Privacy Policy

Your career story deserves care. This notice explains the personal information used to provide MockReps, why it is used, who receives it and the choices available to you.

1. Who is responsible

Robert Hilge Manoj Danushka Stanley, trading as MockReps and operating from Sri Lanka, is responsible for the personal information used to operate the website and application. In laws that use that term, this is the service's data controller. Paddle separately determines how it handles data for purchases it sells as merchant of record. Contact details are below.

2. Information you provide

• Account information: your name, email address, verification and account-support information. Password authentication uses protected password hashes rather than plaintext passwords.
• Preparation information: target roles, level, job descriptions, skills, career profiles, stories, schedules, technical workspaces and practice preferences.
• Interview information: answers, conversation transcripts, generated questions, feedback, scores, reports and practice history. Voice features process audio as part of the conversation and can produce transcripts.
• CV uploads: the PDF you choose to upload and the career information extracted from it.
• Support and billing references: messages you send us, transaction/subscription identifiers, credit balances and payment status. Payment details are collected by Paddle's checkout; MockReps does not ask you to send full card numbers.

Please provide only what is useful for preparation. Avoid confidential employer information, unnecessary personal information about other people, and sensitive information unrelated to the service.

3. Information from running the service

Hosting and security systems may process connection information such as IP addresses, browser information and requests. The application uses session identifiers and security/rate-limit information to authenticate users and protect the service. Operational events use limited metadata such as internal identifiers, timings, error codes and model/token counts.

Optional product analytics, if enabled, measure selected actions such as starting a session or viewing feedback. Raw CVs, answers, audio, authentication secrets and full AI prompts/responses are excluded from the application's analytics and log events. Our public website loads Google Tag Manager, which receives connection information such as your IP address and browser information when its resources are requested. See the Cookie and Storage Notice for browser storage and optional analytics.

4. Why information is used

• Provide your account, requested practice tools, personalisation, feedback and history.
• Send requested verification, password-reset and necessary account messages.
• Maintain credit entitlements and reconcile payment events received from Paddle.
• Investigate faults and support requests, prevent abuse and protect other users.
• Understand product usage where analytics is enabled lawfully.
• Meet applicable legal obligations and handle disputes or privacy requests.

Where a law requires a lawful basis, we rely on providing the service you request, applicable legal obligations, and legitimate interests in securing and maintaining the service where those interests do not override your rights. Where consent is required for optional processing or device storage, that processing must be offered with the required choice. You may withdraw such consent without cancelling unrelated necessary processing. Optional analytics remain disabled until the applicable settings and choices have been verified.

5. CV minimisation and AI processing

The original CV is held in private temporary storage for processing. Native text extraction is used first, with OCR where needed. The workflow removes unnecessary personal/contact details where possible and keeps a minimised career profile relevant to interview practice. Automated minimisation is not infallible, so review the information you choose to provide.

The workflow deletes the original after processing, including failure paths, and retries failed deletion. Storage expiry is a fallback for abandoned uploads, not an exact 24-hour erasure guarantee. Your structured profile and practice records have a different lifecycle from the original PDF.

Relevant profile information, job descriptions, questions, answers and voice content may be sent to the configured AI provider to deliver a feature you request. AI outputs can be inaccurate. They are practice guidance, not decisions about your employment or eligibility. MockReps does not use your practice score to decide whether an employer should hire you.

6. Service providers and sharing

Providers receive the information needed for their functions, subject to their applicable service terms and data-processing arrangements:

• Amazon Web Services: application hosting, PostgreSQL, temporary/file storage, infrastructure security and transactional email through SES. The application database is planned for the US East (Northern Virginia) region.
• Cloudflare: public-site hosting, DNS, proxy/security and email routing where enabled.
• OpenAI: configured AI and voice features. Anthropic may be used if selected for supported AI operations; activation requires confirming the corresponding processing arrangements.
• Paddle: checkout, payment administration, fraud prevention, receipts, tax handling and transaction support under its own Privacy Policy.
• Axiom: limited application operational logs when connected.
• Google: Tag Manager on the public website. See Google's Privacy Policy.
• PostHog: optional, limited product analytics when lawfully enabled.
• Email inbox provider: support and privacy correspondence may be delivered through the operator's configured inbox service.

We do not sell your CV or interview answers. Information may also be disclosed where required by law, necessary to protect rights or security, or as part of a genuine transfer of the service with required safeguards and notices. A change of operator is not permission to repurpose your information without a lawful basis.

7. International processing

MockReps operates from Sri Lanka and uses infrastructure and providers that can process information in other countries, including the United States. Accessing the service does not mean all information stays in your country. Where applicable law requires a transfer mechanism or additional safeguards, the operator must arrange and maintain them with the relevant providers. Contact us for information about the arrangements applicable to your account.

8. Retention and deletion

Account and practice information is normally kept while you use your account so you can return to your history. It can be removed through available product controls or an account/privacy request. Original uploaded CVs follow the temporary deletion process above. We do not represent account history as having the same short retention period as the uploaded file.

The prepared database backup window is seven days; deleted records can remain in backups until those backups expire. Router diagnostic logs have a 14-day retention configuration. Other operational/provider records are retained only for their documented support, security, billing or legal purpose, under the retention settings verified for the production service. Optional analytics must have a defined retention and erasure process before activation.

Account deletion removes owned profile and practice records through the application workflow. Billing obligations and storage cleanup may need to be resolved before completion. Paddle and other providers can retain records under their own legal obligations. We retain the minimum necessary information when a law, dispute or security investigation requires a longer period and restrict its use to that purpose.

9. Your choices and requests

Depending on the law applicable to you, you may have rights to access, correct, delete or receive a copy of personal data, object to or restrict processing, withdraw consent, or complain to the appropriate regulator. Contact privacy@mockreps.com to make a request or ask which rights apply. We may verify your connection to the account proportionately and will respond within the time required by applicable law.

You may contact the Data Protection Authority of Sri Lanka for information on Sri Lankan data-protection rules and available procedures. Where another jurisdiction's privacy law applies, you may also have rights before its regulator. This notice does not claim a certification or promise that every jurisdiction's rights apply identically.

10. Children, security and changes

The service is intended for adults aged 18 or older. If you believe a child has supplied personal information, contact us. We use access controls, protected credentials, encrypted transport and scoped provider access, but no service can promise absolute security.

We will update this notice when relevant handling or operator details change, identify the effective date and provide additional notice or choices where required. Read the Terms of Service and Refund and Cancellation Policy for product-use and payment information.