Privacy Policy

October 10, 2026

Your privacy is important to us. This Privacy Policy explains how Subcue AI LLC ("SubcueAI," "we," "us," or "our"), a limited liability company organized under the laws of the United States, collects, uses, shares, and protects your personal information when you use our application, website, and related services (collectively, the "Services"). By using our Services, you consent to the practices described in this policy.

1. Information We Collect

Information You Provide

  • Account Information: Name, email address, and password when you create an account.
  • Payment Information: Billing details processed securely through Stripe, Apple In-App Purchase, or Google Play Billing. For App Store and Google Play purchases, we receive only the purchase record needed to activate and renew your plan, such as a purchase token and the subscription status. We do not store your full credit card number.
  • Resume Data: Resumes you upload or create in the resume builder, including any contact details you choose to add (such as phone number, location, and profile links) and an optional profile photo, used for personalized answer generation and stored encrypted at rest.
  • Interview Data: Transcript entries and session metadata generated during your use of the Services.
  • Communications: Messages you send to our support team.

Information Collected Automatically

  • Usage Data: Feature usage patterns, session frequency, and interaction metrics, as well as crash reports and error diagnostics from our apps.
  • Device Information: Operating system version (macOS, Windows, iOS, or Android), device model, app version, and a random installation identifier that our apps create on first launch. This identifier is not derived from your device hardware and is not an advertising identifier.
  • Log Data: IP address, browser or app type, referring pages, and access timestamps when you visit our website or use our apps. From the IP address we derive an approximate location (country, region, and city), which we record with sign-ins and usage events for security, fraud prevention, and aggregate analytics. We do not collect precise (GPS) location.

Information from Third Parties

  • OAuth Providers: When you sign in via Google or Apple, we receive your name, email, and profile identifier from the authentication provider.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Services;
  • Generate real-time AI answer suggestions based on your resume and interview context;
  • Process payments and manage your subscription;
  • Provide customer support and respond to your inquiries;
  • Analyze usage patterns to improve product features and user experience;
  • Detect, prevent, and address fraud, abuse, or security issues;
  • Send transactional communications (e.g., account verification, billing notifications).

3. Audio Data Processing

SubcueAI captures audio to generate transcripts: on the macOS and Windows apps, system audio and microphone input captured locally on your device; on the iOS and Android apps, only the microphone input of your phone or tablet — during mock interviews, and in Listen mode, where the interview plays on another device (such as your computer) and the app listens to it through the microphone; in the browser extension's live mode, the audio of the meeting tab you select; and in mock interviews on our website and in the browser extension, your microphone input, which is transcribed by your browser's built-in speech recognition (in Chrome, for example, the browser sends that audio to Google's speech service). This audio data is:

  • Processed in real-time for speech-to-text conversion by a third-party cloud speech-to-text provider — on every platform and app, audio is transmitted over an encrypted connection to the cloud for transcription; speech-to-text is not performed on-device (see “How We Share Your Information” below);
  • Streamed transiently — we do not store audio recordings on our servers; only the resulting transcript text is sent to our servers to generate AI answer suggestions;
  • Never shared with third parties for advertising or marketing purposes.

Transcript text generated from audio is saved to your account to provide features such as interview history, performance analytics, and resume-driven context for future sessions. You can delete your transcript data at any time from within the app or your dashboard.

Optional Voiceprint (Listen Mode on iOS and Android)

If you turn on “Recognize my voice” in Listen mode, you read a short passage aloud (about 30 seconds) and the app derives a voiceprint from your voice: a set of 512 numbers that describes how your voice sounds. During Listen sessions, the app compares what its microphone hears with this voiceprint to mark which transcript lines are your own words, so that AI answer suggestions respond to the interviewer rather than to you. A voiceprint is biometric information, so:

  • Only with your consent: the app creates a voiceprint only after you agree to it in the app, and uses it only for this purpose;
  • Only on your device: the enrollment recording and the voice comparison are processed on your device, and the voiceprint is stored only on that device (in the iOS Keychain or in Android’s private app storage) and is not synced or transferred to other devices. The enrollment recording is discarded as soon as the voiceprint is made. Neither the recording nor the voiceprint is ever sent to our servers or to any third party;
  • What we receive: the speaker label of each transcript line (your speech or the interviewer’s), as part of the transcript described above, and, in our app analytics, only counts — for example, how many lines were labeled each way;
  • Deletion: you can delete your voiceprint at any time in the app (Listen → Recognize my voice → Delete voiceprint). It is also deleted when you sign out of the app or delete your account in it. We keep no copy.

4. How We Share Your Information

We do not sell your personal information. We may share information with:

  • Service Providers: Third-party vendors that help us operate the Services, each receiving only the data it needs for its task:
    • Hosting and infrastructure: Cloudflare hosts our website, servers, databases, and file storage, protects our forms against bots (Turnstile), and runs some AI processing on its own network: Workers AI (for example, to build the search index of your transcripts and to read the text of resume images) and AI Gateway, which relays our requests to the AI providers below.
    • Speech-to-text: ElevenLabs and Deepgram receive audio streams to transcribe them.
    • AI models: depending on the feature and your country, OpenAI, xAI, Anthropic, Google (Gemini), Alibaba Cloud (Qwen), or DeepSeek receive transcript text, your resume, your job descriptions, your prepared answers, the questions you ask, and the messages you send to our support chat, to generate interview questions, answer suggestions, session analyses, resume parsing and improvements, and support replies.
    • Text-to-speech: xAI and Alibaba Cloud (Qwen) turn the text of mock-interview questions into the interviewer’s voice.
    • Payments: Stripe (website purchases, including sales-tax calculation), Apple (App Store), and Google (Google Play); purchases made before July 2026 were processed by Paddle.
    • Email: Resend delivers our emails, such as verification codes, account and billing notices, and replies to your support messages.
    • Sign-in and analytics: Google and Apple when you sign in with them, and Google Analytics and Microsoft Clarity as described in Section 8.

    Which provider handles a request can depend on the country you connect from, which we determine from your IP address: where a provider’s service is not available, speech-to-text is handled by Deepgram instead of ElevenLabs, and AI features and the mock-interview voice by Alibaba Cloud (Qwen) instead of OpenAI or xAI. These providers process your data to deliver the Services on our instructions, are contractually bound to protect it with safeguards at least equivalent to those described in this policy, and may not use it for their own purposes except as described in Section 13.

  • Legal Compliance: When required by law, regulation, legal process, or governmental request.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
  • With Your Consent: When you explicitly authorize us to share information with a third party.

5. Data Security

We implement commercially reasonable security measures to protect your information, including encryption in transit (TLS) and at rest, secure authentication with JWT tokens, and access controls. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. Upon account deletion, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, dispute resolution). Anonymized, aggregated data may be retained indefinitely.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you;
  • Request correction of inaccurate data;
  • Request deletion of your personal data;
  • Object to or restrict certain processing activities;
  • Request data portability;
  • Withdraw consent where processing is based on consent.

To exercise any of these rights, please contact us at contact@subcueai.com.

8. Cookies & Tracking

Our website uses essential cookies to maintain session state and preferences. We do not use third-party advertising cookies. You may configure your browser to reject cookies, though some website features may not function properly without them.

We also use Microsoft Clarity, a third-party analytics service provided by Microsoft, to understand how visitors interact with our website (such as pages viewed, clicks, and scrolling) so that we can improve it. Clarity may set cookies and record usage interactions; sensitive input fields are masked. For details, see Microsoft's Privacy Statement.

We also use Google Analytics, a service provided by Google LLC, to understand in aggregate how our website and apps are used — for example, pages and screens viewed, sign-ups, feature usage, and purchases — so that we can improve the Services. On our website, Google Analytics uses cookies and, while you are signed in, a pseudonymous account identifier so that your visits across devices are counted once. In our iOS and Android apps we use Google Analytics for Firebase; the apps do not collect advertising identifiers (such as Apple's IDFA or the Android Advertising ID), and we do not use this information for advertising or ad personalization. Google processes this information as described in its Privacy Policy and in How Google uses information from sites or apps that use its services. You can opt out of Google Analytics on the web with Google's opt-out browser add-on.

9. Regional Protections

California (CCPA): California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

European Union (GDPR): If you are located in the EU/EEA, we process your data under lawful bases including consent, contract performance, and legitimate interests. You have the right to lodge a complaint with your local data protection authority.

International Transfers: Your data may be processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for cross-border data transfers.

10. Children's Privacy

The Services are not intended for children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date above. Your continued use of the Services after changes take effect constitutes your acceptance of the revised policy.

12. Your Recording Responsibility

The Services capture audio from your microphone and system output to generate transcripts. You are solely responsible for:

  • Obtaining consent from all participants where required by law (e.g., "two-party consent" jurisdictions including California, Illinois, Florida, Pennsylvania, Washington, Massachusetts, and the European Union under GDPR);
  • Honoring NDAs and workplace policies that may restrict your use of recording or AI-assistance tools during interviews;
  • Avoiding sensitive personal data (e.g., health, ethnicity, political opinions, religion, biometric data) where prohibited.

We do not monitor or verify your compliance with these obligations. You agree to indemnify and hold us harmless from any claims arising from your use of the Services in violation of recording, privacy, or confidentiality laws.

13. AI Training

We do not use your transcript content, audio, or session analyses to train AI models.

The AI and speech-to-text providers listed in Section 4 receive this data to return results to us, and their own terms govern what happens to it afterwards. Under their published API terms, OpenAI, xAI, Anthropic, and Cloudflare (Workers AI) do not use it to train their models. Google makes the same commitment only for paid use of its Gemini API and may use data sent to the free tier to improve its products. The standard terms of ElevenLabs and Deepgram allow them to use the audio and transcripts they process to improve and train their speech-recognition models, and the published terms of DeepSeek and of the Alibaba Cloud (Qwen) service we use do not clearly say whether API data is used for training.

These providers do not delete the data as soon as a request is complete. Under their published terms, OpenAI, xAI, and Anthropic keep API data for up to 30 days and Google keeps Gemini API data for 55 days, mainly to detect abuse and misuse, and they may keep it longer when the law requires it or when a request is flagged for a policy violation. Alibaba Cloud (Qwen), DeepSeek, ElevenLabs, and Deepgram do not commit to a short retention period for API data in their published terms.

Requests to OpenAI, Anthropic, and Google (Gemini) pass through Cloudflare AI Gateway, which can keep a log of each request, including its content, in our Cloudflare account.

14. Per-Record Deletion & Mock vs Real Interviews

You may delete individual interview records (transcripts and analyses) at any time from the Records tab in the desktop app or the dashboard. Deletion is logical: the record is hidden from your dashboard immediately. Internal admin tools may retain the record for up to 30 days for audit and recovery purposes, after which it is purged along with associated transcripts and embeddings.

Mock interview transcripts contain only your own voice and AI-generated interviewer questions; no third-party audio is involved. Real interview transcripts may capture the voice content of other participants, and the consent obligations in Section 12 apply.

15. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at contact@subcueai.com.