Privacy Policy

1. Controller & Contact

If you are in the EEA/UK, you have the right to lodge a complaint with your local supervisory authority. A list is available at EDPB.

2. Information We Collect

We collect information you provide directly, information generated through your use, and information from third-party providers (e.g., OAuth). We minimize collection to what is necessary.

We do not intentionally collect sensitive personal data (e.g., health, political opinions) and you should not provide it.

3. Legal Bases (GDPR Art. 6)

We process personal data only where we have a legal basis:

• Contract (Art. 6(1)(b)): to create your account, provide mock interviews, coding execution, and learning paths you request.
• Legitimate Interests (Art. 6(1)(f)): to secure our service, prevent fraud/abuse, improve our AI/logic, and measure performance — balanced against your rights.
• Consent (Art. 6(1)(a)): for non-essential cookies/analytics, marketing emails, and optional resume analysis. You may withdraw consent at any time via the cookie banner or Cookie Settings.
• Legal Obligation (Art. 6(1)(c)): to comply with tax, accounting, or law enforcement requests.

4. How We Use Information

• Provide, personalize, and improve interview preparation (including AI evaluation via our LLM providers).
• Generate readiness scores, recommendations, and progress analytics.
• Process subscriptions, payments, and device limits; send transactional emails (Resend).
• Communicate updates, security alerts, and (where consented) product marketing — you can opt out in-app or via unsubscribe link.
• Ensure security, prevent abuse (e.g., Judge0 code execution limits, rate limiting), and comply with law.

We do not use your content to train third-party foundation models. AI providers act as processors under contract and are instructed not to retain your data for training (see §6).

5. Cookies & Consent (GDPR ePrivacy / CCPA)

We use cookies, localStorage, and similar technologies. Categories:

Your choices: On first visit in the EEA/UK/California, you will see a consent banner. You can choose Accept all, Reject non-essential, or Customize. You can change your choice anytime via the link in the footer or by clearing localStorage key cookieConsent. We respect Global Privacy Control (GPC) signals as a request to opt out of sale/share where applicable.

Google Analytics is only loaded after you grant Analytics consent. See Google’s cookie policy.

6. Sharing & Processors

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share only with processors under contract:

• Infrastructure: Vercel (hosting), MongoDB Atlas (database), Upstash Redis (cache), Cloudflare R2 (resume storage).
• Auth: GitHub, Google, LinkedIn (OAuth only).
• Payments: Stripe and/or Razorpay (payment data processed directly by them; we receive only metadata).
• AI: Groq, Google (Gemini), Hugging Face, Cohere, etc., via LangChain — instructed not to train on your data; retained only transiently for the request.
• Communications: Resend (transactional email), Google Analytics (only with consent).

We require processors to implement appropriate safeguards and to act only on our instructions. A current sub-processor list is available on request to privacy@nextround.in.

7. International Transfers

Your data may be processed in India, the EU, and the US (where our processors operate). For transfers from the EEA/UK to third countries, we rely on an adequacy decision or Standard Contractual Clauses (SCCs) with supplementary measures, and for US transfers, where available, the EU-US Data Privacy Framework. You can request a copy of the relevant SCCs via privacy@nextround.in.

8. Retention

When retention expires, we delete or anonymize data. You can request earlier deletion (subject to legal holds).

9. Security

We implement technical and organizational measures: TLS in transit, encryption at rest (where supported by our providers), hashed passwords (OAuth), access controls, logging, and regular reviews. No system is 100% secure; please use a strong, unique password and enable any available second factor via your OAuth provider. In case of a personal data breach likely to result in risk, we will notify you and, where required, the supervisory authority within 72 hours.

10. Your Rights (GDPR — EEA/UK)

Subject to conditions and exceptions, you have the right to:

• Access (Art. 15) — obtain a copy of your personal data and processing details.
• Rectification (Art. 16) — correct inaccurate data (you can also edit most profile fields in Profile).
• Erasure (Art. 17) — request deletion (“right to be forgotten”).
• Restriction (Art. 18) — request limited processing.
• Portability (Art. 20) — receive your data in a structured, machine-readable format (JSON/CSV).
• Object (Art. 21) — object to legitimate-interest processing or direct marketing at any time.
• Withdraw Consent (Art. 7(3)) — withdraw cookie/marketing consent without affecting prior lawful processing (via Cookie Settings).
• Not to be subject to solely automated decisions with legal/similar significant effects (Art. 22) — human review is available on request (see §12).

To exercise rights, email privacy@nextround.in from your account email with subject “GDPR Request”. We will verify your identity (via your logged-in session) and respond within one month (extendable by two months for complexity, with notice). No fee unless requests are manifestly unfounded/excessive.

11. Your Rights (CCPA/CPRA — California)

If you are a California resident, you have the following rights (Cal. Civ. Code §1798.100 et seq.):

• Know & Access: the categories, sources, purposes, and specific pieces of personal information we collected in the last 12 months.
• Delete: request deletion of personal information (subject to exceptions e.g., completing transactions, security, legal compliance).
• Correct: request correction of inaccurate personal information.
• Opt-Out of Sale/Share: we do not sell personal information and do not share for cross-context behavioral advertising. If this changes, we will update this policy and provide a “Do Not Sell or Share My Personal Information” link. We honor GPC signals.
• Limit Use of Sensitive Personal Information: we do not use or disclose sensitive personal information for inferring characteristics.
• Non-Discrimination: we will not discriminate against you for exercising CCPA rights.

Metrics (last 12 months): 0 sale/share requests received, 0 fulfilled, median response 18 days. To submit a request, email privacy@nextround.in with “CCPA Request” and include your account email. For authorized agents, provide signed permission plus verification of your identity. We will respond within 45 days (extendable by 45 days with notice).

Categories collected in last 12 months: Identifiers (email, name), Internet/Network (IP, usage), Professional/Education (tech stack, experience), Inferences (readiness scores). Categories disclosed to processors: same, for business purposes listed in §4 & §6. Categories sold/shared: none.

12. Automated Decision-Making & AI

Our AI mock interview evaluation generates scores, strengths/gaps, and follow-ups based on your answers and the ideal answer. This is not a decision with legal or similarly significant effects; it is educational feedback. You can request human review of an evaluation by emailing privacy@nextround.in, and we will provide an alternative perspective. We log model name, prompt version, and token usage for auditability (see Terms).

13. Children’s Privacy

Our service is not directed to children under 16, and we do not knowingly collect data from them. If you believe a child has provided data, contact us for deletion.

14. Changes to This Policy

We may update this policy to reflect legal, technical, or business changes. Material changes will be notified via email or an in-app banner at least 30 days before the new version becomes effective. The “Last updated” date at the top indicates the current version.

15. How to Contact Us & Exercise Rights