Back to ConvoScript

Who we are

ConvoScript is operated by operator legal entity of registered address, the data controller for everything described here. Contact: support@convoscript.local.

What we collect, and why

Your account

Email address, display name, and a one-way hash of your password - never the password itself. If you sign in with Google we also store the account identifier Google gives us. We keep the date you joined, when you last signed in, and your plan. This is what lets you have an account at all.

Your devices

For each signed-in session: the browser's user agent string, the IP address it signed in from, and when it was created, last used, and expires. You can see this list and end any session on it. It exists so an account takeover is visible and reversible, and it is deleted when the session ends or expires.

Your resume and profile

The file you upload is kept, along with the text extracted from it and the structured profile a language model produces from that text - skills, roles, education, projects, and short talking points. Anything you add as "extra proof points" is kept with it. This is the material every suggested answer is built from.

Your interviews

The position, company, and job description you enter; when the interview started and ended; how long it ran; and the outcome, round label, and notes you record yourself. ConvoScript never infers how an interview went.

Transcripts and generated content

The text of what was said, labelled by speaker - which includes the words of whoever else was on the call - the questions ConvoScript detected, and the answers and reviews it produced.

Retention is decided when the interview starts, and never changes afterwards. Whatever your plan entitled that interview to is written down at the moment it begins. Upgrading later does not open an older interview that was never kept, and downgrading later does not shorten a window you were already promised. If you use a one-off interview credit on a Free account, that interview gets the credit's retention, not Free's.

On Free, none of it is written down at all. Not stored and hidden - not stored. The words exist in memory for the length of the call, because that is what an answer is generated from, and nothing reaches a disk: no transcript, no detected question, no answer text, and no review.

Consent records

For each interview, which version of the recording notice you accepted and when. This is kept because it is the record that you were told what was being captured.

Usage and cost

How many seconds of audio were streamed, how many tokens each model call used, and what we estimate that cost us. Used to run the business, spot abuse, and keep an eye on our own spending - never to profile you.

Product events

That a resume was submitted, whether it parsed, that setup was completed, that an interview started and how long it ran, how many answers it used, and whether someone opened the pricing page or pressed upgrade. Each one records the step, the plan, and a timestamp.

The details are counters and fixed labels, never your words. No company name, no job title, no question, no answer, no filename. It is how we find out that a step is broken - a resume format that never parses, an upgrade button nobody can complete - which is not something support tickets tell us in time. It stays in our own database; there is no analytics vendor.

Error reports

When something breaks in your browser or on our server we record the error message, where in the app it happened, and a stack trace. Accounts are identified by an internal id rather than an email address.

Before an error leaves our server we remove: everything after the ? in a web address, because that is where a sign-in link would be; the body of the request; cookies and authorisation headers; the local variables recorded at each line of the stack; and any email address, sign-in link, or API key found anywhere in the text. Error messages are also cut short, because a failing provider sometimes quotes the request back to us and that request would contain your resume or your conversation.

What we do not collect

Cookies and local storage

One cookie keeps you signed in (convoscript_session), and a short-lived second one exists only during a Google sign-in (convoscript_oauth_state). Both are strictly necessary, which is why there is no cookie banner to click.

Your theme and sidebar preferences are stored in your browser and never sent to us.

Who else sees your data

We use these processors, and no others:

We do not sell your data, share it with advertisers, or use it to train anyone's model. Check each provider's own terms for how long they hold what we send.

How long we keep things

Deleting your account

Profile › Security › Delete account. You confirm by typing your email address and your password. It happens immediately, there is no grace period, and it cannot be undone. It removes your account, resumes and their files, every interview including deleted ones, transcripts, answers, reviews, credits, devices, and outstanding links. We email you to confirm it happened.

Uploaded files are removed as part of the same request. If our storage cannot be reached at that moment, the deletion is queued and retried until it succeeds - it is not logged and forgotten. We also sweep periodically for stored files whose record is already gone and remove those too.

Two things survive, with your name taken off them. We keep the record of what your usage cost us - seconds of audio, model tokens, and an estimated figure - with the link to you removed. It is what tells us that a given day cost a given amount, and we would have no way to run the business or check a provider invoice without it.

The same is true of product events. "Someone completed setup on the 9th" stays; which someone does not. They are counters and fixed labels with no content in them, so once your id is gone there is nothing left that points at you. Neither can be traced back to you.

And one marker, if you used the free interview. When a free interview is used, we keep a one-way marker derived from the verified email address so the same address cannot claim it twice. The marker is not reversible, is stored separately from your account, and contains no readable address and nothing from your resume, transcripts, or interviews. It stays after the account is deleted, for as long as the free offer exists. If an account is deleted before it ever used its free interview, that address stays eligible.

It is used for that one purpose and nothing else - never for marketing, profiling, analytics, fraud scoring, or linking accounts to one another. No part of ConvoScript can list it or search it by address; the only question it can answer is "has this one address, which you already gave me, been used?". The key that produces it is held outside the database, so a copy of the table alone cannot be turned back into a list of addresses. When the free offer ends, the table is dropped and the keys destroyed, because there is nothing else it could be used for.

The free interview is per address, not per person

The free interview is one per verified email address, not one per person. Someone with several addresses can verify more than one. We do not try to work out whether two addresses belong to the same person, because guessing wrong would block people from an interview they are entitled to.

That means we do not fold addresses together. a.b@example.com and ab@example.com are two accounts here, and so are me@example.com and me+work@example.com. Capitalisation is the one exception, because every mail provider treats it as the same mailbox.

Repeated signups are limited by rate and risk checks on the signup itself, and by ceilings on what we will spend, rather than by trying to identify who you are.

Your rights

Depending on where you live you may have the right to access, correct, export, delete, or restrict the use of your data, and to object to it or complain to a regulator.

Our legal basis, where that concept applies, is the contract between us for running the service, and our legitimate interest in keeping it secure and knowing what it costs.

Security

Passwords are stored as PBKDF2-SHA256 hashes with a per-account salt. Sign-in cookies are HTTP-only, so page scripts cannot read them, and every state-changing request carries a CSRF token. Reset and confirmation links are stored only as hashes, expire, and work once. Sign-in, reset, and confirmation are all rate limited.

No system is perfectly secure. If you find a problem, email us before telling anyone else and we will fix it.

Children

ConvoScript is not for anyone under 18, and we do not knowingly keep their data.

Changes

The version and date at the top change whenever this document does. We will email you before a material change takes effect.