Privacy Policy

1. What we collect

We collect only what is needed to provide the service:

• Account data: your email address and a securely hashed password (we never store your password in readable form).
• Your submissions: the profile, documents and text you provide for preparation - case study, summary of experience, CV - and the AI analysis derived from them.
• Practice data: your learning progress, quiz scores, interview transcripts and debriefs.
• Your referral report (optional): if you have already sat the assessment and were referred, you can tell us what your panel found so your practice aims at it. We store the competencies you confirmed you were referred on, with a short note against each, and nothing else: the file itself is read and discarded, never stored.
• Voice (optional): if you answer by voice, the recorded audio is processed only to produce a transcript (see section 4).
• Usage analytics: a small, content-free record of which step of the journey you reached (e.g. “started a demo”, “viewed a debrief”). It never includes your submission text, transcripts or any free text. Non-essential analytics only runs if you opt in via the cookie banner (see section 8).
• Operational/technical data: minimal logs and error reports needed to keep the service running and secure. We never include the content of your submissions or transcripts in logs, analytics or error reports.

2. Why we use it (lawful basis)

Under UK GDPR we rely on the following lawful bases. (Interboard is designed for candidates in the UK and the Gulf; equivalent local data-protection law may also apply to you.)

• Contract - to create and run your account and provide the preparation features you ask for (analysis, lessons, mock interview, debrief).
• Consent - for sending a submission to the AI provider (see section 3), for any optional voice processing, and for non-essential usage analytics. You can withdraw consent at any time; withdrawal does not affect processing already carried out.
• Legitimate interests - to keep the service secure, prevent abuse, and fix faults, balanced against your rights (we use the minimum data needed and never the content of your work for this).

3. AI processing & who receives your data

To analyse your submission, generate lesson content, run the mock interview and produce your debrief, the relevant text (and, if you use voice, your recorded audio) is sent to a third-party AI provider for processing. We ask for your explicit consent before a real submission is sent for analysis, and we recommend redacting confidential detail first (see section 5).

Training note: under our AI provider's current terms, submitted content may be used to improve its models. Treat the service as suitable for redacted or non-confidential practice material, and do not paste anything you are not comfortable sharing under those terms.

Beyond the AI provider, Interboard relies on a small set of processors that handle data strictly on our instructions:

• Cloud database & authentication provider - stores your account, submissions and practice data.
• Cloud hosting provider - application hosting and delivery.
• AI provider - the AI processing described above.
• Email provider - sends transactional email (verification, password reset). It sees your email address, not your submissions.
• Analytics & error tracking - the content-free usage analytics described in section 1 (first-party by default) and error reporting used only to keep the service running. Neither receives your submission content.

We do not sell your personal data, and we do not use it for advertising.

4. Voice data

If you answer by voice, your audio is sent to the AI provider only to produce a transcript and is not retained by Interboard beyond generating that transcript.

5. Redacting confidential detail

You rarely need real names or exact figures for effective practice - the panel cares about your reasoning and the technical substance. Before you paste a document, consider replacing identifying detail with placeholders:

• Client / employer / project names → [Client], [Employer], [Project].
• Exact figures → keep the magnitude, blur the precision (e.g. ~£14m).
• People's names, addresses and reference numbers → remove or replace.

We surface this same guidance at the point you submit a document, so it's easy to do before anything is sent for analysis.

Interboard does not need special category data (for example data revealing health, ethnicity, religion or similar) to help you practise. Please do not include it. If any appears in the material you submit, it is processed only as part of your submission under the consent you give in section 3.

6. How long we keep it (retention)

One rule per kind of thing we hold, so you can find yours without reading the rest.

• Your account. Your email address, a securely hashed password, and the settings you choose. Kept for as long as the account exists. Goes when you delete your account from Settings.
• Your documents. The case study, summary of experience and CV you give us, held as text. Kept for as long as the account exists. You can delete any one of them from Settings without touching the rest, and all of them go with the account.
• The analysis of them. The competency read, your lesson plan, and the questions built from your own material. Kept for as long as the documents it was built from are. It is rebuilt when you change a document, and cleared entirely once too little is left to question you on.
• Your practice history. Interview transcripts, debriefs, drill answers, module progress, the stories you save to your evidence bank, and any real interview you log: what you were asked, how it went, and the result. Kept for as long as the account exists. Your access window ending does not shorten this, so evidence for a guarantee claim is still there in the 60 days you have to make one. Goes when you delete your account.
• Your referral report. We store the competencies you confirmed you were referred on, with a short note against each, and nothing else: the file itself is read and discarded, never stored. Kept for as long as the account exists. You can remove it from Settings at any time, which also takes your prep back to standard, and it goes with the account.
• Voice. If you answer by voice, the audio is used to understand your answer and nothing is kept afterwards. Not retained. There is nothing to remove.
• Purchase and access records. What you bought, when your access window runs to, and any refund. Kept for as long as the account exists. Goes when you delete your account, with one exception: the record of a guarantee claim and the decision on it is kept for 24 months, with your identity removed from it.
• Anything you said about us. If you choose to give us a testimonial: the sentence you wrote, the credit level you picked, and the two readiness scores it was written about. Kept while your permission stands. You can withdraw it from Settings at any time, which deletes it and stops us using it anywhere, and it goes with the account.
• Usage analytics. Which step of the journey you reached. No submission text, no transcript, no free text of any kind. Kept in aggregate, and only collected at all if you accepted analytics in the cookie banner. Declining analytics stops it being collected.
• Operational logs. The minimum needed to keep the service running and secure, never the content of your work. Kept as long as security and troubleshooting need them, then rotated out. Rotation.

Your access window ending is not a deletion. When your access window ends you lose access to the features it bought. Nothing you hold is deleted. Your documents, transcripts, debriefs and readiness history stay in your account, and you can still export all of it at any time.

A claim under the guarantee is made within 60 days of your result, which is usually after your access window has ended. Your history is still there, and the export in Settings is never gated on an active window.

The guided demo runs entirely in your browser without an account and stores nothing, so there is no demo data to retain or delete.

7. Transport, storage & data residency

All traffic is encrypted in transit (TLS), and the datastore encrypts data at rest. We never include the content of your submissions or interview transcripts in application logs or analytics.

The hosting region of the datastore (for example UK, EU or Gulf) is chosen at deployment time, and some processors (such as the AI provider) may process data outside the UK. Where they do, the transfer is covered by an appropriate safeguard - an adequacy decision, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. If you have a data-residency requirement, contact us before you sign up so we can confirm the region.

8. Cookies & consent

We use a single, essential, HTTP-only session cookie to keep you logged in. It is strictly necessary for the service to work, so it is always on; you cannot opt out of it without being unable to use your account.

Non-essential analytics are off by default. The content-free usage analytics described above only run if you accept them in the cookie banner. You can decline (“essential only”) and still use everything. We use no advertising or third-party tracking cookies.

9. Your rights

You can, at any time and free of charge:

• Access & export all of your data as a file from Settings.
• Delete an individual document (for example, your case study) from Settings without deleting the rest of your account.
• Remove your referral report on its own from Settings, which clears the findings and takes your practice back to standard.
• Delete your account and all associated data permanently from Settings - this cannot be undone.
• Rectify inaccurate data (edit your profile and documents directly), withdraw consent (e.g. stop using AI features, decline analytics), and object or restrict processing.

One exception, stated plainly. If you make a claim under the guarantee, the record of that claim and the decision on it is kept as a financial record for 24 months from the decision. If you delete your account before then, your identity is removed from it: no name, no email, no account identifier. What remains is counts and dates, never your submission, your transcripts or the competencies you were referred on.

Your purchase itself is handled by our payment provider, which is the merchant of record for it. It keeps its own record of the transaction to meet its tax and accounting obligations, and that record is not ours to delete. It never contains any of your preparation material.

You also have the right to lodge a complaint with a supervisory authority - in the UK, the Information Commissioner's Office (ICO).

No automated decisions about you. Interboard does not make solely automated decisions that produce legal or similarly significant effects about you. Your readiness scores, verdicts and feedback are AI-generated practice guidance for your own preparation (see the Terms), not a decision made about you.

10. Contact for data requests

For any privacy request or question, contact us at support@interboard.co.uk. We aim to respond within one month, as UK GDPR requires.

11. Changes to this policy

We may update this policy; material changes will be reflected by the “last updated” date above. Continued use after a change means you accept the updated policy.