Privacy Policy

1. This Policy and the Data Controller

This Policy describes personal data processing when you use the Interview Boost AI website, account area, API and Windows application.

The Policy takes into account Russian Federal Law No. 152-FZ on Personal Data and covers information provided by Users or generated through use of the Service.

2. Data we process

• Account: email, password hash, name, avatar URL, interface language, email verification date, account identifiers and access token identifiers.
• Social login: the selected provider, its user identifier, email and technical OAuth data when social sign-in is used, including Google sign-in on the English website.
• Interview settings and context: answer language, selected model, theme, job title and URL, resume, technologies, additional information and skill pack.
• Chats: questions, message history, AI responses, generation status, model information and technical token metrics.
• Attachments: voluntarily uploaded screenshots, file name, MIME type, size, width, height, retention period and message association.
• Payments: selected plan, amount, currency, internal order number, T-Bank payment identifier and status, subscription period, renewal preference and an encrypted technical identifier of the saved payment method. The Service does not receive full card details.
• Email communications: whether consent to special offers was given, its date, version and source, unsubscribe date and personalized offer status.
• Product analytics: a random visitor ID before authentication, internal user ID after login, UTM tags, sanitized referral source and page path, timing and sequence of key product events, app version and aggregated feature usage. This store does not contain email addresses, resumes, job descriptions, chats, AI responses, screenshots, audio or payment details.
• Technical information: IP address, user agent, cookies and session ID, request and login dates, free AI request usage, error codes, app and OS versions. Error reports must not contain message text, stack traces or request bodies.
• Support requests: email address, support message and materials attached by the User.

During registration and successful website sign-in, the connection IP address is used to estimate the country, region and city for diagnosing service quality. The profile stores the most recently resolved location, its source and observation date; precise coordinates and movement history are not collected. The IP address is not stored in this geographic profile or sent to the geodata provider: lookups use a local database. Estimates may be inaccurate, including when a VPN is used. Geodata source: IP Geolocation by DB-IP.

3. Purposes and legal grounds

Data is used only for the following purposes:

• registration, login, email verification and account protection;
• performing the Terms of Service: storing sessions and chats, processing requests, generating AI responses and handling screenshots;
• accepting payments, issuing receipts, activating and managing subscriptions, notifying about upcoming charges, renewing as chosen by the User and processing refunds;
• providing support, resolving faults and maintaining information security;
• meeting accounting, tax and other mandatory legal requirements;
• end-to-end product analytics, measuring the funnel from referral to the first useful AI answer and payment, comparing app versions and improving the interface;
• emailing news and special offers only with separate, voluntary consent and until that consent is withdrawn.

Legal grounds include entering into and performing an agreement, the data subject's consent, statutory obligations and, where permitted by law, the Controller's legitimate interest in protecting the Service and preventing abuse.

Consent to special offers is not required to register or use the Service. Unsubscribing does not affect the account, subscription or service emails.

4. AI requests and User Content

The Service may display models and modes labeled GPT/OpenAI, Claude, Gemini, Grok and DeepSeek, as well as Auto mode. Availability may change as the Service evolves.

To generate an answer, the current question, relevant chat history, selected session context and attached images are sent to the API of the AI provider actually processing the request. A request is sent only after the User explicitly sends a message. For voice input, the selected audio recording is sent to a transcription provider after the User explicitly starts that feature.

As of this Policy version, answer generation and speech transcription are performed through the OpenAI API. Claude, Gemini, Grok and DeepSeek labels in the interface or website may denote modes and model families; these names alone do not imply direct data transfers to Anthropic, Google, xAI or DeepSeek. If their direct APIs are integrated, the recipient list and this Policy will be updated.

Where the provider's API supports it, the backend requests processing without saving results in the provider's product stores. Technical processing and limited operational retention by the provider may still be subject to its own terms and security requirements.

5. Cookies and Yandex Metrica

Necessary cookies support web sessions, CSRF protection, persistent login and the account area. They work independently of analytics choices; disabling them may make some features unavailable.

On a first visit, Yandex Metrica, Session Replay and Varioqub start before the User saves a choice, to measure visits and allocate visitors to A/B variants. Analytics services may receive cookies, IP address, browser and device details, referral source, visited pages, clicks and other interactions for statistics, experiments and website improvements.

Users can allow continued analytics or disable it in the notice. The choice, date and version are stored in a preference cookie for up to one year. After rejection, analytics scripts are not loaded on subsequent views, and accessible analytics cookies and localStorage entries are deleted. Data already transmitted before rejection cannot be automatically recalled.

For first-party product analytics, the Service creates a random visitor_id, stores first-touch and last-touch UTM attribution, and links it after registration or login to an internal user_id. The client sends only allowed UI events; registration, AI answers, subscriptions and payments are recorded by the backend. User materials are not included in these events.

Rejecting analytics does not affect registration, login, payment or use of your account.

Change analytics cookie preferences

6. Recipients and processors

To the extent necessary for an operation, data may be received by:

• OpenAI — the current provider processing text and images for AI responses and audio for transcription;
• T-Bank — payment acceptance, saving payment methods at the User's request, recurring charges, payment confirmation and receipts;
• Yandex — web analytics, service email delivery and OAuth sign-in where used;
• VK — OAuth sign-in when that method is selected;
• Google — OAuth sign-in when that method is selected;
• hosting and infrastructure providers — operating servers, databases, caches and backups;
• public authorities, only pursuant to a binding lawful request.

The Controller does not sell personal data or give third parties independent rights to use User Content for their advertising.

7. Infrastructure location and cross-border transfers

When AI features are used, data may be processed on infrastructure of the actual AI provider and its technical suppliers outside the Russian Federation. As of this version, that provider is OpenAI.

Transfers are limited to data necessary for the selected feature, require a lawful basis and must meet applicable cross-border transfer requirements. If you do not want to send questions or screenshots to an AI provider, do not submit them in the chat.

8. Retention periods

• accounts, settings, sessions, chats and associated messages are retained while the account exists or as needed to perform the agreement;
• unattached screenshots have limited retention and are deleted automatically, normally after 60 minutes;
• attached screenshots are retained with their messages until the relevant data or account is deleted;
• payments, receipts and transaction records are retained for mandatory accounting and tax periods;
• technical security data and backups may remain temporarily after the primary record is deleted, until the scheduled cleanup cycle ends.
• pseudonymous product events and attribution are retained as needed to compare funnels and retention, then deleted or aggregated; their account association is removed with the account.
• marketing consent and withdrawal records are retained as needed to demonstrate compliance with the User's choices and legal requirements.

After the purpose is fulfilled, data is deleted or anonymized unless further retention is required by law or to resolve an ongoing dispute.

9. Security and confidentiality

Measures include access controls, HTTPS, password hashing, private file storage, resource isolation, time-limited codes, API authorization and other reasonable organizational and technical safeguards.

Passwords, access tokens, resumes, messages, AI responses and screenshots are intentionally excluded from application logs and Telegram error alerts. No transmission or storage method can nevertheless guarantee absolute security.

10. User rights

Users may request information about processing, correction, restriction or deletion of data, withdraw consent and exercise other rights provided by law.

Send your request from the account email to majetec.service@gmail.com. To protect your account, the Controller may request reasonable identity verification. Withdrawal does not affect the lawfulness of previous processing or require deletion of data that must be retained by law.

You can also unsubscribe using the link in any marketing email. Opening the confirmation page does not itself unsubscribe you.

11. Minors' data

Paid features are intended for adults or individuals with full legal capacity. If the User cannot independently provide the required consent, processing is allowed only with a legal representative's involvement.

12. Policy changes

New versions are published at https://interview-boost.ru/en/privacy. Material changes to purposes, recipients or processing methods follow the notification and consent procedure where legally required.

13. Contact

For questions about personal data processing, contact majetec.service@gmail.com.

Service provider details

Service Provider and Data Controller

Dmitry Evgenyevich Kozyrev, Individual Entrepreneur

Sole proprietor registration number (OGRNIP)

322280100026582

Taxpayer identification number (INN)

281304244173

Bank account

40802810000003664857

Correspondent account

30101810145250000974

Bank identification code (BIK)

044525974

Address

11 Stantsionnaya Street, Zavitinsk, Zavitinsky District, Amur Region, 676870, Russia

Support and legal notices

majetec.service@gmail.com