Privacy Policy

1. Data We Collect

• Waitlist and beta-access information — your email address, access consent, optional marketing consent, optional interview timeline, target role or company, practice challenge, campaign/referrer attribution, invitation and registration status, and timestamps showing whether an invited user completed and viewed a first or second evaluated practice case.
• Account information — such as your name, email address, hashed password (or third-party sign-in identifier), and subscription tier.
• Practice content — the answers, notes, and other text you submit, together with the scores and feedback generated for them.
• Usage & device data — analytics events, progress, streaks, pages viewed, approximate location derived from IP, browser type, and similar technical information.
• Payment data — handled by our payment processor; we receive limited billing metadata (such as the last four digits and subscription status) but not full card numbers.

2. How We Use Your Data

We use personal data to provide and operate the Service; to evaluate your submitted answers and return scores and feedback; to maintain your account, history, and subscription; to administer the waitlist, invitations, onboarding, activation, and consented follow-up; to process payments; to send transactional emails; to secure the Service and prevent abuse; to understand and improve how the Service is used; and to comply with legal obligations. Our legal bases under GDPR are performance of our contract with you, your consent (for example, for non-essential analytics cookies), our legitimate interests in operating and improving the Service, and compliance with law.

Requesting beta access authorizes messages needed to confirm, invite, and onboard you. It does not subscribe you to general marketing, guarantee an invitation, or create an account. General product updates are sent only if you separately opt in, and you can unsubscribe at any time.

3. AI Processing of Submitted Answers

To generate rubric scores and feedback, the text you submit is sent to a third-party AI provider (currently Google) to be evaluated. We send your answer text and the practice prompt — not your name, email, or account identifiers — so your submission is pseudonymous to the provider. Depending on the provider plan we use, the provider may process and retain that text and, under some tiers, use it to operate and improve its own AI services in accordance with its terms. We never sell your data. Because your answers leave our systems to be scored, please do not include sensitive personal information in them. Automated scoring is provided for guidance only and does not produce legally significant decisions about you.

4. Cookies & Analytics

We use strictly necessary cookies to keep you signed in and to secure the Service, and — where permitted — analytics cookies to understand product usage. You can control non-essential cookies through your browser settings or any cookie controls we provide. Analytics data is used in aggregate to improve the Service.

5. Third-Party Processors

We share personal data with vetted service providers that process it on our behalf under their applicable terms and, where available, data-processing agreements, including:

• a database and authentication provider (for hosting account data and content);
• an AI evaluation provider (for scoring your answers);
• a payment processor (for subscriptions and billing);
• an email delivery provider (for transactional email);
• an analytics and error-monitoring provider (for usage and reliability).

We do not sell your personal data. We may disclose data if required by law or to protect our rights, users, or the Service.

6. Your Rights

Depending on your location, you have rights to access, correct, export (data portability), restrict, object to, and delete your personal data, and to withdraw consent where processing is based on consent. You can access and update much of your data in your account settings, and you can request export or deletion by contacting us. We will respond within the timeframes required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

Unsubscribing stops optional marketing and records the minimum suppression information needed to avoid contacting you again. A suppression record is not used for marketing.

7. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or de-identify your personal data within a reasonable period, except where we must retain certain records (such as billing records) to comply with legal, accounting, or security obligations.

8. International Transfers

We and our processors may store and process data in countries other than your own, including the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

9. Children

The Service is not directed to children. You must be at least 16 years old to use it. We do not knowingly collect personal data from anyone under 16; if we learn that we have, we will delete it.

10. Security

We use technical and organizational measures — including encryption in transit, access controls, and hashed credentials — to protect personal data. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice before they take effect and update the “Last updated” date above.

12. Contact

For privacy questions or to exercise your rights, contact us at privacy@productcasework.com.