeguards such as the EU Standard Contractual Clauses and the UK addendum in each provider’s data processing agreement. You can ask us for a copy of these safeguards at hello@prephint.ai.
6. How long we keep it
- Your account and content stay until you delete them. Deleting an account marks it deleted and stops sign-in; your data is no longer shown or used. You can ask us at hello@prephint.ai to remove it for good, and we will do so within 30 days.
- A resume or document you delete has its text and file removed. Deleted sessions are no longer shown to you; we keep the record of the session itself.
- If you switch off transcript saving, we do not save the transcript. Backups and providers may still hold text for a while. This can be up to 60 days.
- When you delete your account, the record of which terms you accepted is deleted with it.
- Payment and tax records are kept as long as the law requires. Paddle keeps them as Merchant of Record; we keep our own payment records for at least 5 years (Kenyan tax law).
- Desktop crash dumps are kept 90 days in our own private storage. Other error, performance and analytics data is kept about 13 months.
- An address left for the Mac app notice is deleted after we send the message, or when you ask us to remove it.
- Audit records of changes to accounts are kept without an end date.
- Some records are short-lived: a sign-in code stops working after 5 minutes, a data download stops working 24 hours after it is made and its file is deleted after 7 days, repeat-request keys are deleted after a day, and the stored details of a payment event, cut to the fields we read, are emptied after 90 days.
7. Your rights
Depending on where you live, you can ask us to: show you the data we hold about you, correct it, delete it, limit or object to its use, give you a copy you can move, or stop using it where you gave your agreement. You can also complain to your data protection authority. To use a right, email hello@prephint.ai from the address on your account.
If you are not a customer but were in a call where a customer used PrepHint AI (for example as an interviewer), you can email hello@prephint.ai to ask what we hold of what you said, or to have it removed. Tell us the date of the call and who the customer was, so that we can find it. We will reply as the law requires.
You can delete your own resumes, documents and sessions in the app, and switch off transcript saving for a call.
8. Cookies
See our cookie notice.
9. Children
The service is not for people under 18.
10. Changes
If we change this notice in a way that matters, we say so on this page and, where our terms require it, ask you to accept again.
Privacy notice version: 2026-10-26. See also the terms, refund policy and cookie notice.