Privacy Policy

1. Who We Are

InterviewSeason ("InterviewSeason," "we," "us," or "our") is an AI-powered job application tracking platform available at interviewseason.com. We operate a web application, a Chrome browser extension, and associated backend services that help job seekers organise, track, and analyse their job search.

For privacy-related enquiries, contact us at [email protected].

2. Information We Collect

We collect the following categories of personal data:

2.1 Account & Profile Information

• Name (first and last), email address
• Job title, current company, and location (optional)
• Work experience (in months), skills list
• Preferences: weekly application goal, snooze duration, follow-up threshold, preferred display currency
• Notification preferences (push and email)

2.2 Job Application Data

• Company name, job title, job ID, application platform (LinkedIn, Indeed, Naukri, Gmail)
• Job type, applied date, application status, referral flag
• Notes (up to 5,000 characters), expected salary and currency
• Interview rounds, types, results, and notes
• Follow-up and snooze dates

2.3 Offer & Compensation Data

• Base salary, signing bonus, target bonus percentage, equity details, vesting schedule
• Benefits data: PTO, parental leave, health/dental/vision insurance, 401(k) match, learning budget, gym stipend
• Offer deadline, personal notes, pros and cons

2.4 Resume Data

• Uploaded resume files (PDF, up to 10 MB each)
• Extracted text and skills parsed from your resume
• Resume builder content: personal details, work history, education, certifications, projects, publications, awards, volunteering

2.5 Usage & Technical Data

• Last active timestamp, account creation and update timestamps
• Feature usage (AI extraction calls, career card exports, analytics views)
• Activity timeline events (source: manual entry or Gmail parsing)
• Feedback you submit (like/dislike with message)

2.6 Push Notification Data

• Browser push subscription endpoint, encryption keys (P256dh, Auth), and user agent
• This data is used solely to deliver push notifications you have opted into

2.7 Chrome Extension Data

• Job listings you view or click on LinkedIn, Indeed, and Naukri
• Gmail email content (Premium only) — parsed by Google Gemini AI to extract job application details; raw email content is not stored beyond the parsed result
• Idempotency keys to deduplicate extension events

2.8 Subscription & Payment Data

We do not directly process or store payment card numbers. Subscription payments are processed by our payment processor. We retain subscription status (Free / Premium), billing plan type, subscription start date, and expiry date.

3. How We Use Your Information

We use personal data only for the following purposes:

• Providing and personalising the InterviewSeason service
• Processing AI-powered features: resume skill extraction, ATS scanning, job description matching, Gmail email parsing (Google Gemini)
• Sending transactional emails: interview reminders, offer alerts, rejection notifications, weekly application reports
• Delivering browser push notifications you have opted into
• Enforcing plan limits (Free vs. Premium tier)
• Security: rate limiting, replay attack prevention (via Redis), fraud detection
• Analytics to improve the product (aggregated, not sold to third parties)
• Responding to support requests and legal obligations

We will never sell, rent, or trade your personal data to third parties for their marketing purposes.

4. Third-Party Services & Data Processors

We engage the following sub-processors, each bound by data processing agreements or equivalent contractual protections:

We determine your approximate country from your IP address in order to show prices in your local currency. This lookup happens entirely on our own servers using a bundled offline database — your IP address is never sent to a geolocation provider. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

5. Data Retention

• Your data is retained for as long as your account is active
• On account deletion, all personal data, job applications, resumes, interviews, offers, and activity logs are permanently deleted within 30 days
• Aggregated, anonymised analytics data may be retained indefinitely as it cannot be attributed to any individual
• Backup copies may persist for up to 90 days after account deletion before they are overwritten
• Push notification subscription data is deleted immediately when you revoke notification permission or delete your account

6. Cookies & Local Storage

InterviewSeason uses browser local storage (not traditional HTTP cookies) to maintain your authenticated session via Supabase. Specifically:

• Authentication tokens: Your Supabase JWT is stored in browser local storage to keep you logged in across sessions. This token is automatically refreshed and expires after the configured session duration.
• Session storage: Maintenance mode notices are stored in sessionStorage and cleared when the browser tab closes.
• Activity tracking: Read/unread state for your activity feed is stored in localStorage under the key trackr_activity_last_read.
• No third-party advertising cookies: We do not deploy advertising, tracking pixels, or retargeting cookies.

The Chrome extension uses its own isolated storage (Chrome extension storage API) for extension-specific state. This storage is not accessible to the website.

For detailed information about our storage practices, see our Cookie Policy.

7. AI & Automated Processing

InterviewSeason uses Google Gemini AI for the following automated processing:

• Extracting job application details from Gmail emails (Premium users only, limited to 5 emails per day)
• Extracting skills and ATS-relevant information from uploaded resumes
• Matching resumes against job descriptions
• Enhancing resume bullet points (AI text enhancement)

You retain full control over which resumes and emails are processed. Gmail email parsing only activates when the Chrome extension is installed and you explicitly authorise access. AI-processed results are stored as structured data attached to your account; raw AI model outputs are retained for debugging for up to 7 days before automatic deletion.

8. Data Security

• All data in transit is encrypted via TLS/HTTPS
• Resume files are stored in AWS S3 with access controls
• Authentication is handled by Supabase using industry-standard JWT tokens with JWKS validation
• Rate limiting (200 requests/minute authenticated, 30/minute anonymous) protects against abuse
• Replay attack prevention uses Redis with a 24-hour deduplication window
• No payment card data is stored on our servers

While we employ reasonable security measures, no system is 100% secure. If you discover a security vulnerability, please report it to [email protected].

9. Children's Privacy

InterviewSeason is not directed at individuals under the age of 18 (or 13 in jurisdictions where that is the applicable minimum age). We do not knowingly collect personal data from minors. If we discover that a minor has created an account, we will delete the account and all associated data without notice.

10. India — Digital Personal Data Protection Act 2023 (DPDPA)

If you are located in India, the Digital Personal Data Protection Act 2023 (DPDPA) applies. Under DPDPA, InterviewSeason acts as a Data Fiduciary and you are a Data Principal.

Your Rights Under DPDPA

• Right to access: Request a summary of the personal data we hold about you and how it is being processed
• Right to correction: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data (account deletion triggers permanent deletion within 30 days)
• Right to grievance redressal: Raise a grievance about our data processing practices
• Right to nominate: Nominate a person to exercise your rights in the event of death or incapacity

Consent

By creating a InterviewSeason account, you provide free, specific, informed, unconditional, and unambiguous consent to the processing of your personal data as described in this policy. You may withdraw consent at any time by deleting your account, which will terminate our right to process your personal data.

Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside India (including the United States, where our cloud infrastructure and AI processing services are located). These transfers occur under contractual protections consistent with DPDPA requirements.

To exercise your rights or raise a grievance, email [email protected]. We will respond within 72 hours and resolve requests within 30 days.

11. United States — California Consumer Privacy Act (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete: Request deletion of personal information we have collected, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising
• Right to limit use of sensitive personal information: We do not use sensitive personal information beyond what is necessary to provide the service
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights

Categories of personal information collected (past 12 months): Identifiers (name, email), professional or employment-related information (job applications, salary, interview data), inferences drawn from personal information (analytics, match scores).

To submit a CCPA request, email [email protected]with "CCPA Request" in the subject line. We may ask you to verify your identity before processing. We will respond within 45 days (extendable by an additional 45 days with notice).

12. Canada — PIPEDA & Provincial Privacy Laws

If you are located in Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies, along with substantially similar provincial legislation in British Columbia (PIPA), Alberta (PIPA), and Québec (Law 25 / Act 64).

Your Rights Under PIPEDA

• Access to personal information we hold about you
• Challenge the accuracy and completeness of your information
• Request correction of inaccurate information
• Withdraw consent to our collection, use, or disclosure of your information (subject to legal or contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca

We collect only what is necessary for the identified purposes, obtain consent, and do not use your data for undisclosed purposes. Our retention practices are described in Section 5.

For Québec residents: consistent with Law 25, we publish this privacy policy in accessible language, you have the right to data portability and the right to be de-indexed from any automated decision-making, and we will report any serious privacy incidents to the Commission d'accès à l'information as required.

To exercise your rights, email [email protected].

13. Australia — Privacy Act 1988 (Cth) & Australian Privacy Principles

If you are located in Australia, the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) apply to our handling of your personal information.

Your Rights Under the Privacy Act

• APP 12 — Access: Request access to the personal information we hold about you
• APP 13 — Correction: Request correction of personal information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading
• Right to complain: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have interfered with your privacy

We collect personal information only by lawful and fair means and only if necessary for our functions. We take reasonable steps to ensure the accuracy of your personal information and to protect it from misuse, interference, loss, and unauthorised access.

Cross-border disclosures: your personal information is transferred to and processed in the United States (AWS, Google, Supabase). Before doing so, we take reasonable steps to ensure these overseas recipients handle your information in accordance with the APPs (APP 8).

To access or correct your information or lodge a complaint with us (which must be resolved before the OAIC will accept it), email [email protected]. We will respond within 30 days.

14. International Data Transfers

InterviewSeason's infrastructure is primarily hosted in the United States. By using InterviewSeason from India, Canada, or Australia, you acknowledge that your personal data will be transferred to and processed in the United States. We rely on contractual protections with our sub-processors and, where applicable, standard contractual clauses or equivalent mechanisms to ensure your data receives an adequate level of protection.

15. Your Content & Data Portability

You retain ownership of all content you create or upload in InterviewSeason — your resumes, job application notes, interview details, offer information, and career cards. InterviewSeason is granted a limited, non-exclusive licence to store, process, and display this content solely for the purpose of providing and improving the service to you.

You can export your job application data as a CSV file at any time from the Applications page. Resume files can be downloaded individually. We do not hold your data hostage — if you want to leave, you can take everything with you.

16. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will update the "Last updated" date at the top of this page and notify you via email or an in-app notice at least 14 days before the changes take effect. Continued use of InterviewSeason after the effective date constitutes acceptance of the updated policy.

17. Contact Us

For any privacy-related questions, requests, or complaints: