ff703b_feeb58edfb1c4bb49ae700bf0745e24c_mv2__1_-removebg-preview.png

PRIVACY POLICY

Last updated: 21 October 2026 – v1.0

1. Who We Are and How to Contact Us

AstravaTechnologies SARL-S is a simplified limited liability company (société à responsabilité limitée simplifiée) incorporated and existing under the laws of the Grand Duchy of Luxembourg, registered with the Luxembourg Trade and Companies’ Register (Registre de Commerce et des Sociétés, Luxembourg) under number B307446, having its registered office located at 6A Avenue des Hauts-Fourneaux, L-4362 Esch-sur-Alzette, Grand Duchy of Luxembourg, incorporated in May 2026.

We develop and operate uinterview, an AI-powered interview coaching platform that helps individuals prepare for job interviews through real-time, adaptive AI-driven practice sessions.

For the purposes of Regulation (EU) 2016/679 of 27 April 2016, as may be amended from time to time, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), AstravaTechnologies acts as the Data Controller for the personal data processed through the uinterview platform, except where a third party acts as an independent controller for its own processing as described in Section 6.2. We determine the purposes and means of processing your personal data as described in this Policy.

For any questions about this Policy or about how we process your personal data, please contact us at privacy@uinterview.ai .We aim to acknowledge privacy enquiries within 5 business days and to respond within one calendar month.

2. Definitions

The following terms are used throughout this Policy with the meanings set out below. Capitalised terms used but not defined in this Policy (such as “Service” and “User Content”) have the meaning given to them in our Terms of Use.

3. Personal Data We Collect

We collect personal data when you register, use the uinterview platform, and interact with our services. The categories of personal data we collect are described below. This list reflects our current processing activities; not all categories will apply to every user.

3.1 Account and Identity Data

When you register for an account, we collect:

Full name (first name, last name, and optional display name)
Email address (normalised to lowercase for deduplication)
Password - submitted during registration and immediately hashed using an industry-standard salted key-derivation algorithm. Your raw password is never stored or transmitted beyond the initial processing layer.
Google OAuth profile data (if you choose to register using Google Sign-In): email address, display name, and profile photo URL provided by Google
Country (detected from your network connection via Cloudflare headers)
IP address (collected at registration for security logging)
Consent records: the date, time, and version of the Privacy Policy you acknowledged and, as applicable, your optional consents (e.g. marketing communications, analytics)

3.2 CV, Job Description, and Interview Setup Data

When you prepare for an interview session, we collect:

CV / Résumé file: the document you upload (PDF, DOCX, or other supported formats)
Parsed CV data: structured data extracted from your CV, including professional experience, skills, and educational background
Job description: the job posting text or file you upload to contextualise the coaching session
Interview session preferences: target role, company name, country, and session configuration
Generated interview questions: AI-generated questions tailored to your CV and target role

3.3 Interview Session and AI Processing Data

During and after an interview practice session, we collect:

Live audio: your spoken interview responses are captured in real time via WebRTC and streamed to our interview processing pipeline for transcription. Audio is not stored - only the text transcript is retained.
Interview transcript: the text output of real-time speech-to-text transcription of your spoken answers
AI-generated scores and feedback: performance ratings, qualitative feedback, gap analysis, and coaching recommendations generated by our AI system based on your transcript
Session metadata: session status, start and end timestamps, duration, and session identifiers
PDF coaching report: a formatted PDF summary of your session performance, scores, and recommendations

3.4 Payment and Billing Data

When you purchase a subscription or credit pack, we collect:

Subscription plan and status (Free, Pro, Elite Pack 1 or Elite Pack 2)
Stripe customer reference (an identifier linking your account to your Stripe billing profile)
Billing-related events (subscription creation, renewal, cancellation, payment confirmation)

We do not store your payment card details. Payment card data is entered directly into Stripe's secure payment interface and is processed by Stripe, Inc., which is an independent data controller for payment instrument data. AstravaTechnologies never receives or stores raw card numbers, CVV codes, or full card data.

3.5 Technical and Usage Data

To operate and improve the platform securely, we collect:

Security event data: login attempts, outcomes, IP addresses, country, browser/device information, and timestamps - stored with your email address hashed (not in plaintext)
Platform usage events: pseudonymised (GDPR Art.4(5)) records of how you interact with the platform (e.g., pages visited, features used, session start/end) linked to your user identifier, not your name or email
Audit logs: records of administrative actions affecting your account (restricted to authorised staff)
Error and diagnostic data: application errors and exceptions reported to our error monitoring service, with authentication tokens and session identifiers stripped before transmission

3.6 Special Category Data

We do not intentionally collect special category personal data (as defined in GDPR Art.9) such as health data, biometric data, racial or ethnic origin, political opinions, or religious beliefs. However, your spoken interview responses (transcript) or CV may incidentally contain such information if you choose to disclose it. Where this occurs:

We do not use incidentally received special category data for any purpose other than the interview coaching service you have requested
We do not profile you on the basis of any incidentally received special category data

We recommend that you do not include special category data in your CV or interview responses. If you choose to do so, we process it solely to provide the coaching service you requested, on the basis of your explicit consent (GDPR Art.9(2)(a)), which you may withdraw at any time by deleting the relevant content

4. How and Why We Use Your Data (Purpose and Legal Basis)

We process your personal data only where we have a lawful basis to do so under GDPR Art.6. The table below sets out each processing purpose, the personal data involved, and the legal basis that applies.

Where a processing purpose below is based on GDPR Art.6(1)(b) contract performance, providing the related data is a contractual requirement (GDPR Art.13(2)(e)): without it (e.g., your CV for CV/résumé processing, or your email for account registration), we cannot provide the corresponding feature or the Service as a whole. Where a purpose is based on consent, providing the data is optional and declining it only affects the optional feature concerned (e.g., marketing communications).

4.1 Consent - How We Obtain and Process It

Where our legal basis is consent (Art.6(1)(a)), we will:

Ask for your consent separately and specifically (GDPR Art.7(2)) - consent for marketing is collected as a distinct, optional step at registration, separate from your acknowledgement of this Privacy Policy and your acceptance of our Terms of Use
Not bundle consent - acknowledging this Privacy Policy or accepting our Terms of Use does not constitute consent to marketing or optional analytics processing
Record your consent: we record the date, time, IP address, and version of the policy at the time of consent (GDPR Art.7(1))

4.2 Provide an easy withdrawal mechanism: you may withdraw consent at any time via your account Privacy & Data settings, or by emailing

. Withdrawal does not affect the lawfulness of processing carried out before withdrawal (GDPR Art.7(3)).Legitimate Interests - Summary

Where we rely on legitimate interests (Art.6(1)(f)), we have conducted a Legitimate Interests Assessment (LIA) for each purpose. Our key legitimate interests are:

Platform security and fraud prevention: protecting the integrity and availability of the platform and detecting fraudulent or malicious activity. Processing is limited to security event metadata; no content data is accessed for this purpose.
Product analytics: understanding how the service is used in aggregate to improve features and diagnose technical issues. All analytics data is pseudonymised using a user identifier rather than your name or email.

LIA documentation is available on request from privacy@uinterview.ai. If you believe your interests override our legitimate interests in any particular context, you may object at any time (GDPR Art.21(1); see Section 11).

5. AI Processing and Automated Decision-Making

5.1 How AI Is Used in the uinterview Platform

uinterview uses an AI system to deliver its core coaching service. The AI system is provided by Google LLC via its Gemini large language model, accessed through a European Union-specific endpoint via Cloudflare AI Gateway. Prompt logging is disabled in our AI gateway and we do not retain AI conversation logs and do not use your personal data or User Content to train, fine-tune or improve AI models. Any temporary retention by the AI provider (e.g. for abuse monitoring) is limited to what is permitted under our agreement with it.

The AI system is used for the following functions:

Parsing and analysing your CV and the target job description to identify relevant skills, experience, and potential gaps
Generating contextualised interview questions tailored to your background and the target role
Scoring your interview responses against role-specific competencies
Generating qualitative feedback, gap analysis, and coaching recommendations

5.2 Transparency About AI - EU AI Act Art.50

In accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689), we inform you that:

The scoring, feedback, and gap analysis you receive are generated by an AI system, not by a human evaluator
The AI system analyses your interview transcript and CV data to produce its outputs
AI-generated outputs are coaching tools to support your preparation - they are not a definitive assessment of your professional capabilities

Important: AI Outputs Are Not Employment Decisions

The uinterview platform is an interview preparation and coaching tool. AI-generated scores and feedback do not constitute, and are not used as, employment decisions. AstravaTechnologies does not share your AI-generated coaching reports with employers, Sponsors or third parties, except at your request or with your prior explicit consent or where required by law, in which case this is expressly disclosed to you and lawfully agreed.

uinterview is currently designed for user-side interview preparation rather than employer-side recruitment or selection decisions. If the Service is later used to make or materially support employment decisions on behalf of employers, AstravaTechnologies will reassess the applicable EU AI Act and GDPR classification and update this Policy before that use is introduced.

5.3 Automated Processing and Your Rights

The current uinterview consumer coaching service is not intended to make decisions that produce legal effects concerning you or similarly significantly affect you. Accordingly, GDPR Article 22 is not generally expected to apply to ordinary coaching scores and feedback. If the way the Service is used changes so that solely automated processing produces legal or similarly significant effects, we will provide the information and safeguards required by applicable law.

You may nevertheless contact us if you believe an AI-generated assessment is inaccurate, unfair, or based on incorrect personal data. Where applicable, you may exercise your rights of access, rectification, erasure, restriction, objection and other rights described in Section 11.

We can also provide information about the main factors used to generate coaching outputs, such as your interview transcript, target role or competency context, and relevant experience data, subject to protection of confidential information, security and intellectual property.

To raise an AI-assessment concern, contact privacy@uinterview.ai with the subject line 'AI Assessment Review Request'.

5.4 PII Stripping Before AI Transmission

Before your CV content is transmitted to the AI provider for processing, we apply a PII stripping process, in line with the principles of data minimisation and data protection by design (GDPR Art.5(1)(c) and Art.25), to remove direct personal identifiers from the content - including your name, email address, telephone number, home address, and personal web links. This means the AI model receives the substance of your professional experience without your identifying contact details.

Note: PII stripping is applied to CV-derived content sent to the AI. Your interview transcript is transmitted with user-linkable identifiers stripped, but may contain personal disclosures made during the session.

6. Data Sharing - Who Receives Your Data

We do not sell your personal data. We do not share your personal data with advertisers or use it for third-party advertising purposes. We share personal data only with the following categories of recipients (GDPR Art.13(1)(e)), and only as necessary for the purposes described in this Policy.

6.1 Data Processors

The following third parties process personal data on our behalf as Data Processors under Data Processing Agreements (DPAs) compliant with GDPR Art.28. They act on our instructions and may not use your data for their own purposes.

We maintain this table as the current record of our processors. Where we add a new processor or sub-processor that will handle your personal data, we will update this Policy and, for material changes, notify you in accordance with Section 13.

6.2 Independent Data Controllers

The following parties receive personal data and act as independent data controllers for their own processing activities:

6.2 Independent Data Controllers

The following parties receive personal data and act as independent data controllers for their own processing activities:

6.3 Legal Disclosures

We may disclose personal data where required by law or in response to a valid legal process (GDPR Art.6(1)(c)), including:

A court order, subpoena, or other binding legal instrument issued by a competent authority in Luxembourg or the EU
A regulatory requirement from the CNPD or another EU supervisory authority
Where we believe in good faith that disclosure is necessary to prevent imminent serious harm or to protect the rights and safety of individuals (GDPR Art.6(1)(d) and (f))

Where we are legally permitted to do so, we will notify you before disclosing your personal data in response to a legal demand.

6.4 Institution Sponsored Access

Where a university, educational institution, employer, public body or other organisation (a “Sponsor”) pays for or arranges your access to uinterview, AstravaTechnologies remains the controller of the personal data processed through your account. The Sponsor does not act as our processor and has no access to your account.

Data we do not share. We do not share with a Sponsor your CV, job descriptions, interview transcripts, AI-generated scores, feedback or coaching reports, or any other content of your sessions.
Data we may share. To administer the sponsored access and verify the use of the licences it has paid for, we may share with the Sponsor: (i) confirmation that your sponsored account has been activated, together with the email address used for the invitation; and (ii) aggregated statistics that do not identify you. This sharing is based on our and the Sponsor’s legitimate interest in administering the sponsored access (GDPR Art.6(1)(f)). The Sponsor processes this information as an independent controller under its own privacy notice. You may object to this sharing at any time (see Section 11).
Sharing at your request. Any other sharing with a Sponsor, for example sending a coaching report to your career service, will only take place at your request or with your prior explicit consent, which you may withdraw at any time.
Data received from the Sponsor. Where the Sponsor provides us with your name and email address to invite you, we use them only to send the invitation and set up your sponsored access (GDPR Art.6(1)(f)).
Restrictions. The Sponsor is contractually prohibited from using any information received from us to evaluate, grade, rank or take decisions concerning you.

Sponsor-related records are kept for the duration of the institutional agreement and 12 months thereafter.

6.5 Business Transfers

If AstravaTechnologies is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy.

7. International Transfers of Personal Data

AstravaTechnologies’ primary data processing infrastructure is located within the European Union / European Economic Area (EU/EEA). Specifically, our primary database and interview pipeline are hosted on Hetzner servers in Germany, and our file storage and session state are maintained in Cloudflare's EU jurisdiction infrastructure.

The following processors operate EU-specific endpoints, meaning your data is processed within the EU when transmitted to them, subject to the exception noted below:

Google Gemini (AI): accessed via a dedicated EU-region endpoint through Cloudflare AI Gateway; where the Gemini EU region is overloaded, certain non-live requests may be retried in Google's US region (see the transfer table below)
Deepgram (speech-to-text): accessed via the EU-specific endpoint wss://api.eu.deepgram.com

The following recipients receive personal data outside the EU/EEA. These transfers are covered by appropriate safeguards under GDPR Chapter V (Art.44 to 49):

For transfers relying on Standard Contractual Clauses, we have conducted a Transfer Impact Assessment (TIA) to evaluate whether US surveillance laws undermine the SCCs' protections in relation to the data transferred. The TIA documentation is available on request from privacy@uinterview.ai .

Some of our processors (including Cloudflare, Inc., Google LLC, Deepgram, Inc., PostHog, Inc., Microsoft and ElevenLabs) are US-headquartered. Where personal data may be accessed from outside the EU/EEA (for example for support or security purposes), such access is covered by the EU-US Data Privacy Framework where the recipient is certified (GDPR Art.45), or by Standard Contractual Clauses (GDPR Art.46(2)(c); Commission Implementing Decision (EU) 2021/914) together with supplementary measures where required.

Your Rights Regarding International Transfers

You may request a copy of the safeguards we have put in place for international transfers (GDPR Art.13(1)(f) and Art.15(2)) by contacting privacy@uinterview.ai. If you have concerns about a specific transfer, you may lodge a complaint with the CNPD (see Section 14).

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected (storage limitation principle, GDPR Art.5(1)(e)), subject to legal retention obligations. The table below sets out our specific retention periods by data category.

Following the expiry of the relevant retention period, personal data is securely deleted or anonymised. Where we are required by law to retain personal data beyond the period for which it would otherwise be held, we will restrict active processing of that data to the extent possible.

9. How We Protect Your Data

We implement appropriate technical and organisational security measures in accordance with GDPR Art.32 to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our current security measures include:

9.1 Technical Measures

Encryption in transit: all data transmitted between your browser and the uinterview platform is encrypted using TLS 1.3 / HTTPS. All connections to third-party processors (including Google, Deepgram, Stripe, PostHog EU Cloud, Microsoft Azure and ElevenLabs) are TLS-encrypted.
Password hashing: passwords are hashed using an industry-standard salted key-derivation algorithm. A timing-safe comparison algorithm is used to prevent timing attacks. Raw passwords are never stored.
Session security: access tokens are short-lived JWTs (15-minute TTL) stored in browser memory only (not cookies or localStorage). Refresh tokens are stored as HttpOnly, SameSite=Strict cookies and are hashed server-side in Cloudflare Durable Objects (EU jurisdiction).
Encryption at rest: files stored in Cloudflare R2 (EU) use provider-managed encryption at rest. Cloudflare Durable Objects (EU) apply provider-managed encryption.
Access controls: role-based access control (RBAC) ensures users can access only their own data. Administrative access is restricted to a defined allowlist.
Database security: the primary Postgres database is accessible only via server-side application code using parameterised queries (Drizzle ORM) to prevent SQL injection. The database is not publicly accessible.
AI Gateway controls: AI processing via Google Gemini is routed through Cloudflare AI Gateway with BYOK (Bring Your Own Key) configuration and prompt logging disabled.
Network protection: Cloudflare provides edge TLS termination, DDoS protection, and Worker isolation. WAF managed rules and rate limiting are applied to the API endpoints.

9.2 Organisational Measures

We assess the data protection and contractual arrangements applicable to third-party service providers used by uinterview, including Cloudflare, Hetzner, Google, Deepgram, Microsoft Azure,
ElevenLabs and PostHog EU Cloud, and seek to ensure that appropriate agreements and safeguards are in place where required under applicable data protection law.
Access to personal data is restricted to personnel who need it to perform their role
All admin and engineering access to production systems is logged in audit logs retained for 12 months
Security events (login attempts, anomalous activity) are logged and monitored
Database backups are taken daily (retained 30 days) and monthly (retained 12 months). Backup integrity and restore capability are tested annually.

9.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the CNPD without undue delay and, where required, within 72 hours of becoming aware of the breach (GDPR Art.33).
Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay (GDPR Art.34), describing the nature of the breach, the data affected, likely consequences, and the measures we are taking to address it.

10. Cookies and Tracking Technologies

We use cookies and similar technologies when you use the uinterview platform. In accordance with the Luxembourg Law of 30 May 2005 relating to the protection of persons with regard to the the processing of personal and the protection of privacy in the electronic communications sector, and also implementing the Directive (2002/58/EC) of 12 July 2002 concerning the processing of personal and the protection of privacy in the electronic communications sector, we obtain your consent (within the meaning of GDPR Art.4(11) and Art.7) before placing any non-essential cookies.

You will be presented with a cookie consent interface before any optional cookies are placed. You can manage and update your cookie preferences at any time through the cookie settings link available in the footer of our website and, for logged-in users, in your account settings under Privacy & Data, or by contacting us at privacy@uinterview.ai. We also use Cloudflare's cookieless page analytics, which does not place cookies on your device. We do not use third-party advertising cookies. Other than the optional analytics cookies described above (including Google Analytics, implemented via Google Tag Manager), which are placed only with your consent, we do not allow third parties to place tracking cookies on your device through our platform.

11. Your Rights as a Data Subject

As a data subject whose personal data we process, you have the following rights under the GDPR. We will respond to all rights requests within one calendar month of receipt (GDPR Art.12(3)). This period may be extended by up to two further months where the request is complex or numerous, in which case we will notify you within the initial month.

There is no charge for exercising any of these rights. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act (GDPR Art.12(5)) - we will explain our reasons in writing.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or our business operations. The version number and 'Last Updated' date at the top of this Policy indicate when it was last revised.

Where we make material changes - changes that affect the purposes for which we process your data, the legal basis, the categories of data shared, or your rights - we will:

Notify you by email to the address associated with your account at least 30 days before the changes take effect
Display a prominent notice on the platform
Where the change requires a new legal basis or new consent, we will obtain that consent before the change applies to you in accordance with article 13(3) of the GDPR

Continued use of the platform after the effective date of a non-material change does not constitute consent to the changed processing. For material changes requiring new consent, we will obtain that consent explicitly.

12. Children's Privacy

The uinterview platform is not intended for use by individuals under the age of 16. In accordance with GDPR Art.8 as implemented in Luxembourg (minimum age 16 for consent to information society services), we do not knowingly collect or process personal data from children under 16.

If you are under 16, please do not use the uinterview platform or provide any personal data to us. If you believe that a person under 16 has provided us with personal data without parental consent, please contact us immediately at privacy@uinterview.ai and we will take steps to delete such data.

At registration, users are required to confirm that they meet the minimum age requirement. If we later have reason to believe that a user is below the applicable minimum age, we may take proportionate steps to verify eligibility and, where appropriate, restrict or delete the account.

14. How to Contact Us and How to Complain

For any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact us:

14.1 Contact the Controller

14.2 Lodge a Complaint with the CNPD

If you are not satisfied with our response to your privacy concern, or if you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Luxembourg supervisory authority as detailed below:

You may also lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement if you are located in another EU/EEA member state.