1. Who we are
CS Interview Coach is an independent business based in the United Kingdom.
Data controller: CS Interview Coach
Contact: customerservice@csinterviewcoach.com
We are the data controller for personal data you provide when using CS Interview Coach. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data we collect and why
Account information
When you create an account we collect:
- Email address — to identify your account and send transactional emails (e.g. password reset)
- Name (if provided) — to personalise your experience
Lawful basis: Performance of a contract (Article 6(1)(b) UK GDPR).
Practice sessions and your answers
When you use the service we collect:
- Interview session records — questions attempted, competency framework, grade selected
- Answer text — the written answers you submit for AI evaluation, stored verbatim
- Scores and AI feedback — the evaluation results returned for each answer
- Session timestamps and progress data
- A record of which downloadable guides you have opened
Lawful basis: Performance of a contract (Article 6(1)(b)) for core functionality; Legitimate interests (Article 6(1)(f)) for service improvement.
Answers are free text. You should not include the names of third parties, case references, or information subject to a confidentiality or security obligation. Answer text is transmitted to Anthropic for AI scoring; see Sections 5 and 6.
Payment information
Payments are handled entirely by Stripe. We do not see or store your card number, CVV, or bank details. We receive from Stripe only your name as entered at checkout and a Stripe customer reference, so we can manage your subscription or lifetime access.
Lawful basis: Performance of a contract (Article 6(1)(b)); Legal obligation (Article 6(1)(c)) for retaining transaction records.
Marketing emails
Where you register an account we send a limited sequence of emails concerning use of the service and our paid plans, together with periodic updates. Each carries a one-click unsubscribe link. Unsubscribing takes effect immediately and permanently.
Lawful basis:Legitimate interests (Article 6(1)(f)) in marketing our own similar services to existing and prospective customers, relying on the “soft opt-in” in regulation 22 of PECR. You may object at any time, by unsubscribing or by emailing us.
Civil Service Jobs Tracker
You can use the jobs tracker, save vacancies and searches, and receive job alerts without creating a full account. If you do, we collect:
- Your email address, and the alert and tips preferences you selected
- The vacancies and searches you save
- A record of the alert emails we have sent you, and when you unsubscribed if you did
- Your IP address, briefly, to rate-limit abuse of the sign-up endpoint
We set a signed, server-only cookie (cst_subscriber, one year) to identify you on return and display your saved items. It contains no personal data beyond an identifier and is not readable by scripts in your browser.
Lawful basis: Consent (Article 6(1)(a)) for the alert and tips emails; Legitimate interests (Article 6(1)(f)) for keeping your saved items available and for rate limiting.
Cookies, analytics and advertising
We use essential cookies for authentication and session security. With your consent we also load analytics and advertising tags, and share a one-way hashed version of your email address, together with your IP address and browser user agent, with Reddit so it can measure which of our ads led to sign-ups. See our Cookie Policy for full details, including how to withdraw consent.
When you sign up we also record the advertising click identifier from the URL you arrived on, your IP address and your browser user agent, so a later conversion can be attributed to the right ad. This is only sent onward if you have accepted advertising cookies.
Lawful basis: Consent (Article 6(1)(a)) for all non-essential cookies, analytics and advertising; Legitimate interests (Article 6(1)(f)) for essential session cookies and security.
When you contact us
If you email us or use the contact or cancellation-feedback forms, we keep your message and the address you sent it from so we can reply and keep a record of the issue.
Lawful basis: Legitimate interests (Article 6(1)(f)) in responding to enquiries and improving the service.
3. How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Account information | While your account is open; deleted within 30 days of you asking us to close it | Operate the service |
| Practice sessions, answers, AI feedback and scores | While your account is open; deleted within 30 days of you asking us to close it | Provide session history and progress tracking |
| Payment records (Stripe reference, name, transaction) | 6 years from the transaction date | Legal obligation — accounting and tax records |
| Jobs tracker subscription, saved vacancies and searches | Until you unsubscribe or ask us to delete them | Send the alerts you asked for |
| Unsubscribe and email-suppression records | Kept indefinitely after you unsubscribe | So we can honour your objection and not email you again |
| Correspondence with us | 2 years from the last message | Handle follow-up queries and disputes |
| Cookie consent record | 6 months, in your browser's localStorage | Record your choice and re-ask when it expires |
Where retention is based on a legal obligation, data is kept for the minimum period required and then securely deleted.
4. Who we share your data with
We do not sell your personal data. We share it only with the providers listed in Section 5, and only to the extent necessary to operate the service.
We may disclose personal data if required to do so by law, by court order, or in connection with any legal proceedings.
5. Processors and third parties
| Provider | Role and what they receive | Location | Privacy information |
|---|---|---|---|
| Supabase | Database and user authentication. Stores your account details, session records, answers, scores and tracker subscriptions. | EU (AWS eu-west-2) | supabase.com/privacy |
| Anthropic | AI scoring. Your answer text and the question are sent to the Claude API to generate feedback. No name, email or account identifier is sent with it. Anthropic does not use API inputs to train its models, and retains inputs for a limited period for trust and safety purposes. | United States | anthropic.com/privacy |
| Stripe | Payment processing. Handles all card transactions; receives your email and name. We never receive your card details. | United States / EU | stripe.com/privacy |
| Resend | Email delivery. Receives your email address and the contents of the emails we send you. | United States | resend.com/legal/privacy-policy |
| Vercel | Hosting. Serves the web application and processes request logs, including IP addresses. | United States / EU edge | vercel.com/legal/privacy-policy |
| Advertising measurement — only with your consent. Receives a one-way hashed version of your email address and account identifier, and your IP address and browser user agent in readable form, so it can match a sign-up or purchase to an ad click. | United States | reddit.com/policies/privacy-policy | |
| Google Ads and Google Analytics — only with your consent. Receives usage and conversion data associated with advertising identifiers. | United States | policies.google.com/privacy |
6. International transfers
Several of the providers above are based in, or transfer data to, the United States. Where personal data leaves the UK we rely on the UK International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as incorporated into each provider's terms — and, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework.
You can request details of the specific transfer mechanism used for any provider by contacting us at customerservice@csinterviewcoach.com.
7. Automated processing
Practice answers are scored automatically by an AI model. This does not constitute a decision producing legal effects concerning you, or similarly significantly affecting you, within the meaning of Article 22 UK GDPR: the output is practice feedback, it has no bearing on any actual application, and it is not disclosed to any employer or recruiter.
AI scoring may be inaccurate. Where you consider a score or item of feedback to be wrong, contact us and we will review it.
8. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — ask us to delete your personal data (subject to legal retention obligations).
- Right to restriction — ask us to restrict how we process your data in certain circumstances.
- Right to data portability — receive your personal data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests, including direct marketing. Where you object to direct marketing we will always stop.
- Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
How to exercise your rights
Email customerservice@csinterviewcoach.com with the subject line “Data rights request” and describe your request. We will respond within one calendar month and we do not charge for this. We may ask you to verify your identity first.
To close your account and have your data deleted, use the subject line “Close my account”. We will confirm on completion.
Right to complain
You have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would ask that you raise the matter with us first.
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encrypted data storage, HTTPS for all data in transit, row-level security policies on our database, and access controls limiting who can view user data.
No system can be guaranteed secure. Where we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk to you is high, inform you without undue delay.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email or via a notice on the service. The “Last updated” date at the top of this page always reflects the most recent revision.
11. Contact
For any questions about this Privacy Policy or how we handle your data, contact us at: customerservice@csinterviewcoach.com