Privacy notice for KickstartRole

This notice applies when you visit or use KickstartRole, including the home page, practice flow, question generation, Role Prep Pack, Experience examples, sign-in, pricing, telemetry, and support or privacy requests.

The data controller is the owner or operator that publishes the live KickstartRole service. Privacy contact details must be published on the live site before launch, including the legal or trading name, privacy email address, and any postal address required for the public service.

• Account and sign-in data: email address, authentication identifiers, session cookies, account plan, and sign-in status.
• Practice content: your temporary audio recording, transcript, interview question, selected question type, role title, company name, job advert, interview date, and selected Experience example.
• Saved preparation: Role Prep Pack details, Experience examples, saved answers, improved answers, summaries, focus areas, preparation state, and practice progress.
• AI output: transcript text, structured feedback, suggested improved answer, follow-up question, and generated interview questions.
• Consent evidence: signed-in user ID, consent purpose, policy version, and timestamp for AI feedback or saving an answer.
• Usage and security data: page path, route name, feature name, status code, latency, provider, limit reason, safe error category, request ID, and rate-limit subject.

Interview examples, job adverts, and transcripts can contain sensitive information if you choose to include it. KickstartRole does not ask for special category data, and you should avoid adding health, disability, ethnicity, religion, political opinion, trade union, immigration, or criminal-offence information unless it is genuinely needed for your own practice.

• To provide the requested service: record a practice answer, transcribe it, generate feedback, generate practice questions, save preparation, sync signed-in data, and restore your work across visits.
• To manage accounts: send magic-link sign-in emails, maintain secure sessions, show your account state, and apply the correct free or paid plan when billing is added.
• To keep the service safe and reliable: prevent abuse, enforce AI usage limits, troubleshoot failures, protect API keys, monitor uptime, and investigate security or support issues.
• To improve the product: understand broad product flow events such as page views, practice starts, answer submissions, feedback completion, sign-in success or failure, and where users abandon the flow.
• To meet legal and accountability obligations: keep narrow consent evidence, respond to privacy requests, handle disputes, and comply with lawful requests.

• Contract or pre-contract steps: processing needed to provide the practice, account, saved-preparation, and sign-in features you ask to use.
• Consent: processing your microphone recording for transcription and feedback, and recording signed-in consent evidence for AI feedback or saving an answer. You can withdraw consent by not submitting further recordings and by deleting saved preparation where available.
• Legitimate interests: service security, abuse prevention, cost control, privacy-safe telemetry, product reliability, and support. The right to object is specifically available for processing based on legitimate interests.
• Legal obligation: processing needed to comply with applicable law, regulator requests, tax, accounting, or security obligations.

When you request AI feedback, your audio is uploaded to KickstartRole and sent to OpenAI to create a transcript. The transcript, interview question, role details, job advert, and selected Experience example are then sent to OpenAI to produce feedback. When you generate practice questions, role details, job advert text, and selected Experience example details may be sent to OpenAI.

The OpenAI API key stays on the server. AI output is practice guidance only. KickstartRole does not make hiring decisions, does not provide live interview assistance, and does not score accent, dialect, emotion, personality, protected characteristics, or hireability.

The service does not make solely automated decisions that have legal or similarly significant effects on you. You should review AI feedback yourself and adapt any suggested answer in your own words.

Without an account, your Experience examples, Role Prep Pack, saved answers, latest improvement focus, and practice count stay in this browser's local storage. Clearing site data for KickstartRole removes local-only preparation from that device.

When you sign in, your browser may import existing local preparation once and sync it to your Supabase-backed account. Signed-in data is also cached locally so the app remains usable if the network or account sync is temporarily unavailable.

KickstartRole uses necessary cookies for authentication and same-origin operation. It does not use third-party advertising cookies. Browser telemetry posts to the app's own telemetry endpoint unless the telemetry kill switch is enabled.

• OpenAI, for transcription, question generation, and structured feedback.
• Supabase, for authentication, account data, private preparation storage, consent records, and database security controls.
• Vercel, for hosting, serverless runtime, deployment, and runtime logs.
• Upstash, for short-lived rate-limit and daily AI-usage counters when production rate limiting is configured.

KickstartRole does not sell personal data, does not share your saved preparation with employers, and does not use your practice answers for advertising. If payment processing, custom email delivery, analytics dashboards, or support-ticket tooling are added, the provider list must be updated before that feature is launched.

Providers may process personal data in the UK, EEA, United States, or other locations where they operate. Where personal data is transferred outside the UK or EEA, the launch operator should rely on the relevant provider data-processing agreement and transfer safeguard, such as an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism.

• Raw audio: not saved by this app to database or file storage. The browser may keep a temporary recording until feedback succeeds, you reset it, or you leave the page.
• Signed-out preparation: kept in this browser until you delete it in the app, use Forget progress, clear site data, or replace it with newer preparation.
• Signed-in preparation: kept in your account until you delete it in the app, delete the account, or ask for deletion. Deleting an Auth user cascades through personal product tables.
• Consent events: kept as narrow accountability records while the account exists or while needed to evidence consent and service integrity.
• Telemetry, logs, and rate-limit counters: kept only as long as needed for security, reliability, abuse prevention, cost control, debugging, and service accountability.

• You can remove saved Experience examples, Role Prep Packs, and saved answers inside the app.
• The continue-practice prompt includes a Forget progress action.
• You can clear browser site data to remove local-only preparation from a device.
• Signed-in deletions sync to your account when the network and session are available.
• For account deletion, export, or wider deletion requests, use the privacy contact published on the live service.

Depending on where you live and which law applies, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal data. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that already happened before withdrawal.

If you are in the UK, you can complain to the Information Commissioner's Office. You may also be able to complain to another supervisory authority where you live or work.

KickstartRole is designed for graduates and early-career job seekers, not children. If a user is under 16, they should use it only with permission from a parent, guardian, school, college, or training provider.

Do not use KickstartRole to secretly record real interviews, upload another person's voice without permission, disclose confidential employer material, or receive live assistance during a real interview.

KickstartRole uses server-side API keys, same-origin API routes, request-size limits, audio-duration limits, rate limits, Supabase row-level security, and privacy-safe logging rules. No online service can guarantee perfect security, but the app is designed so raw recordings are not stored by the application and sensitive practice content is not intentionally logged.

This notice should be reviewed when the service changes, when a new provider is added, when payment or support tooling launches, or when the legal owner/contact details change. Material updates should use a new effective date and a clear explanation of what changed.