Privacy Policy

Who operates InterviewPath AI

Elevate Customer Experience Advisory operates InterviewPath AI. Contact info@elevatecxadvisory.com for privacy questions and requests. This policy covers our career-preparation app, not independently operated websites you visit through its links.

Information we process and why

• Accounts: email, account identifier, authentication/session and confirmation or recovery information, to create and secure your account. Email/password credentials are submitted to managed authentication through Lovable Cloud. Password verification and hashing are handled by the authentication provider; we do not maintain a separate password database.
• Saved applications: company, role, source link, status, dates, next steps and notes, to provide your private, account-synced tracker. Signed-out tracker entries can instead remain in this browser until you delete them or explicitly import them.
• Career content: uploaded résumé files are read and text is extracted in your browser. Pasted or extracted résumé text, target-role preferences, job descriptions, and an existing letter when revising are sent to our server and AI service when you request analysis. Generated content is returned to your workspace.
• Purchases and billing: account/customer identifiers, checkout and invoice references, amounts, currency, payment/subscription status, paid-period dates, access expiry and payment-event references, to verify ownership, grant allowances and manage billing.
• Agreements: account identifier, accepted document version, timestamp, agreement source and a limited user-agent string, to record policy and separate recurring-billing acceptance.
• AI usage: account identifier, feature, purchase or period reference, timestamps, reservation/success/failure state, limited failure codes and a one-way input fingerprint, to enforce quotas, prevent duplicate use and limit abuse. These application usage rows do not contain résumé, letter, job-description or output text.
• Private diagnostic trials: invited email, a one-way invitation-token hash, issuance/expiry, redemption account and diagnostic usage, to restrict each invitation to its intended confirmed email. Optional feedback is stored privately with your chosen quote/name permissions and their timestamp/version; no positive review is required and nothing is automatically published. A chosen testimonial name is stored only when you permit its use. Contact us to withdraw permission or request deletion.
• Support and operations: information you send us, plus technical request and error information needed to investigate problems and secure the service. Avoid sending career content or sensitive details in support requests unless needed and specifically requested.

Workspace memory is different from provider logs

The app does not save résumé text, letters, job descriptions or generated reports in its account database or browser persistent storage. They are held in tab memory while you work. Saved tracker notes are different: anything you put in those notes is stored with the tracker, so do not paste sensitive résumé content there.

This does not mean content is never retained anywhere. Real AI requests pass through the Lovable AI gateway to OpenAI, using the currently configured model openai/gpt-6-astra. Our request sets store: false, but that is not proof that Lovable gateway logging or provider security retention is disabled.

Lovable’s official documentation says that, when AI app context is enabled, full prompts and responses can be retained for 90 days for debugging, with secret redaction. The setting is on by default for Free and Pro workspaces and off by default for Business and Enterprise. We have not verified this project’s actual setting, so assume your submitted content and generated responses may be logged. Turning app context off still leaves request summaries.

OpenAI’s API documentation describes separate abuse-monitoring logs that may include prompts and responses, normally retained up to 30 days, with exceptions and approved retention controls. The controls actually applied to requests routed through this gateway have not been verified. Neither workspace deletion nor store: false establishes zero retention or a universal no-training promise. See Lovable AI logging documentation and OpenAI API data controls.

Server error logging and preview error reporting may retain error messages, stack traces, route and technical context. These are separate from account content storage; retention and comprehensive redaction are not verified. The AI handler does not intentionally log full career prompts or outputs to its console.

Providers and disclosures

Lovable Cloud provides hosted authentication and database infrastructure, and Lovable AI routes AI requests to OpenAI. Stripe processes payments through its embedded checkout and billing portal; this app does not collect or store full payment-card numbers. Billing references and gateway operational records are separate from card entry.

We disclose information to providers as needed for service delivery, payment processing, support and security, and where required by law or to protect legitimate rights. We do not make an unverified blanket promise about all sharing, sale, provider training or provider retention. Privacy acknowledgment is not optional marketing or model-training consent; there is no marketing signup in this app.

Dubsado scheduling and job-board links take you to independent services. Their processing begins under their own policies when you visit them. The app also loads fonts from Google, and embedded Stripe content may use its own necessary storage and technical information.

Official references: Lovable Privacy Policy, Lovable training-data controls, OpenAI Privacy Policy, Stripe Privacy Policy and Dubsado Privacy Policy.

Cookies, browser storage and measurement

Essential browser data includes authentication/session storage, recovery state, and a purchase-ownership cookie for checkout continuity and legacy claims. The purchase cookie is HTTP-only, uses SameSite protections and is secure outside local development; it has a 30-day lifetime. Browser-local tracker entries and an account-binding marker support explicit import and shared-browser isolation.

No separate advertising tracker or marketing analytics integration is configured in the application code inspected for this policy. Lovable preview/error telemetry, operational request records and aggregate AI cost/usage measurement are separate and may still operate. We have not verified all platform-level telemetry settings; this is not a claim that no technical data is collected.

Retention, deletion and your requests

Refreshing or closing the tab, logging out, or clearing the workspace removes current workspace memory. Deleting browser-local tracker entries removes those local entries only. Neither action deletes provider logs, account-synced tracker entries, purchase or consent records, or downloaded copies.

We retain account, transaction, agreement, usage and operational information as needed for service delivery, security, financial administration and legal obligations. Provider logs, backups and required transaction or security records may follow separate retention rules. We do not promise a fixed deletion deadline or that every record disappears on an account-deletion request.

You can edit or delete saved applications in the tracker. To request access, correction or deletion of other account information, email info@elevatecxadvisory.com. We may verify ownership before acting and explain any information we must retain. Rights to access, deletion, correction or other controls depend on applicable law; mandatory rights are preserved. We review requests and confirm the outcome by email.

Account deletion is a support request, not an automatic subscription cancellation. Cancel monthly Plus first from My Dashboard or ask support for help with both. Providers may process information across locations; we have not verified all processing and backup locations or a single-country processing guarantee.

Security, minimization and updates

Private application records use account-based access controls, and the server verifies purchase and AI access. No system is perfectly secure. Remove unnecessary contact details, government identifiers, financial, health or other highly sensitive information before uploading or pasting content; provide only what is needed for career assistance.

We identify material policy changes with an updated version and in-app review before new purchases. Existing agreement records are retained as historical evidence, not retroactive acceptance of a new policy.

Your workspace controls

These controls clear only the indicated workspace or browser state—not provider logs or account records.