Skip to content
Interview Coach

Privacy notice

Last updated 15 August 2026 · Applies to Interview Coach at ibinterviewpractice.com

Interview Coach is operated by Ash Rigby, who is the data controller for the personal data described here. For anything in this notice (questions, requests, complaints) email ansrigby@gmail.com. The version of this page on the site is always the current one.

What we collect, and why

  • Account details: your email address, your name as entered at registration and your password, which Supabase (our authentication provider) processes when you sign up or log in and stores only as a one-way hash, a form that cannot be read back as the password itself. Used to sign you in, keep your practice history yours and send you account emails (a welcome message, password resets).
  • Your answers: the text of each answer you submit for evaluation, including, for spoken answers, the automatic transcript and any edits you made to it, plus the recording's length. Used to generate your feedback and to show you your own attempt history.
  • Evaluation results: the scores, written feedback, suggested stronger answer and confidence level the AI evaluator produces for each attempt. Used to show your results and progress over time.
  • Practice activity: which questions you attempted and when, and any questions you mark “I don't know” for review. Used to run your dashboard, progress page and needs-review list.
  • Your view of the marking: if you choose to answer “Was this feedback fair?” on a results page, we store your thumbs-up or thumbs-down and, if you add one, a short reason (up to 280 characters), linked to that attempt. This is optional; you can change or remove it at any time from the same results page. It is used only to review and improve the questions, rubrics and evaluator. The operator sees it, per question, alongside the attempt's scores. It never changes your score, progress, recommendations or usage limits.
  • Learning-level profile: each question carries a learning level (1 Entry to 5 Hard). From your own attempts we derive, privately, which questions are developing, strong or secure for you, your demonstrated and recommended level in each subject, and level-aware suggestions about what to practise next. This is calculated on demand from your attempts under the same per-account protections; we do not keep a separate stored rank, publish any profile, compare you with other users, or predict interview outcomes. Each saved attempt records the question's level at the time so your history stays accurate if questions are later reclassified.
  • Unsent drafts in your browser: to protect against an accidental refresh, the answer you are typing (and a per-submission identifier) is kept in your own browser's local storage, scoped to your account and the question, cleared when the answer is saved, and never sent to us as a draft. Switching account on the same browser removes the previous account's drafts.
  • Usage counts and records: how many evaluations and transcriptions you use per hour and per day, and, for each transcription, a usage record holding the reserved and provider-reported audio duration in seconds and the request's status; and, for each evaluation, a short-lived submission record used to make sure a retried submission is never evaluated or charged twice. Used only to enforce fair-use limits, control AI costs and monitor for abuse; these are numbers and statuses, never the audio or the transcript itself.
  • Product-usage analytics: we use PostHog (EU-hosted, data stored in the European Union) to count page views and to record four moments: an account being created, a practice question being opened, an answer being submitted for evaluation and the results page being viewed (with the question's topic and the overall score). Signed-in activity is linked to your account's internal identifier, a random ID, not your name or email address; the browser keeps a small identifier so a visit can be recognised across pages. No answer text, audio, transcript, name or email is ever sent to PostHog and we do not record your screen. Used to understand whether the service is being found, used and returned to, so we can improve it.

We do not collect payment details (the service is free), we do not use advertising trackers or sell personal data, and the usage analytics above are the only third-party measurement on the site.

Lawful bases

UK data protection law requires a lawful basis for each use of personal data. We rely on:

  • Performance of a contract: for delivering the service you sign up for: your account, signing you in, evaluating the answers you choose to submit, transcribing the recordings you choose to make, and showing you your results, history, progress, learning levels and needs-review list.
  • Legitimate interests: for keeping the service secure and affordable: enforcing fair-use rate limits, preventing abuse, and controlling AI costs (this is what the usage counters and submission records exist for); and for understanding, through the minimal usage analytics described above, whether the service is being used and improved in the right places. We use these in ways we believe do not override your rights.
  • Legal obligation: for handling privacy-rights requests and anything else the law requires of us.

This mapping reflects the current service; it is kept under review and we recommend independent professional review of this notice.

AI processing: what leaves our systems

  • Submitted answers go to Anthropic. When you press “Submit answer”, your answer text is sent to Anthropic (the maker of Claude, in the United States) together with the question and its marking guide so the AI can grade it. The app does not attach your name, email or account identity, but the answer text itself is sent as you wrote it, so any personal details you choose to include in an answer are sent with it. Anthropic states that standard Claude API inputs and outputs are not used to train its models and are deleted within 30 days, subject to its stated exceptions, for example policy enforcement, legal requirements, or separately agreed retention arrangements.
  • Recorded audio goes to OpenAI. If you record a spoken answer, the audio stays in your browser until you press transcribe; it is then sent to OpenAI's speech-to-text API (the /v1/audio/transcriptions endpoint, in the United States) and only the transcript comes back. Interview Coach does not save the recording in its own database. No audio is stored anywhere on our side. The recording itself is sent as spoken, so anything personal you say out loud is part of the audio OpenAI receives. OpenAI's data-controls documentation currently lists this endpoint as having no application-state retention and no abuse-monitoring retention and states that API data is not used to train its models unless a customer opts in, though providers can make exceptions where legally required or under their policies.

AI-generated feedback can be wrong. Scores and suggestions are produced by a language model against a marking guide; they may contain inaccuracies and are provided for interview practice only. They are not financial, careers or other professional advice and no score is a promise about real interview outcomes.

Where your data lives

  • Supabase hosts our database and login system. Your account and everything in “What we collect” is stored there, protected by row-level security so each account can only read its own data. Supabase runs on cloud infrastructure that may be located outside the UK.
  • Vercel serves the website. Its server functions for this site run in the United States, so requests you make (including answer submissions in transit) are processed there. Vercel keeps short-lived technical logs (currently about an hour) that do not include your answers.
  • Resend delivers our account emails, such as password resets and the message confirming your account was created. Resend receives your email address (and the email's contents) for delivery and runs on cloud infrastructure that may be located outside the UK. We do not use email open or click tracking.
  • PostHog stores the product-usage analytics described above, on its EU Cloud (data held in the European Union). It receives page views, the four product events and your account's random internal identifier, never your name, email, answers, audio or transcripts.

Because Anthropic, OpenAI and Vercel process data in the United States, your practice data is transferred internationally when you use the service. We keep what is sent to each provider to the minimum the feature needs, as described above. Each provider offers standard data-protection terms for these transfers: Anthropic's data processing addendum (including standard contractual clauses) is incorporated automatically into its API terms; OpenAI's is incorporated into its services agreement; and Supabase's (effective 1 August 2026) forms part of its terms of service, with acceptance of the agreement having the effect of signing the standard contractual clauses. Vercel's addendum expressly covers its paid plans, and we are confirming how it applies to our current setup before any public launch.

How long we keep it

  • Your account and practice history are kept while your account remains active, so your progress and learning-level tracking keep working.
  • If you ask us to delete your account (below), we delete it and all of your practice data following a verified request.
  • We review inactive accounts at least annually and delete those no longer needed. We do not currently have automatic deletion, and we will not pretend otherwise.
  • Deletion removes your data from the live application database. Copies may persist temporarily elsewhere: in the AI providers' retention windows described above, in Vercel's short-lived technical logs (currently about an hour), and in provider-managed database backups according to Supabase's current retention processes, which age out on the provider's schedule. The usage-analytics events linked to your account's internal identifier are deleted from PostHog as part of handling your deletion request.

Deleting your account and data

Email ansrigby@gmail.com from the email address your account is registered under and ask for deletion. We will acknowledge your request and complete it (or formally respond if we cannot) without undue delay and at most within 28 days. Deletion removes your login, account details, answers and transcripts, evaluation results, learning-level history, needs-review list, usage counters, usage and submission records. The same address also handles requests for a copy of your data.

Your rights

Under UK data protection law you have rights over your personal data. Depending on the circumstances, these include the rights to access it, correct it, delete it, restrict or object to its use and receive a copy of it. Exercise any of these via ansrigby@gmail.com. If you are unhappy with how a request is handled, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

This notice is revised whenever the service's processing changes. It has been prepared carefully by the operator but is not legal advice; independent professional review is recommended before relying on it as such.

← Back to Interview Coach