← Back to PitchVoxx

Privacy Policy

Effective date: 2026-03-24  Â·  Version 1.0  Â·  Controller: PitchVoxx operator

This policy applies to all users of PitchVoxx, including users in the European Economic Area (EEA), the United Kingdom, and Switzerland, and fulfils the information requirements of the General Data Protection Regulation (GDPR, Regulation EU 2016/679).

1. Who We Are

PitchVoxx is an AI-powered interview coaching service. References to "we", "us", or "PitchVoxx" mean the operator of this service. For questions about this policy or to exercise your rights, contact us at privacy@pitchvoxx.com.

2. Data We Collect

2.1 Account data

DataWhy we collect itRetention
Email addressAccount identification, loginUntil account deletion
Password (hashed with bcrypt)Authentication — the plain-text password is never storedUntil account deletion
Subscription plan and session countEnforce plan limits, display plan statusUntil account deletion
Stripe customer ID and subscription IDLink payments to your accountUntil account deletion (Stripe retains its own records per financial regulations)
Account creation timestampAudit and supportUntil account deletion

2.2 Interview session data

Interview messages (your questions and the AI's responses) are processed in real time to generate replies and post-interview feedback. We do not store conversation transcripts in our database. Messages exist only in your browser's memory for the duration of your session and are discarded when you close or refresh the page.

Each message is sent to Anthropic (Claude API) to generate a response. See §5 for details.

2.3 Resume data (Pro/Team plans)

If you use the Resume Analysis feature, the text you paste is sent to Anthropic for analysis and immediately discarded — it is not stored in our database.

2.4 Server logs

Our server records access logs containing IP address, timestamp, HTTP method, and response code. These logs are used for security monitoring and are rotated and deleted after 90 days. We do not log message content.

2.5 Cookies

We use a single essential session cookie (session) to keep you logged in. This cookie is strictly necessary for the service to function and does not require your consent under the ePrivacy Directive. It contains only an encrypted session identifier — no personal data. It expires when your browser session ends or after 30 days of inactivity. We use no analytics, advertising, or tracking cookies.

3. Lawful Basis for Processing (GDPR Article 6)

Processing activityLawful basis
Creating and maintaining your accountContract performance (Art. 6(1)(b))
Processing payments via StripeContract performance (Art. 6(1)(b))
Sending interview messages to Claude AIContract performance — core service delivery (Art. 6(1)(b))
Server access logs for security monitoringLegitimate interests — fraud prevention and service security (Art. 6(1)(f))

4. How We Share Your Data

We do not sell your data. We share data only with the subprocessors listed below, strictly as necessary to deliver the service.

SubprocessorRoleData sharedLocation
Anthropic AI responses (Claude API) Interview messages and resume text (text only). No email, no payment data. United States
Stripe Payment processing Email address (pre-fills checkout). Payment card data is held by Stripe only — never by PitchVoxx. United States (global)
ElevenLabs Text-to-speech (voice output — primary) AI-generated reply text only. No email, no user messages, no PII. United States
Google Cloud TTS Text-to-speech (voice output — fallback when ElevenLabs is unavailable) AI-generated reply text only. No email, no user messages, no PII. United States
Hosting provider Server infrastructure All server-side data (database, logs). Encrypted at rest. European Union (where possible)

International transfers

Anthropic, Stripe, ElevenLabs, and Google Cloud are based in the United States. Transfers to these providers are made under Standard Contractual Clauses (SCCs) adopted by the European Commission, or under the EU–US Data Privacy Framework where applicable. Copies of relevant transfer mechanisms are available on request.

5. Your Rights Under GDPR

As an EEA, UK, or Swiss resident you have the following rights:

To exercise any right, email privacy@pitchvoxx.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g. CNIL in France, ICO in the UK, BfDI in Germany).

6. Data Retention

Account data is retained until you delete your account. Access logs are retained for 90 days. Interview transcripts are not stored. When you delete your account, all personal data is permanently removed from our systems within 30 days. Stripe retains payment records for the period required by applicable financial regulations (typically 7 years).

7. Security

We protect your data using industry-standard measures: bcrypt password hashing, encrypted HTTPS connections (TLS 1.2+), HTTP security headers (Content-Security-Policy, HSTS, X-Frame-Options), rate limiting to prevent brute-force attacks, and bot-filtering middleware. The server is hardened following SOC 2 security guidelines. We hold SOC 2 compliance documentation on request.

8. Children

PitchVoxx is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us at privacy@pitchvoxx.com and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where required by law, notify you by email. Continued use of PitchVoxx after changes take effect constitutes acceptance of the revised policy.

10. Contact

For any privacy-related questions or to exercise your rights:
Email: privacy@pitchvoxx.com

PitchVoxx  Â·  Effective 2026-03-24  Â·  Back to app