AXIR Interview Buddy — Privacy Policy (EU/EEA)
Effective date: 13 July 2026 · Last updated: 13 July 2026
This Privacy Policy explains how Axir Consulting, registered in Dubai, United Arab Emirates ("AXIR," "we," "us"), processes the personal data of users in the European Union / European Economic Area ("EU/EEA") when they use AXIR Interview Buddy (the "Service"). For the purposes of the EU General Data Protection Regulation ("GDPR"), AXIR is the data controller.
1. Our EU Representative and Contact
- Controller: Axir Consulting, JLT, Unit #179 Jewellery & Gemplex, Dubai, United Arab Emirates.
- EU Representative (GDPR Art. 27): [NAME, EU ADDRESS, EMAIL].
- Data protection contact: privacy@axir.io.
You have the right to lodge a complaint with your local supervisory authority.
2. Personal Data We Process
You provide: account data (name, email, via Google/LinkedIn OAuth); your resume; job descriptions; voice recordings of your mock interviews; transcripts.
We generate: coaching reports, scores, and analysis; cross-session interview memory.
Collected automatically: usage/log/device data and analytics.
Payment: processed by Stripe; we do not store full card data.
Some content you submit (e.g., resumes, spoken answers) may reveal special categories of data under GDPR Art. 9 (such as health, ethnicity, or religion). We do not seek this data and ask you not to provide it, but where such data is processed we rely on your explicit consent or another Art. 9 basis.
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service (generate questions, run the AI voice interview, transcribe, produce reports, cross-session memory) | Performance of a contract — Art. 6(1)(b) |
| Record and process your voice | Consent — Art. 6(1)(a) [+ Art. 9(2)(a) where special-category] |
| Improve and train our AI models | Consent — Art. 6(1)(a) (opt-in; see §4) |
| Billing and subscription management | Contract — Art. 6(1)(b) |
| Security, fraud prevention, service maintenance | Legitimate interests — Art. 6(1)(f) |
| Comply with legal/tax obligations | Legal obligation — Art. 6(1)(c) |
4. Using Your Data to Improve and Train Our AI (Opt-In)
We would like to use information derived from your use of the Service — including transcripts and coaching data — to improve and train our AI models. Before any such use, we de-identify and/or aggregate the data so it is not reasonably linkable to you.
This use is off unless you switch it on. Your account settings include a training-consent control that is OFF by default. We will only use your data for model improvement and training if you give explicit, opt-in consent. You can withdraw consent at any time in your settings; withdrawal takes effect going forward and does not affect your ability to use the Service. Withdrawing consent, or requesting erasure, will also stop further training use of your identifiable data and remove your still-identifiable contributions from our training sets.
5. Automated Processing
Your coaching scores and reports are produced by automated AI. This processing is for practice and feedback only; it does not make legally or similarly significant decisions about you, and it is not used for automated decision-making under GDPR Art. 22. You can contact us with questions about how the analysis works.
6. Recipients and Subprocessors
We share personal data with vendors who process it on our behalf under GDPR Art. 28 data-processing agreements:
| Provider | Purpose |
|---|---|
| Retell AI | AI voice interviews; recording/transcription |
| OpenAI | Question generation and analysis (LLM) |
| Qdrant | Vector storage for interview memory |
| Stripe | Payments and subscription billing |
| [Database host] | Application data storage |
| Google / LinkedIn | Authentication (OAuth) |
| [Analytics provider, e.g. PostHog] | Product analytics |
(Reviewer: confirm complete and current.) We do not sell personal data.
7. International Transfers
We and our processors may process your data outside the EU/EEA, including in the UAE (our establishment) and the United States. As these countries may not have an EU adequacy decision, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards from privacy@axir.io.
8. Retention and Erasure
We keep personal data only as long as necessary for the purposes above. When you delete your account or request erasure, your account is disabled and enters a 30-day grace period during which you may reactivate it. After 30 days we permanently delete your personal data across our systems — account, resumes, job descriptions, transcripts, coaching reports, interview memory (including vector data), and voice recordings held by our voice provider — and remove personal identifiers from our payment records. We retain only (a) data we must keep by law (e.g., invoices/tax records, typically for [6–10] years), (b) records of your request, and (c) anonymized data that can no longer identify you. Formal erasure requests are completed within one month.
9. Your GDPR Rights
You have the right to: access; rectification; erasure; restriction; data portability; object to processing based on legitimate interests; withdraw consent (including for training and voice recording); and not be subject to solely automated decisions with legal/similar effect. To exercise these, use your account settings or contact privacy@axir.io. We respond within one month (extendable by two further months for complex requests) and may verify your identity first. You will not be treated less favourably for exercising your rights.
10. Cookies and Analytics
We use essential cookies to run the Service and, with your consent, non-essential cookies for analytics. You can manage these through our cookie banner and your browser.
11. Security
We apply appropriate technical and organizational measures, including access controls, encryption in transit, and processor security requirements. We will notify you and the relevant authority of a personal-data breach where required (within 72 hours of awareness where feasible).
12. Children
The Service is for users 18 and older. We do not knowingly process children's data.
13. Changes
We will notify you of material changes at least [30] days in advance by email or in-product notice.
14. Contact
Axir Consulting · JLT, Unit #179 Jewellery & Gemplex, Dubai, United Arab Emirates · Privacy: privacy@axir.io · EU Representative: [details].