Privacy Policy

1. Data controller

Íñigo Bohigues (Spain), operating Deskcraft. Contact for anything privacy-related: deskcraftbanking@gmail.com.

2. Data we process

Account data: name, email and a securely hashed password (managed by Supabase Auth). Profile data: your target role, firm tier, market and interview date. Training data: your answers, memos, model submissions, scores and progress. Optional CV text you upload or paste, used to personalise behavioral preparation.

Voice practice: when you answer aloud, your microphone audio is processed to produce a transcript; the transcript is stored with your answer, the audio is not retained after transcription, and your camera preview never leaves your device. Billing: subscription status and plan; card details are handled entirely by Stripe and never touch our servers.

3. Purposes and legal bases

We process data to provide the service you contracted (drills, grading, readiness scores — contract performance), to bill subscriptions (contract and legal obligation), to secure and improve the platform (legitimate interest), and, where you give it, on the basis of consent (e.g. optional CV upload). We do not sell personal data and we do not run advertising or tracking.

4. AI processing

Your answers, submissions and audio are sent to Google's Gemini API to generate grading, feedback and transcripts. This is core to the service. We do not use your data to train our own models.

5. Marketing communications

If — and only if — you tick the optional box when you sign up, we send you occasional product updates, new-feature announcements and interview tips by email. The legal basis is your consent, and we record the moment you gave it. You can withdraw at any time via the unsubscribe link in any such email or by emailing deskcraftbanking@gmail.com; withdrawing has no effect on your subscription or on the service. We never share your email address with third parties for their own marketing, and transactional emails you always receive (verification codes, receipts, security notices) are not marketing and are sent on the basis of contract, not consent.

6. Processors

We rely on: Supabase (database and authentication), Vercel (hosting), Stripe (payments) and Google (AI processing). Each processes data under its own data-processing agreement. Some processing may occur outside the EEA under EU-approved safeguards (standard contractual clauses).

7. Retention

We keep your data while your account exists. If you delete your account, personal data is deleted or anonymised within 30 days, except what we must keep for legal (e.g. invoicing/tax) obligations. Shared readiness reports contain no personal identifiers and can be removed on request.

8. Your rights

You can request access, rectification, erasure, portability, restriction or object to processing at any time by emailing deskcraftbanking@gmail.com. You can also exercise the main rights yourself directly in Account settings: export all your data as a JSON file, and permanently delete your account and data. You may additionally lodge a complaint with the Spanish supervisory authority (AEPD, aepd.es) or the authority of your country of residence.

9. Cookies

We use only essential cookies: the authentication session (Supabase) and a language preference cookie (dc_lang). No advertising or third-party tracking cookies are used, so no cookie banner consent is required.

10. Security

Data is encrypted in transit (TLS) and at rest by our providers; database access is protected by row-level security so each user can only reach their own records. Payment data is handled exclusively by Stripe (PCI-DSS certified).

11. Minors

The service is intended for users aged 16 or older. We do not knowingly process data of children under 16; if you believe we do, contact us and we will delete it.

12. Changes

We may update this policy; material changes will be announced in the app or by email. The date above always reflects the latest version.