Privacy Notice

Last updated: [DATE]

Draft. Replace the bracketed parts and have this reviewed before you launch. It is a starting point, not legal advice.

Who we are

ProdDojo is run by [YOUR NAME OR ENTITY], [FULL POSTAL ADDRESS], [CITY], India ("ProdDojo", "we", "us"). We decide how your personal data is used, which makes us the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 and the "controller" under the EU and UK GDPR.

Contact and Grievance Officer

For any privacy question, request or complaint, contact our Grievance Officer: [GRIEVANCE OFFICER NAME], support@proddojo.com, [FULL POSTAL ADDRESS]. We acknowledge every message within 48 hours and resolve it within 30 days.

The short version

• We collect your email, what you type in interviews, and how you use the site.
• An AI writes the interviewer's replies and your scorecard. Your interview text goes to our AI providers for that, and to nobody else.
• Analytics and ad cookies only run if you click "Accept".
• You can delete your account and everything in it yourself, from Account › Delete account.
• ProdDojo is for people aged 18 and over.

What we collect, and why

• Account details (your email; if you use Google sign-in, your name and picture as Google shares them): to create your account and sign you in. You gave them to us to use ProdDojo.
• Interview content (what you type, the AI interviewer's replies, scorecards, timestamps, number of replies, which AI model answered and how many tokens it used): to run interviews, write scorecards, keep your history and control cost.
• Consent record (the version of these terms you accepted and that you confirmed you're 18 or over): to show what you agreed to.
• Waitlist interest (that you joined the Pro waitlist, and the plan and price shown): to email you if Pro launches. You can leave the waitlist at any time.
• Technical data (IP address, browser and device type, sign-in times, error logs): to keep the service secure, stop abuse and fix problems.
• Usage analytics, only if you accept (a random ID stored in your browser, pages viewed, buttons pressed, the website that sent you): to see which features work. You can withdraw consent at any time.
• Ad measurement, only if you accept (the ad click ID and campaign tags, Google Ads cookies): to see whether our ads lead to sign-ups. You can withdraw consent at any time.

Notes you type in the interview room's notes box stay in your browser. They are never sent to us.

Please don't share personal or confidential information in interviews

The cases are fictional, so you never need to give real personal details, your employer's confidential data, or sensitive information such as health, finances, religion or politics. If you do, it's stored with your transcript and sent to our AI providers like any other reply. You can remove it by deleting your account.

AI and your scorecard

The interviewer is an AI, not a person. Replies and scorecards are generated automatically by AI models, with no human review. A scorecard is practice feedback only. It isn't shared with employers and has no legal or similar effect on you. AI can be wrong; if you think a scorecard is unfair, tell us. To improve cases and prompts, we may read a small number of transcripts. We don't use your transcripts to train AI models.

Who we share it with

We don't sell or rent your personal data. We share it only with these service providers, who process it for us under contract:

• Supabase: sign-in and database. India (Mumbai region).
• Cloudflare: hosting and security. Global network, nearest location to you.
• Google Cloud (Vertex AI, Gemini): writing interviewer replies and scorecards. [India (asia-south1) / Google's global infrastructure].
• Groq: backup AI provider if Google is unavailable. United States.
• Google Ads, only if you accept: measuring ad results. United States and other Google locations, also under Google's own policy.
• [Email provider]: sending sign-in links. [Country].

We may also disclose data if Indian law or a lawful order requires it, or to protect users and the service from fraud or abuse.

Transfers outside India

Some providers above process data outside India, mainly in the United States. Indian law currently allows this. If you're in the EU or UK, we rely on our providers' Standard Contractual Clauses or the EU–US Data Privacy Framework for these transfers.

Cookies and browser storage

• Always on, needed to work: your sign-in session, your notes, where to send you after sign-in, and your cookie choice.
• Only if you click Accept: the analytics ID (crux_anon), saved campaign tags (crux_utm) and Google Ads cookies (such as _gcl_au).

You can change your choice at any time with Cookie settings, also at the bottom of every page.

How long we keep it

• Account and interviews: until you delete them, or [24] months after your last sign-in, whichever comes first.
• Usage analytics: [13] months, then deleted.
• Security logs: [1 year], as Indian law requires, then deleted.
• If you delete your account, your data is removed from our live systems straight away and from backups within [30] days.

Your rights

Wherever you live, you can ask for a summary of the personal data we hold about you and who we've shared it with; correct or update it; delete your account (Account › Delete account, or email us); withdraw consent to analytics and ads at any time (Cookie settings), without affecting anything done before; nominate someone to exercise your rights if you die or can't act yourself; and complain to our Grievance Officer. If you're in the EU or UK, you can also ask us to restrict or stop processing, object to processing based on legitimate interests, and get your data in a machine-readable format.

We reply within 30 days. If you're not satisfied, in India you can complain to the Data Protection Board of India after using our grievance process; in the EU or UK, to your local data protection authority.

Children

ProdDojo is only for people aged 18 and over, and we ask you to confirm your age when you sign in. We don't knowingly collect data from anyone under 18 or show them targeted ads. If you believe someone under 18 has an account, email us and we'll delete it.

Security

Data is encrypted in transit and at rest. Only ProdDojo can access the database, using restricted keys, and other users can't see your interviews. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

Language and changes

This notice is in English. If you'd like it in another language listed in the Eighth Schedule to the Constitution of India, email us. If we change it in a way that matters, we'll tell you by email or in the app before the change takes effect.