Privacy Policy — Lenviva

Lenviva ("we", "us") provides an AI-powered job interview practice service. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and comparable laws.

1. Data we collect

Account data: name, email address, hashed password (or OAuth identifier), profile picture.
Billing data: subscription plan, invoice history, and the last four digits of your payment method (full card details are handled by our payment processor, Stripe, and never stored on our servers).
Usage data: which interview roles you practice, session duration, number of sessions, minutes used, and coaching scores.
Voice & transcript data: your spoken answers are streamed to our voice AI provider (Vapi) and transcribed. Transcripts are stored so you can review them in your history. We do not permanently store raw audio recordings.
Technical data: IP address, browser type, device information, and pages visited (see our Cookie Policy).

2. Why we collect it

To provide the practice interview and coaching features you request.
To generate personalized coaching reports using AI.
To bill you for paid plans and prevent fraud.
To improve product quality and fix bugs.
To comply with legal obligations.

3. Legal basis

We process your data under contract (to deliver the service you signed up for), legitimate interest (to improve the product and prevent abuse), consent (for optional analytics cookies), and legal obligation (for tax and accounting records).

4. Data sharing

We share data only with sub-processors strictly necessary to run the service:

Supabase — authentication, database, and file hosting.
Vapi — real-time voice AI for the practice interviews.
OpenAI / Anthropic / Google (via Lovable AI Gateway) — language model calls used to generate coaching reports.
Stripe — payments and subscription billing.
Cloudflare — hosting and content delivery.

We do not sell your personal data.

5. Data retention

Account data: kept while your account is active and for 90 days after deletion (for backups and legal disputes).
Transcripts and coaching reports: kept until you delete them or close your account.
Billing records: kept for the period required by tax law (typically 5–10 years).

6. Your GDPR rights

Right to access your data.
Right to correct inaccurate data.
Right to erasure ("right to be forgotten").
Right to data portability.
Right to object to processing.
Right to withdraw consent at any time.

To exercise any of these rights, email privacy@lenviva.app. You also have the right to complain to your local data protection authority.

7. International transfers

Some sub-processors are located outside the EEA. Where required, we rely on Standard Contractual Clauses approved by the European Commission to protect your data.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is limited to authorized personnel and requires multi-factor authentication.

9. Changes

We may update this policy from time to time. Material changes will be announced in-app or by email at least 14 days before they take effect.

10. Contact

Questions? Email privacy@lenviva.app.

This document is a template provided for convenience. It is not legal advice. Please have a qualified attorney in your jurisdiction review and adapt it to your specific business before relying on it.