Privacy Policy | Orava - Data Protection & GDPR Compliance

1. About Orava

Orava is an AI-powered interview preparation platform designed to help job seekers practice and improve their interview skills through realistic mock interviews and personalized feedback. This Privacy Policy explains how we collect, use, and protect your personal data when you use our services. We are committed to protecting your privacy and handling your data transparently.

2. Who We Are

Orava is created and operated by Richard Judge. For the purpose of the General Data Protection Regulation (GDPR), Nextfem Leaders School, trading as Orava, is the data controller for your personal information. We are based in Amsterdam, Netherlands, so the GDPR applies to everything we do with your data, wherever you live.

3. Information We Collect

When you create an account, we collect your email address and name to set up and manage your profile. During practice interviews, the text of your responses (typed, or transcribed from your speech) is linked to your account so you can review it later. We never store recordings of your voice. You may also upload your resume and paste job descriptions to personalize your sessions. You must be at least 18 to create an account.

Interview answers can touch on personal topics. You don't need to share details about your health, disability, religion, ethnic origin, sexual orientation or immigration status to use Orava, and we never ask for them. If you choose to include them in an answer, story or resume, we use them only to give you feedback on that content, and you can delete them at any time.

You can answer one practice question before creating an account. That answer stays in your browser, and each answer you give is sent once to Google's Gemini AI service so the interviewer can ask you a follow-up. We send nothing else with it — no resume, no job description, and no account, because you do not have one yet. We do not store the answer on our servers unless you go on to create an account, and we never store raw microphone audio. We do record that a follow-up was generated, and what it cost us to generate, never its content and never your answer.

You can also compare your resume to one job description before creating an account. Both documents and the resulting comparison stay in your browser for 24 hours; the documents are sent once to Google's Gemini AI service to produce the comparison, and we do not store them or the result on our servers unless you go on to save the comparison to an account. We record that a comparison was generated and what it cost us, never the documents, your target role, or the result.

When you upload a resume during a practice session, it is processed in-memory to generate personalized interview questions. If you save your resume in your prep workspace, it is stored securely in our database so you can reuse it across sessions, and you can delete it at any time from your account. All uploads are protected during transit using SSL/TLS encryption.

If you use Case Study Prep, we store your Case title, employer brief, notes, presentation plan, rehearsal transcripts, panel answers, and AI feedback with your account. We do not store raw microphone audio.

If you use Technical Questions, we store your tailored practice sets, spoken-answer transcripts, answer durations, and AI feedback with your account. We do not upload or store raw microphone audio.

When you create an account, we record how you arrived: the page you landed on, the referring site, any campaign parameters in the link, the country inferred from your network address, and whether you signed up on a phone or a computer. This helps us understand where candidates come from. We do not store your IP address, and this record is never shared with analytics.

We also process limited technical information needed to operate, secure, and improve the service. Optional product analytics is described separately below and remains off unless you accept it.

4. Analytics and device storage

Orava is the controller for optional product analytics. PostHog is our sole analytics provider, and we use its EU cloud ingestion and processing environment. Analytics processes personal usage data only after you accept: minimized page routes, named feature events, device and browser information, language, time zone, screen and viewport information, and network information such as the IP address received by the ingestion service. Events also carry how you arrived on that visit: the hostname of the referring site (such as google.com, never its full address) and the utm_source, utm_medium, and utm_campaign values in the link you followed, so we can tell which channels bring candidates to Orava. The signup record described above is separate and is still never shared with analytics. We do not send your email, name, resume, job description, interview answers, transcripts, story text, company names, or other free-form candidate text.

For signed-in candidates, PostHog receives only the internal Orava user ID, account type, and subscription tier. Anonymous activity from this browser may be connected to that internal ID after signup or sign-in so we can understand the path from a public page or guide to signup and product activation. This makes the analytics personal and linked to the account. After you accept, PostHog also records application errors: the error message, the code location it came from, and the minimized page route, so we can find and fix what broke. Error reports never include what you typed. Autocapture, surveys, feature flags, and performance capture are disabled.

After you accept, PostHog also records session replays: a reconstruction of the pages you view and how you move through them, including page layout, Orava's own interface text, clicks, scrolling, mouse movement, and minimized page routes. We use replays to see where candidates get stuck or where something breaks. Everything you type into a field is masked, and so is the candidate content Orava shows back to you, such as resume and job description text, fit analysis, interview questions, transcripts and answers, feedback, stories, plans, company and role names, and your name and email. Masked text is replaced with asterisks in your browser before anything is sent. Case Study Prep screens are not recorded at all. Replays never include audio, video, console logs, or network requests.

The necessary localStorage recordorava_analytics_consent stores your accept or reject choice, the policy version, decision or migration timestamp, and six-month expiry. If you accept, localStorage also holds PostHog persistence namedph_<project-key>_posthog. PostHog cookies are not used.

Analytics is strictly default-off. Acceptance and rejection both last six months on this browser and device. We ask again only when the receipt expires or the analytics purpose, provider, or disclosure changes materially. The choice is not synchronized to your account or other devices.

You can change your choice at any time through Cookie settings in the public footer or authenticated user menu. Rejection stops new collection immediately and clears PostHog identifiers and legacy PostHog or Google Analytics storage and cookies where the browser permits.

Orava's policy caps identifiable event-level analytics at 14 months. Genuinely anonymized aggregate reports that can no longer be linked to a person or device may be retained longer.

Separately from PostHog, Vercel Web Analytics counts page visits in aggregate without cookies or any stored identifier, so it runs without asking. It records the page, the referring site, country, and browser and device type. Our fonts are served from our own domain, so loading a page sends nothing to a font provider.

5. How We Use Your Information

Under GDPR, we must have a valid legal basis to process your data. We use your interview data and preferences to deliver the core mock interview functionality (contractual necessity). We monitor technical information to prevent misuse, protect our services, and ensure everything runs smoothly (legitimate interest).

Scores and feedback are AI-generated practice guidance for you alone. Orava makes no decisions about you, and no employer or sponsoring organization ever sees them.

We use optional product analytics only with the consent and safeguards described in the Analytics and device storage section. We only send marketing communications if you have explicitly opted in, and you can change that at any time from your account page. Service messages about your own account and activity — such as sign-up confirmation — are sent separately and are not marketing.

6. Data Sharing and Third Parties

We do not sell, trade, or rent your personal data. We only share data with the service providers below, which process it on our instructions under data processing agreements.

Vercel hosts our website and servers. Supabase stores your account data and manages sign-in; our database is hosted in the United States (AWS, US East). Google processes everything you ask Orava's AI to work on (resume and job description, Role & Fit, positioning, stories, Research, mock interviews, Case Study Prep and Technical Questions) through its paid Gemini API, and generates the interviewer's voice. Under Google's terms for paid services, Google does not use your prompts or responses to improve its products or train its models. Research briefs also use Grounding with Google Search, which receives only the company name, role title and job description. Your browser's speech-recognition service converts microphone input into text; its provider varies by browser. Resend delivers our emails, such as your welcome email. With your consent, PostHog processes the minimized product analytics and masked session replays described above in its EU environment. Stripe securely processes payments for paid plans and handles your payment information directly — we do not store your card details.

The one exception is an organization that sponsors your access, such as a coding school or careers service. If you join through its invite link, it sees your name and email, the date you joined, how many mock interviews you complete and when you last practiced, counting only from the day you join until the day you leave. It never sees your answers, stories, scores or feedback. The invite page shows you this before you join.

We may also disclose information if required by law or in the event of a business transfer, where you would be notified.

7. Your Data Rights

Under GDPR, you have the right to access, rectify, or delete the personal data we hold about you. You can also object to processing for certain purposes, request restriction of processing, and request your data in a portable, machine-readable format. Where we rely on your consent, you can withdraw it at any time. You can delete your account yourself from the Account page; for anything else, including a copy of your data, email us and we will respond within one month.

You also have the right to complain to a data protection authority: ours is the Dutch Autoriteit Persoonsgegevens, or you can contact the authority where you live, such as the Data Protection Commission in Ireland or the Information Commissioner's Office in the UK. We'd appreciate the chance to fix things first.

8. Data Retention & Security

We keep your personal data for as long as your account is active. You may delete your account and associated data at any time from the Account page. When you delete your account, all personal data is removed from our application systems; we retain only a minimal timestamp record for audit purposes. Stripe retains billing information where required for legal, tax, fraud-prevention, and accounting purposes. Analytics retention is described in section 4. Google keeps Gemini prompts and responses for a limited period solely to detect abuse, and keeps Research requests grounded with Google Search for 30 days.

We use encryption in transit (SSL/TLS) and at rest, along with strict access controls to protect your data.

9. International Data Transfers

Supabase, Vercel, Google, Resend and Stripe process data in the United States. These transfers are covered by the Standard Contractual Clauses (SCCs) approved by the European Commission in each provider's data processing agreement and, where the provider is certified, the EU-U.S. Data Privacy Framework. PostHog processes analytics in the EU. Email us for a copy of the relevant safeguards.

10. Policy Updates

We may update this policy periodically. All changes will be posted on this page with a revised "Last updated" date. We will notify you of any significant changes.

11. Contact Us

For any questions, data requests, or privacy concerns, please reach out at support@getorava.com. We are committed to addressing your concerns promptly and transparently.