Privacy Policy

1. Introduction

OutClassAI ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the OutClassAI application, website, and related services (the "Service").

We act as the data controller for the personal data described in this policy, where applicable under the EU General Data Protection Regulation (GDPR) and Spanish data protection law (Ley Orgánica 3/2018, LOPDGDD).

If you have questions or concerns about this policy, please contact us at support@OutClassAI.app.

2. Data We Collect

We collect different categories of data depending on how you use the Service:

2.1 Account data

When you register, we collect your email address, display name, and authentication tokens from your chosen identity provider (Google or Apple). If you register with email and password, we store your email address and a hashed password.

2.2 Subscription and billing data

If you subscribe to a paid plan, our payment processor (Paddle) collects and holds your payment method details. We receive and store confirmation of your subscription status, plan type, billing period, and transaction identifiers. We do not store raw payment card data.

2.3 Usage data (telemetry)

We collect high-level usage metrics to operate the Service — specifically: minutes of session time consumed, intel points used per billing period, and aggregate feature interaction signals. This data is associated with your account ID and stored on our servers.

2.4 Local-only content

Interview audio, transcripts, CVs, job descriptions and session context are captured on your device. Portions of this content may be sent to OutClassAI backend services purely to generate real‑time suggestions, analyses and documents.

We do not permanently store full interview transcripts or complete CV files on our servers. Once a response has been generated and delivered, the underlying request payloads are discarded, subject only to limited operational logging as described below.

Our operational logs may contain limited snippets or short excerpts of CV or document text for debugging and security (for example, to investigate failures or abuse). These logs are retained for a short period only and are then deleted in accordance with our retention policy.

We do not use interview content, CVs or log excerpts to train machine‑learning models, to build behavioural profiles of users, or to target advertising.

2.5 Log and diagnostic data

We may collect anonymised crash reports and error logs from the desktop application. These do not contain session content or personally identifiable information beyond your account identifier, and are used solely to fix bugs and improve the Service.

2.6 Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at support@OutClassAI.app so we can delete it.

3. How We Use Your Data

• Service delivery: To authenticate you, enforce plan limits, and provide core Service functionality.
• Real-time AI processing: To transiently process audio, transcripts, CVs, and job descriptions solely for generating real-time suggestions, contextual intelligence, and interview documents during your active session.
• Billing and subscription management: To process payments, manage renewals, and handle billing queries.
• Service improvement: To identify bugs, monitor system health, and understand aggregate usage patterns.
• Communications: To send essential transactional emails (account creation, billing confirmations, material policy updates). We do not send marketing emails without your explicit consent.
• Operational logging and security: To record limited technical information and short excerpts of request content in server logs, solely for debugging, monitoring abuse, and protecting the Service. These logs are retained for a short period and are not used for profiling users or training models.
• Legal compliance: To comply with applicable laws, regulations, and lawful requests from public authorities.

We do not use your interview or session content to train AI models. Any content transmitted for real-time assistance is processed ephemerally and is not permanently stored, used for model training, or used to profile users. If we ever introduce an opt-in research programme, we will obtain your explicit, granular consent before any content is used for model training.

4. Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b)): Processing your account and usage data to provide the Service you have subscribed to.
• Legitimate interests (Art. 6(1)(f)): Collecting crash reports and aggregate telemetry to improve the Service, provided this does not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)): Retaining billing records for the periods required by Spanish tax law.
• Consent (Art. 6(1)(a)): Any optional processing not covered above (e.g., marketing communications or future opt-in research programmes).

5. Third-Party Processors

We share data with the following categories of trusted third-party processors under appropriate data processing agreements:

• Paddle — payment processing and subscription management (servers in the US/EU).
• Google Firebase — authentication, account database, and hosting infrastructure.
• Apple — identity provider for Apple Sign-In (where applicable).
• Cloud hosting provider — server infrastructure for account, usage, and billing data.

We do not sell your personal data to third parties. We do not share your data with advertisers.

6. International Data Transfers

Some of our processors operate in countries outside the European Economic Area (EEA), including the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards, including:

• European Commission Standard Contractual Clauses (SCCs);
• Adequacy decisions; or
• Other legally recognised transfer mechanisms.

You may request a copy of the relevant transfer mechanism by contacting us at support@OutClassAI.app.

7. Data Retention

• Account data: Retained for the duration of your account plus 30 days after deletion to allow for recovery, then permanently deleted.
• Billing records: Retained for 5 years from the end of the relevant tax year, as required by Spanish tax law.
• Usage telemetry: Aggregated and anonymised after 12 months; raw records deleted within 90 days of your account closure.
• Crash/diagnostic logs: Retained for a maximum of 90 days.
• Operational logs: Server logs used for debugging, security and service monitoring may contain limited snippets of CV or document text. These logs are retained for up to 30 days and then deleted. They are not used for profiling users or training models.
• Local session content & transient data: Controlled entirely by you on your device; any data processed ephemerally during real-time assistance is not retained on our servers.

8. Cookies and Similar Technologies

OutClassAI uses cookies and similar technologies only to the extent necessary to operate the Service securely and reliably.

Essential cookies. When you access the OutClassAI website or sign in to your account, we and our service providers (including Firebase) may use strictly necessary cookies and similar technologies to:

• maintain your login session and authentication state;
• protect against fraud and abuse (for example, by helping to prevent unauthorised access);
• deliver core functionality of the website and application, including routing and basic performance.

These cookies are required for the Service to function and cannot be disabled without affecting how the Service works.

No analytics or advertising cookies. We do not currently use analytics cookies, advertising cookies, or similar technologies to track your behaviour across websites or to build marketing profiles.

If we introduce optional analytics or advertising cookies in the future, we will update this Privacy Policy in advance and, where required by law (including EU/EEA rules), present an appropriate consent mechanism so you can choose whether to allow such cookies.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS) for all server communications;
• Encryption at rest for database storage;
• Access controls restricting data access to authorised personnel;
• Password hashing using industry-standard algorithms (bcrypt/Argon2);
• Regular security reviews of our infrastructure.

No system is completely secure. If you discover a security vulnerability, please disclose it responsibly to support@OutClassAI.app.

10. Your Rights

Depending on your location, you may have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at support@OutClassAI.app. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es).

11. Contact

For any privacy-related questions, requests, or concerns:

OutClassAI
Address: Barcelona, Spain
Email: support@OutClassAI.app

This policy may be updated from time to time. Material changes will be communicated via email to your registered address at least 30 days before they take effect.