Privacy Policy

Last Updated: April 20, 2025

This Privacy Policy explains how ProVocis ("we," "us," or "our") collects, uses, shares, and safeguards your information when you access or use our websites, mobile applications, and any other online services (collectively, the "Services"). By accessing or using ProVocis, you confirm that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree with our practices, please refrain from using our Services.

1. Global Data Protection Compliance

ProVocis strives to comply with international privacy laws and frameworks. While we are not formally registered as a business entity at this time, we take all necessary precautions to protect user data under global regulations including but not limited to:

  • European Union: General Data Protection Regulation (GDPR)
  • United Kingdom: UK GDPR and Data Protection Act 2018
  • United States: California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA)
  • Canada: Personal Information Protection and Electronic Documents Act (PIPEDA)
  • Australia: Privacy Act 1988
  • India: Digital Personal Data Protection Act, 2023
  • Brazil: Lei Geral de Proteção de Dados (LGPD)
  • South Africa: Protection of Personal Information Act (POPIA)

We will make good faith efforts to honor any privacy laws in your jurisdiction.

Contact: support@provocis.com

2. Types of Personal Information We Collect

a. Account Data:

  • Email address (required for signup)
  • First name and last name
  • Full name (derived or user-provided)
  • User ID (auto-generated)

b. Profile Information:

  • Language preference (English/German)
  • Career goals/preferred role
  • Industry
  • Experience level
  • Onboarding completion status

c. Subscription & Billing Data:

  • Stripe customer ID
  • Stripe subscription ID
  • Subscription status (active/canceled)
  • Subscription end date
  • Payment history (amounts, currency, invoice URLs, payment status)
  • Pro subscription status (is_pro boolean)

d. Email Marketing Data:

  • Mailing list subscription status
  • Email verification status
  • Subscription source (maintenance page, etc.)
  • Unsubscribe tokens

e. Usage & Technical Data:

  • Audio data: Voice recordings temporarily processed for speech-to-text conversion
  • Email content: Draft emails processed by AI for enhancement (temporarily)
  • Session data: Authentication sessions and tokens
  • Metadata: Account creation/update timestamps
  • IP address, browser, OS, device type
  • Feature interactions, session logs
  • Analytics via Google Analytics and Vercel
  • Authentication logs via Supabase

f. Cookies and Tracking:

  • Authentication cookies: sb-session, sb-access-token, sb-refresh-token (1 week duration)
  • HttpOnly, Secure, SameSite cookies for security
  • Used for performance, session continuity, and analytics
  • You can control cookies via browser settings or our cookie consent manager

3. How We Use Your Information

  • Manage and personalize accounts
  • Deliver personalized career insights and content
  • Authenticate users securely
  • Improve ProVocis based on analytics
  • Process payments via Stripe
  • Send updates or service notices
  • Prevent abuse or fraud
  • Comply with laws and regulations
  • Anonymized, aggregate data may be used for product improvement and research.

4. AI-Specific Data Use

a. Types of Data Processed by AI

Our AI features may process the following data:

  • Resume content
  • Interview responses
  • Career goals and educational history
  • Speech assessments and feedback
  • Uploaded documents and writing samples

b. Third-Party AI Providers and API Usage

We use OpenAI's API to power certain AI features. We may add additional providers in the future without prior notice. These providers may receive your input data to generate AI responses.

  • Data may be used by third-party providers (e.g., OpenAI) to improve their models, except for sensitive personal identifiers such as email address, phone number, or address—unless you explicitly add such information via tools like EnhanceMail.

Third-party AI providers include:

c. Automated Decision-Making and Profiling

AI features may evaluate or score:

  • Resume quality
  • Interview responses
  • Language proficiency
  • Career match insights

These processes may influence career feedback or suggestions.

You may request:

  • Human review of AI-based decisions
  • Opt-out of profiling where applicable

d. AI Data Retention

  • AI chat logs and feedback are stored for 90 days to improve user experience and allow for review.
  • You may request deletion at any time by contacting support@provocis.com.

e. User Control Over AI Data

You can download or delete:

  • Resume analysis results
  • Interview feedback
  • AI chat history
  • Any training logs associated with your profile

f. Explainability of AI Decisions

Wherever AI scoring or suggestions occur, we will:

  • Provide a brief explanation within the feature
  • Or link to a detailed guide explaining how the AI evaluated your input

g. Security of AI Training Data

  • We do not fine-tune or directly train AI models on your personal data.
  • If user input is ever used to improve AI performance, it is:
  • • Anonymized before use
  • • Access restricted to authorized team members
  • • Stored securely with audit logging

h. Beta/Experimental Features

Some AI features may be marked as beta. These may:

  • Store anonymized data to improve feature accuracy
  • Behave differently from finalized features

You will be notified when using beta tools. Continued use indicates acceptance of potential data usage for development purposes.

5. Third-Party Services and Data Sharing

We share user data with the following carefully selected third parties to provide our platform services. All partners are bound by strict data processing agreements and must meet our security and privacy standards.

Supabase (Database and Authentication)

  • Stores: All user data, profiles, payment history
  • Location: Specified in Supabase project settings
  • Privacy: Supabase Privacy Policy (https://supabase.com/privacy)
  • Security: Encrypted connections, Row Level Security (RLS)

Stripe (Payment Processing)

  • Shares: Email, user ID, customer metadata
  • Purpose: Subscription billing and payment processing
  • Privacy: Stripe Privacy Policy (https://stripe.com/privacy)
  • Webhooks: Receives payment events for subscription management

OpenAI (AI Services)

  • Shares: Email content, transcriptions
  • Purpose: Email enhancement and AI assistance
  • Model: GPT-3.5-turbo
  • Privacy: OpenAI Privacy Policy (https://openai.com/policies/privacy-policy)
  • Data Retention: As per OpenAI's data retention policy

Google Cloud (Speech-to-Text)

Resend (Email Service)

Vercel (Hosting and Analytics)

Email Communication

We send the following automated emails:

  • Welcome emails (upon subscription purchase)
  • Payment confirmation emails (recurring billing)
  • Failed payment emails
  • Subscription cancellation emails
  • Mailing list emails (if subscribed)

Opt-out: Users can unsubscribe from mailing lists via unsubscribe tokens included in all marketing emails.

Legal Disclosure

  • Authorities: If required by law from law enforcement or court order
  • Future Acquirers: In the event of a merger, acquisition, or asset sale

We never sell your personal data to third parties for marketing purposes.

For a complete list of all third-party services that process your data, please see our Subprocessor List (/subprocessors).

6. Your Rights by Region

EEA / United Kingdom / Switzerland:

  • Access, correct, delete, or transfer your data
  • Object to or restrict processing
  • Contact your data protection authority

California (CCPA / CPRA):

  • Know what data is collected/shared
  • Request deletion
  • Opt-out of profiling and automated decision-making

Canada (PIPEDA):

  • Access and correct personal data
  • Withdraw consent

Brazil (LGPD):

  • Access, deletion, correction, anonymization, or withdrawal of consent

Australia (APPs):

  • Request access and corrections
  • File complaints with the OAIC

To exercise these rights: contact us at support@provocis.com

7. Data Retention

We retain your data for the following periods:

  • User profiles: Retained until account deletion
  • Payment history: Retained indefinitely for financial records and compliance
  • Session cookies: 1 week expiration (sb-session, sb-access-token, sb-refresh-token)
  • Audio processing: Temporary (not stored after transcription)
  • Email content: Temporary (not stored after enhancement)
  • AI chat logs: Stored for 90 days to improve user experience and allow for review

8. Account Deletion and User Rights

You may delete your account at any time via the settings page.

  • Deletion is immediate and irreversible
  • We delete:
  • • Account and authentication data
  • • Career data, quiz history, and AI logs
  • • Uploaded documents and chat history
  • We do not retain backups unless legally required
  • Subscription will be canceled; no refunds will be issued (see Terms of Service)

9. Security Measures

We implement industry-standard security measures to protect your data:

  • HTTPS/TLS encryption for all data transmission
  • HttpOnly, Secure, SameSite cookies for session protection
  • Service role keys for administrative operations
  • Row Level Security (RLS) on Supabase tables
  • Webhook signature verification for Stripe events
  • Secure cloud infrastructure (Supabase, Vercel)
  • PCI-compliant billing via Stripe
  • Role-based access and session management
  • Regular audits of authentication and token usage
  • Strong encryption and anonymization protocols for AI training data

10. International Data Transfers

Data may be transferred to and processed in the following regions:

  • Supabase servers: Check their data center locations
  • Stripe: Based in the USA
  • OpenAI: Based in the USA
  • Google Cloud: Varies by region
  • Vercel: Global CDN with edge locations worldwide

By using ProVocis, you consent to these international data transfers. We implement appropriate safeguards such as Standard Contractual Clauses (SCCs) when required under GDPR and other privacy regulations.

11. Children's Privacy

ProVocis is not intended for users under the age of 13 (or 16 in the European Union). If we determine that a user below the minimum age has created an account, we will delete the data immediately.

Users under 18 should obtain parental or guardian consent before using our Services.

12. Policy Updates

This Privacy Policy may be updated periodically. For material changes, users will be notified via email or app notifications. The most current version will always be available at https://provocis.com/privacy.

/ Support

Have questions? We'd love to help! Contact support for any issue you may face.

EXAMPLE: How do I request my data to be deleted?

Contact Support