Privacy Policy

Effective: October 31, 2026

1. Who this policy covers, and who we are

This policy explains what Tutela ("we," "us") collects when you use usetutela.app, why, and who it goes to. We are Vocify LLC, 1021 East Lincolnway, Cheyenne, WY 82001, United States.

2. What we collect

Account information. When you sign up — either with an email and password, or through your GitHub, Google or Apple account — we receive your email address and name (first and last, where provided). We do not require a profile photo and do not collect one.

If you reach us through an organisation's invite, we do not separately collect your email or name for that purpose: the organisation's own identity system authenticates you, and we receive only an opaque identifier for you and the organisation, not your contact details.

Session content. Each mock interview produces: a text transcript of the conversation, any code you write during the session, and AI-generated feedback tied to specific moments in the transcript. Your voice is processed live — sent to our speech-to-text and text-to-speech providers to run the conversation in real time — but we do not record or store audio or video: nothing is saved as a media file, only the resulting text. We may record and store session audio or video in the future, and we expect to. If we do, we will update this policy first, before recording applies to your sessions.

Payment information. We do not collect or store your card details — Stripe collects those directly. We store the fact that a purchase happened: an internal transaction record, the amount in credits, and Stripe's own event identifier for that purchase, tied to your account.

Usage and technical data. We use two cookies to keep you signed in: one holds your session identity and is not readable by scripts on the page; the other simply tells the page when your session expires. Neither is used for tracking or advertising, and we do not use any third-party analytics or advertising cookies.

3. How we use it

  • To run the Service: authenticate you, run your interview session, generate your feedback, and show you your own history.
  • To process payments and maintain your credit balance.
  • To provide usage confirmation (not content) to an organisation that sponsored your session.
  • To improve our interview problems: we review session content (transcripts, code and feedback) to refine the questions and exercises we offer.

4. Who we share it with

We share data with the following providers, each acting on our instructions to run the Service:

  • Stripe — processes payments. Receives only an internal transaction identifier from us (never your card details); Stripe collects your payment details directly under its own terms.
  • GitHub, Google and Apple — if you choose to sign up or log in with one of these accounts, that provider confirms who you are and shares your email address and name with us. Apple may give us a private relay email address instead of your real one. We never receive your password for those accounts. These providers act under their own privacy policies as independent services you choose to use, not as our subprocessors.
  • Anthropic — generates the AI interviewer's responses and your post-session feedback, and so receives your session transcript. By default, Anthropic does not use commercial API inputs or outputs to train its models; a Data Processing Agreement and Zero Data Retention are available.
  • Deepgram — converts your spoken responses to text during a session (speech-to-text), and so receives the audio of your answers. Under Deepgram's standard terms, which apply to our account, Deepgram may keep samples of processed audio to improve its models. Tutela itself does not store your audio.
  • Cartesia — converts the interviewer's responses to speech (text-to-speech). It receives only the interviewer's words, never your voice. We use Cartesia's standard plan, which does not include Zero Data Retention, so Cartesia may keep what it processes under its own terms.
  • Cloudflare — provides network and hosting infrastructure for the Service, and receives email sent to our addresses.
  • Civo — hosts our core servers and databases, where your account and session data are stored.
  • Resend — sends our emails to you, and so receives your email address and the content of those emails.

We do not sell your data, and we do not share session transcripts or feedback with an organisation that sponsored your session — only confirmation that a session occurred and its credit cost.

5. How long we keep it

Your login session expires automatically after 30 days of inactivity, and is deleted the moment it expires — it cannot be extended past that point by anything other than continuing to use the Service. Each time you use the Service your session is refreshed for another 30 days; your short-lived access token (5 minutes) is separate and renews far more often behind the scenes.

Your session content (transcript, code, feedback) and your purchase history are kept indefinitely today — there is no automated deletion, retention period, or scheduled purge for either.

6. Your rights

You can ask us to access, correct, or delete your data by contacting support@usetutela.app. The Service does not offer a self-service way to delete your account or download your data, so we handle every request manually through that address.

If you are in the EU, EEA or UK. The GDPR (or the UK GDPR) applies to how we handle your data. You can access, correct, delete or export your data, restrict or object to how we use it, and withdraw consent where we rely on it. Our legal bases are: our contract with you (your account, sessions, feedback and purchases); our legitimate interests (keeping the Service secure and running reliably, and improving our interview problems); legal obligations (keeping payment records for tax); and your consent, where we ask for it. You can also complain to your local data protection authority.

If you are in Nigeria. The Nigeria Data Protection Act 2023 gives you similar rights to access, correct, delete and move your data and to object to how we use it. You can complain to the Nigeria Data Protection Commission.

If you are elsewhere. Where your local privacy law gives you further rights, we will honour them. Contact support@usetutela.app.

7. Children's privacy

The Service is not directed at anyone under 16, and we do not knowingly collect data from anyone under that age.

8. International data transfers

We are based in the United States, and your data is processed there and wherever the providers in section 4 operate. When we transfer personal data out of the EU, EEA or UK, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum for UK data) or another lawful transfer mechanism.

9. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version here and change the "Effective" date at the top.

If a change is material, we will tell you by email and with a notice in the Service at least 30 days before it takes effect. Material changes include a new way we use your data, a new category of data we collect (such as session audio or video), or a new kind of provider we share it with.

Where the law requires your consent for a change, we will ask for it rather than treat continued use as agreement. Otherwise, if you keep using the Service after a change takes effect, the updated policy applies to you. If you do not agree with a change, you can stop using the Service and ask us to delete your data.

10. Contact

Questions about this policy, or general support: support@usetutela.app.