Privacy Policy

Catalyst Interviews (the "Service") is operated by Catalyst AI & Tech, LLC, a Delaware limited liability company with registered office at 131 Continental Dr, Suite 305, Newark, Delaware 19713, County of New Castle and registered agent Legalinc Corporate Services Inc.

This Privacy Policy explains how we collect, use, disclose and protect personal data when you use the Service at https://interviews.catalystai.llc. It covers job seekers who practise on the Service and people whom an employer organisation invites to an interview on it. It should be read together with our Terms of Service and, for employers, our Data Processing Addendum.

Our roles. For your account, your own practice interviews, security and billing, we are the controller of your personal data. When an employer organisation (an "Organisation") adds candidates to the Service, uploads their details or invites you to an interview, we hold the recruiting records the Organisation creates as its processor, on its instructions and under our Data Processing Addendum. The Organisation decides why and how it uses them. The interview you take is your own: you choose whether to share its result with the Organisation (see section 5).

Depending on how you use the Service, we collect:

• Account information: name, email address, password (stored hashed by our authentication provider), account type (job seeker or employer) and profile details such as experience level, target role, current title, skills and language preference.
• Usage and device data: pages viewed, features used, credit balance changes, interview metadata (category, length, timestamps), error logs, IP address, browser type and similar technical data collected automatically for security and operations.
• Interview and practice content: voice audio processed in real time, transcripts, code you write and periodic snapshots of it, whiteboard diagrams, scores, feedback reports, and your answers to the feedback form after an interview. We do not store voice audio unless you choose to be recorded.
• CV and job-targeting content: CV files you upload, parsed CV data, ATS scores, job descriptions you paste, match analyses and cram-sheet outputs.
• Recordings (optional): if you turn recording on, video from your camera and the interview's audio, including the interviewer's questions, with technical details such as length, size and when it was made (section 3).
• Integrity signals (optional, employer interviews only): if you turn monitoring on, the signals listed in section 4. They are codes, times and durations. They contain no screen images, keystrokes, pasted text or answer text.
• Delivery coaching (optional): if you turn it on, measurements such as how much of the time you looked toward the camera, your speaking pace and a confidence indicator, shown only to you.
• Your choices: a record of what you agreed to or declined for each interview, the version of the wording you saw, and when.
• Information from an Organisation: if an Organisation invites you, it gives us your name and email address and may give us a CV and the job you are being considered for. It may also import candidate details in bulk.
• Payment information: transaction identifiers, amounts, status and gateway references from our payment processors (Stripe or Kashier) and, for Organisation subscriptions, customer and subscription identifiers, the plan, and the billing contact's name and email address. You enter card numbers with the payment processor. We do not receive or store them.
• Communications: messages you send to our support, privacy or refund addresses, and waitlist or marketing emails if you opt in.
• Company waitlist form: what you enter in our company waitlist form. When you press submit, we also keep a record of the attempt, including what you typed, even if the form was incomplete or not accepted, so we can find and fix problems with the form. Incomplete or unaccepted submissions are deleted after 90 days.
• Business demo (companies): if you try the live demo on our page for companies (/business/demo), the name, phone or WhatsApp number, and optional work email and company you enter first, and the text of the demo conversation (the interviewer's questions and your answers) with its result. Your voice is processed live and no audio is recorded. We use this only to follow up with you about Catalyst.

Recording is optional and off by default. Before an interview starts you are told, in plain words, what would be recorded and who could watch it, and you choose. Declining does not stop you taking the interview and does not affect your score. If recording is not offered for an interview, nothing is recorded.

• What is recorded: your camera and the interview's audio, including the interviewer's questions, while the interview is live. Recording stops while the interview is paused.
• Who can watch: you, and, if the interview was set by an Organisation and you shared your result, that Organisation's administrators and recruiters. Viewers, other users and our own staff have no access to recordings through the Service. Recordings are stored privately and are never public. Every playback is written to the Organisation's audit log before the recording opens.
• How long we keep it: at most 90 days after the interview. After that the recording is deleted and only a note that it was deleted remains.
• Stopping: you can stop recording at any time during the interview. Stopping deletes what was recorded.
• How it is handled: your browser streams the recording over an encrypted connection to a recording server we run on Amazon Web Services in Stockholm, Sweden. The server checks it and stores it in our private storage in Frankfurt, Germany, and keeps it only until it has been stored. Your camera and microphone can be used only on interview pages.

You can withdraw your consent at any time, in the interview or by writing to privacy@catalystai.llc. Withdrawing deletes the recording. Your choice is stored together with the version of the wording you saw.

When an Organisation invites you to an interview, the interview may offer integrity monitoring. It is offered only in employer interviews and never in practice interviews. It is off unless you turn it on, and you can decline without losing the interview. The Organisation sees only which kinds of monitoring were enabled, and it sees the same neutral wording whether you declined or it was not offered.

If you turn it on, the following may be noted:

• Browser activity: when you switch to another tab or application and for how long, when the pointer leaves the window, long periods with no input in the coding and whiteboard rooms, how many characters you copied or pasted (never what), and whether more than one display is connected. It does not record your screen or your keystrokes, and it never blocks copying, pasting or switching windows.
• Camera checks, on your device: whether no face, or more than one face, is visible for a while, whether you turn away from the screen for a long time, or whether a phone or second device is visible. The analysis runs in your browser and no image or video leaves your device for it. Only the type, time and length of each moment is sent.
• Answer authenticity checks, on our servers: after the interview, automated checks of the transcript and of code snapshots for specific patterns, such as wording typical of chat assistants or a large block of code appearing at once. These use our own rules and are not sent to any outside AI service. The Organisation sees which answer was flagged, roughly when and why. The flag itself does not include the text of your answers.

These are AI-assisted signals for a person to review, not decisions. A person at the Organisation looks at each one and can acknowledge or dismiss it. They never change your score, ranking or stage, no overall integrity score exists, and we do not make or recommend hiring decisions. Signals can be wrong: a short tab switch, a poor camera or a second monitor is often innocent, and part of the browser activity is reported by your own browser. What was noted before you stop monitoring is kept. Separately, you may be offered delivery coaching, which only you see and which is never shared with an Organisation or used in a score.

If an Organisation invites you, the Service asks whether you agree to share the result of that interview with it. Nothing is shared before you have taken the interview and it has been scored.

If you agree, the Organisation can see:

• your scores, the written report and the per-question feedback, which describe your answers and include short quotes from your answers that support each score, and the full transcript of the interview (the AI interviewer's questions and your answers);
• for a coding interview: your final code, its test results and the AI code review;
• how long the interview took, when it happened and whether it finished;
• if you turned them on: the integrity signals from section 4 (visible to every member of the Organisation) and your recording (visible only to its administrators and recruiters).

You do not see these scores or the AI's written assessment yourself: they go to the Organisation. The Organisation does not get any CV you uploaded yourself or your delivery-coaching summary. Members see only what their role allows. The Organisation is responsible for its own use of your data, including any hiring decision and how long it keeps your details, so ask it directly about those. If you erase your Catalyst account, we also erase the records Organisations hold about you (section 12).

We use personal data to:

• provide, maintain and improve the Service (performance of a contract, and our legitimate interest in improving it);
• authenticate users and prevent fraud, abuse and security incidents (legitimate interests);
• process payments, credit purchases and Organisation subscriptions, and keep financial records (contract and legal obligation);
• generate AI interview sessions, scoring, CV analysis and related outputs (contract);
• record you, note integrity signals or produce delivery coaching (only with your consent, which you can withdraw);
• share your interview result with an Organisation that invited you (only with your consent);
• enforce our Terms and Refund Policy and comply with the law (legitimate interests and legal obligation);
• send transactional messages such as account confirmation, invitations and receipts (contract);
• diagnose errors and analyse how the Service is used (product analytics) to improve it, without session replay or advertising (legitimate interests).
• measure our advertising to companies with the Meta Pixel, on our business marketing pages only (legitimate interests).

Where the law of Egypt (Law No. 151 of 2020 on the Protection of Personal Data) applies, we rely on your consent or on the other grounds that law recognises, such as performing a contract or complying with a legal obligation. We do not sell your personal data. We do not use your private interview content to train public third-party models for unrelated products unless we tell you otherwise and obtain consent where required.

Core features rely on automated processing, including large language models and speech technologies provided by our subprocessors (for example OpenAI). Your inputs, such as spoken answers, CV text, job descriptions, code and whiteboard diagrams, are sent to these systems to deliver the Service, under contract terms that limit their use of the data to providing services to us.

AI outputs are probabilistic and may be inaccurate. Do not submit sensitive personal data you are not comfortable processing through cloud AI systems, such as government ID numbers, health records or private data about other people.

No solely automated hiring decisions. Scores and reports are produced by automated systems and are one input for you and, if you shared them, for the Organisation. We do not decide whether anyone is hired, rejected or advanced. An Organisation may sort or compare candidates by score, and it remains responsible for its own decisions. Integrity signals are never used in any score, sorting or ranking. If an Organisation makes a decision about you, you can ask it for a review by a person.

We may share information with:

• Service providers (subprocessors) that host infrastructure, authentication, payments, email, error monitoring, product analytics and AI, under contracts requiring appropriate confidentiality and security. Each one, its purpose, the data it receives and its region are listed on our subprocessors page, and we give notice before adding one;
• The Organisation that invited you, only as described in section 5;
• Legal and safety: when required by law, subpoena or government request, or to protect the rights, safety and integrity of Catalyst AI & Tech, LLC, users or the public;
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy or notice to you;
• With your direction: when you explicitly request or enable a feature that involves sharing.

How long we keep things:

• Account and profile: while your account exists, then erased or de-identified when you ask.
• Recordings: at most 90 days after the interview, then deleted. They are deleted immediately if you stop recording, withdraw consent or erase your account.
• Interview transcripts: kept with the interview while your account exists, so you can review your reports. They are removed when you erase your account, and you can ask us to remove them sooner at privacy@catalystai.llc. Scores and reports stay while your account exists.
• Integrity signals and your choices: kept with the interview record. After account erasure they remain only as codes, counts and consent records that do not identify you.
• CVs and job descriptions you added: until you delete them or erase your account.
• Candidate records held by an Organisation: for as long as the Organisation keeps them, and erased on the Organisation's or your request. The Organisation can erase a candidate's record at any time from its settings.
• Data export files: 7 days after they are ready.
• Payment and credit records: for as long as the law requires, including after you erase your account.
• Audit logs: kept as tamper-evident records. They identify actions by reference and code, not by name.
• Business demo conversations: 180 days, then deleted. The contact details you left stay with your request until you ask us to delete them.

Backups and logs may persist for a limited period after deletion before they are overwritten in the ordinary course.

We implement reasonable administrative, technical and organisational measures designed to protect personal data. These include encryption in transit and at rest provided by our infrastructure providers, private storage with row-level access control on every table, short-lived signed links for recordings, role-based access for Organisation members, and an audit log of Organisation actions and recording playback. No method of transmission or storage is completely secure. Tell us at support@catalystai.llc if you believe your account has been compromised.

Catalyst AI & Tech, LLC is based in the United States and we use providers in several countries. Most data is stored in Frankfurt, Germany. Recordings pass through a server in Stockholm, Sweden. Some providers, such as OpenAI, Stripe and PostHog, process data in the United States, and Kashier processes Egyptian card payments in Egypt. Our subprocessors page lists each provider and its region.

When personal data leaves the European Economic Area, the United Kingdom or Egypt, we rely on the safeguards those laws allow, such as the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) and, for Egypt, the conditions for cross-border transfer in Law No. 151 of 2020. You can ask us for information about the safeguards at privacy@catalystai.llc. Where your local law requires your separate consent to a transfer, we ask for it separately.

Depending on where you live, including under the GDPR and the UK GDPR and under Egypt's Law No. 151 of 2020, you may have the right to be informed about how your data is used, to access it and receive a copy, to correct it, to have it erased, to restrict or object to its processing, to withdraw consent at any time without affecting earlier processing, and not to be subject to a decision based solely on automated processing that significantly affects you.

How to use them:

• Get a copy: in the app, go to Profile, then Your data, and request a copy. The file is usually ready within minutes and stays available for 7 days.
• Erase your account: email privacy@catalystai.llc and we will start the request for you and complete it within 30 days. Erasure starts 7 days after the request is confirmed, and until then it can be cancelled. It erases your profile, transcripts, reports, CVs, recordings, job descriptions and progress, and the candidate records Organisations hold about you. It keeps interview scores and timings and integrity signal codes without anything that identifies you, your consent records, and payment and credit records that the law requires us to keep.
• Correct your data: edit your profile in the app, or email us.
• Withdraw consent to recording, monitoring or coaching: switch it off during the interview. Withdrawing recording consent deletes the recording.
• Object or restrict: email us and tell us what you want to limit.
• Data an Organisation holds about you: ask the Organisation. Its administrators can export or erase a candidate's record from their settings.

We may verify your identity before responding and we aim to respond within 30 days. You can update profile information in account settings, and you can opt out of non-essential marketing email through the unsubscribe links. If you are unhappy with our response, you may complain to your data protection authority or, in Egypt, to the Personal Data Protection Centre.

California residents (CCPA/CPRA): we do not sell personal information for money. On our business marketing pages only, the Meta Pixel described in section 15 helps us measure our advertising to companies, which California law may treat as "sharing" for cross-context behavioural advertising. It does not run in the app, or on candidate, interview or report pages, and it does not load if your browser sends a Global Privacy Control signal. You have the access, deletion and correction rights described above. Email privacy@catalystai.llc to use them, and we will not discriminate against you for doing so.

The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact privacy@catalystai.llc and we will take appropriate steps to delete it.

We use what the Service needs: sign-in cookies, a language preference, a browser-storage entry that lasts 24 hours and remembers which payment provider suits your country, and, on interview pages, temporary browser storage that keeps a recording safe until it has been delivered. We also use PostHog (PostHog, Inc.) for product analytics, the same tool used on our main site, catalystai.llc. It sets an analytics cookie on catalystai.llc and its subdomains, so a visit to both sites counts as one visitor, and records the pages you view (with any link codes removed from the address), which buttons and links you click (never the text on the screen or anything you type), your browser and device type, the site that referred you, and your approximate location, which PostHog works out from your IP address. When you are signed in, these events are tied to a pseudonymous identifier derived from your account that PostHog cannot link back to you. Our servers also send PostHog a few product-usage events under the same identifier, such as "an interview was completed". None of this includes your name, email address, CV, transcript, answers or code, and there is no session replay and no advertising use. Analytics events are kept for up to 12 months and are processed in the United States. PostHog does not load if your browser sends a Global Privacy Control signal, and a tracker blocker also stops it. You can ask us to delete your analytics data at privacy@catalystai.llc. We use no advertising or cross-site tracking cookies, except on our business marketing pages for companies (/business, /for-business and the company waitlist): there, the Meta Pixel from Meta Platforms Ireland Ltd sets cookies and sends Meta the page you viewed, your IP address and browser details, and, if you join the company waitlist or create an organisation, the fact that you did (never your name, email address or phone number), so we can measure our advertising to companies. It does not run in the app, or on candidate, interview or report pages, and it does not load if your browser sends a Global Privacy Control signal. Our error monitoring records technical exceptions only, with no user identity.

The Service may link to third-party sites. Their privacy practices are not governed by this Policy. Review their policies before providing information.

We may update this Privacy Policy from time to time. We post the revised version with a new date and version number at the top. We will tell you about material changes through the Service or by email, and where the law requires your consent to a change we will ask for it. Continued use after a change takes effect is acceptance where the law allows.

Privacy requests and questions: privacy@catalystai.llc. We have not appointed a separate data protection officer, and this mailbox is monitored for that purpose.

Catalyst AI & Tech, LLC
c/o Legalinc Corporate Services Inc.
131 Continental Dr, Suite 305, Newark, Delaware 19713, County of New Castle