Privacy Policy

Introduction

This Privacy Policy describes how Intervy collects, uses, stores, and protects your personal data when you use our service. Intervy is operated by a sole proprietor based in the European Union (Poland) and is committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Polish law.

By using Intervy, you acknowledge that you have read and understood this policy. If you do not agree with our practices, please do not use the service.

Data We Collect

We collect the following categories of personal data:

• Account information — email address, name, and OAuth profile information from Google, GitHub, or Microsoft
• Interview data — questions, templates, scores, and notes you create within the platform
• AI chat history — conversations with Ivy, Intervy's AI assistant
• CV/resume data — documents you upload for AI-powered analysis
• Payment information — processed securely by Stripe; we do not store your card details on our servers
• Usage analytics — aggregated data about how you interact with the platform

How We Use Your Data

We use your personal data for the following purposes, each with a lawful basis under GDPR:

• To provide and improve the Intervy service
• To process payments and manage your subscription
• To send transactional emails, including purchase confirmations and account notifications
• To provide AI-powered features such as interview assistance and CV analysis
• To analyze usage patterns in an aggregated and anonymized manner to improve the product

We do not use your data for advertising or sell it to third parties for marketing purposes.

AI Data Processing

When you use Intervy's AI features, your data may be sent to third-party AI providers — specifically OpenAI and Anthropic — for processing. These providers act as data processors and are bound by their respective data processing agreements.

If you use the BYOK (Bring Your Own Key) option, requests are sent directly from your browser to the AI provider. In this case, Intervy does not act as an intermediary and the AI provider's own privacy policy applies to those requests.

CV and resume data is anonymized on the client side before being sent to AI providers for analysis. We do not use your data to train AI models, and we require the same commitment from our AI providers.

Data Storage

Your data is stored on Cloudflare infrastructure, including Workers, D1 database, and R2 object storage. All data is encrypted in transit using TLS encryption.

Cloudflare's infrastructure is distributed globally, with data processing directed to the European Union where possible. We have a Data Processing Agreement in place with Cloudflare to ensure compliance with GDPR requirements.

Analytics

We use PostHog for product analytics to understand how our features are used and to improve the product experience. PostHog is loaded lazily and does not collect personally identifiable information.

Analytics data is aggregated and used solely for understanding feature usage, identifying issues, and guiding product development. You can opt out of analytics tracking through your browser settings or by using an ad blocker.

Cookies

Intervy uses essential cookies only for session authentication. These cookies are strictly necessary for the service to function and cannot be disabled.

We do not use advertising cookies, tracking cookies, or any third-party marketing cookies. We believe in keeping our cookie usage minimal and transparent.

Third-Party Services

We rely on the following third-party services to operate Intervy. Each service has its own privacy policy and data processing practices:

• Stripe — payment processing and subscription management
• Google, GitHub, Microsoft — OAuth authentication providers for secure sign-in
• OpenAI & Anthropic — AI processing for interview assistance and CV analysis features
• PostHog — privacy-focused product analytics
• Cloudflare — infrastructure, CDN, DNS, and data storage
• Resend — transactional email delivery

We carefully select third-party providers that demonstrate a commitment to data protection and GDPR compliance.

Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the GDPR:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restrict processing — limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing of your personal data

To exercise any of these rights, please contact us at support@intervy.ai. We will respond to your request within 30 days as required by law. If we need additional time, we will inform you of the reason and extension period.

Data Retention

We retain your personal data for as long as your account is active and the service is being used. Upon account deletion, we will delete your personal data within 30 days, except for the records below.

Organizations you were a member of but did not own keep their records of your activity there. Their audit logs keep your name, email address, IP address and browser details on the actions you took, and your email address on the actions others took on you, such as inviting you, changing your role or removing you. Their invitations to you keep your email address. These records are kept on the basis of legitimate interests (GDPR Article 6(1)(f)): a complete and trustworthy record of who did what in an organization's workspace, including to establish, exercise or defend legal claims (GDPR Article 17(3)(e)). Audit log entries are deleted once they pass the audit log retention period of the organization's plan, if the plan has one; invitations are kept until the organization deletes them or is itself deleted.

Anonymized analytics data that cannot be linked back to you may be retained indefinitely for product improvement purposes. Payment records and invoices are retained as required by applicable tax law (typically 5–7 years depending on jurisdiction).

No Sale of Data

We do not sell, rent, or trade your personal data to third parties. Your data is shared only with the service providers listed above, solely for the purpose of operating and improving Intervy.

Children

Intervy is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@intervy.ai.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, the "Last updated" date at the top of this page will be revised.

For material changes that significantly affect how we handle your data, we will notify you via email before the changes take effect. We encourage you to review this policy periodically.

Contact

For any privacy-related questions, concerns, or to exercise your data protection rights, please contact us at support@intervy.ai. You also have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

See also our Terms of Service and Refund Policy.