Privacy Policy

Information we collect

• Account details: your name, email address and the profile photo from the provider you sign in with.
• Your resume, work history and the answers you save for job applications.
• Practice sessions: audio, video and transcripts of interviews you record, and the scores and feedback we generate from them.
• Job applications you submit through us, including the tailored resumes and cover letters we generate.
• Billing details. Card numbers go directly to Stripe and never reach our servers; we keep your subscription status and invoice history.
• Usage and device data: pages viewed, features used, approximate location from your IP address, and diagnostic logs.

Google user data

Two separate Google permissions are involved, granted at different moments. Signing in with Google gives us your name, email address and profile photo. Connecting Email tracking — an optional feature you switch on yourself from the Application Profile screen — additionally lets us read the metadata of recent messages in your Gmail mailbox, so we can show you which companies have replied to applications you sent through us.

In full, these are the Google permissions this application requests:

• openid

  Confirms the identity of the Google Account you are signing in with.

• https://www.googleapis.com/auth/userinfo.email

  Your email address, which is the identifier your account and all of your data are keyed to.

• https://www.googleapis.com/auth/userinfo.profile

  Your name and profile photo, shown in the app and used on your billing receipts.

• https://www.googleapis.com/auth/gmail.metadatasensitive

  The sender, subject and date of recent messages, so replies from companies can be matched to the applications you submitted. This permission cannot return message contents.

What we never receive, and never do

• We never receive the body of any message. The gmail.metadata permission is technically incapable of returning message contents or attachments — Google will not serve them under this permission, whatever we ask for.
• We never look at your sent mail or your drafts. Both are excluded from the query we run.
• We cannot send, reply to, modify, label, archive or delete anything in your mailbox. This access is read-only.
• We never look at messages older than 14 days.
• We never use your Gmail data for advertising, and we never sell it.

What we store

When a message matches one of your applications, we store only these fields:

• The sender's name and email address.
• The subject line.
• The date the message was sent.
• Google's identifier for the message and its thread, so we can link you straight to it.

No message content is stored, because none is ever retrieved. To read a matched message you click through to Gmail itself.

How matching works

Every 30 minutes we compare the sender, subject and date of messages from the last 14 days against the companies you applied to — by the company's own email domain, by the domain of a known applicant-tracking system, or by the company name appearing in the subject or sender. This is ordinary text comparison running on our own servers. No artificial-intelligence or machine-learning model is involved at any stage.

Who can see it

You can, on your own applications. Beyond that, access is limited to automated server-side processes and to a small number of named staff, who may access it only to resolve a support request you have raised, to investigate a security incident, or where the law requires it. There is no routine human review of your Gmail data.

Limited Use commitment

We affirm the following:

AceInterview AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. https://developers.google.com/terms/api-services-user-data-policy

In plain terms: we use data from Google APIs only to provide the feature you switched on, we do not pass it to others except where that policy allows, we never use it for advertising, and no person reads it outside the narrow cases described above.

• We use Google user data only to provide and improve the Email tracking feature you explicitly enabled.
• We do not transfer Google user data to others, except as necessary to provide that feature, for security purposes, to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
• We do not use Google user data for serving advertising of any kind.
• We do not allow humans to read Google user data unless you give explicit consent for specific messages, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymised.

Turning it off

Use Disconnect in your Application Profile. That revokes our access and immediately deletes every sender, subject and date we stored, along with the timeline entries built from them; notes you wrote yourself are kept. You can also remove access from your Google Account permissions page, which stops our access straight away — to also erase what we had already stored, use Disconnect in the app or write to us.

How we use information

• Run and personalise interview practice, drills, scoring and feedback.
• Find and rank job matches, and prepare and submit the applications you ask us to send.
• Show you the status of those applications, including replies matched from your inbox.
• Take payment, send service email and answer support requests.
• Keep the service running and secure, prevent abuse, and meet our legal obligations.

We do not sell your personal information. We do share irreversibly hashed identifiers — your email address and name — with advertising platforms so they can measure which of their ads led to a signup or a purchase. This never includes anything obtained from Google APIs, and you can opt out by writing to us.

AI and machine learning

The product is built on AI, so we want to be precise about which data reaches which provider. Practice interviews are conducted by a voice agent using OpenAI language models, with speech recognition and synthesis by ElevenLabs, real-time transport by LiveKit, and an optional video avatar from Anam, HeyGen, RunwayML or LemonSlice. Scoring, feedback, interview plans, job-fit analysis and generated resumes and cover letters use OpenAI models. Applications are filled in on your behalf by a browser agent operated by Browser Use. All of these are paid business API plans.

Data obtained through Google APIs is never sent to any of them. Email tracking performs deterministic text and domain comparison on our own servers; no model ever sees a sender, a subject or a date from your mailbox.

We do not use, transfer or sell Google user data — raw, aggregated or derived — to develop, improve or train any generalised or foundational artificial-intelligence or machine-learning model, whether our own or anyone else's.

Who we share data with

We use the providers below to run the service. Each is bound by contract to process data only on our instructions. The final column shows which of them can ever hold data obtained from Google APIs — only the infrastructure the application itself runs on.

How we protect your data

• Everything is encrypted in transit with TLS.
• Google refresh tokens and saved portal credentials are encrypted at rest with AES-256-GCM, under a key held only in our server environment. That key is never present in the browser.
• Access tokens are minted per sync run, held in memory and never written to disk.
• All Gmail access happens server-side. No Google token and no Gmail data is ever exposed to code running in your browser.
• Every database table enforces row-level security, so the public key that ships in our web pages can read nothing. We run an automated audit of this after every schema change.
• We request the narrowest permission that works: Email tracking uses gmail.metadata rather than a permission that would also grant access to message contents.
• Uploaded files are served through short-lived signed URLs rather than public links.
• The connection flow is protected by a signed, encrypted, time-limited value bound to your account.
• If a breach affects your data, we will notify you and the relevant regulator as the law requires.

How long we keep things

Email metadata is kept while your Google connection is active and deleted the moment you disconnect. We only ever look at the last 14 days of mail, so nothing older enters the system at all.

Account data is kept while your account is open. Delete your account from Settings and we remove your profile, resumes, uploaded files, recordings, transcripts, practice history, job applications and Google connection, and revoke our Google access, within 30 days.

Two things are kept deliberately. A record of completed purchases, including the billing email address, is retained for accounting, tax and chargeback defence. Aggregated usage statistics that are no longer linked to you are also kept.

Your rights and choices

Wherever you live, you can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything that is wrong.
• Delete your account and its data — you can do this yourself in Settings.
• Stop sending you marketing email. Every one also carries an unsubscribe link.
• Stop sharing hashed identifiers with advertising platforms.

If you are in the UK, the EU, or a US state with a privacy statute, these rights are guaranteed to you by law, and we will not charge you or treat you differently for exercising them. Write to help@aceinterview.ai and we will respond within 30 days.

Children

The service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

International transfers

We are based in the United States, and our providers operate there and in the European Union. Where data moves out of your own country, we rely on the standard contractual clauses or an equivalent safeguard.

Changes to this policy

We update the date at the top whenever this policy changes. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect.

Contact

Questions, requests, or anything else about this policy: help@aceinterview.ai. We answer every one.