Privacy Policy
Last updated: 23 August 2026
Whitepad ("Whitepad", "we", "us") provides an AI-powered mock-interview product at whitepad.app. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have. We are the data controller for the personal data described here.
If you have any questions, contact us at support@whitepad.app.
Information we collect
Account information. When you sign up, our authentication provider (Clerk) collects your name, email address, and — if you sign in with Google — basic profile information. We store your email and a user identifier.
Session content. When you run a mock interview, we process:
- your voice audio (streamed in real time so the interviewer can hear you),
- the transcript of the conversation,
- the contents of your whiteboard (the diagram you draw), and
- the scorecard / recap generated at the end.
Billing information. If you purchase a plan, our payments provider (Stripe) processes your payment details. We do not store your full card number — Stripe handles that. We store your subscription status, plan, and credit balance.
Usage data. We collect basic, privacy-friendly analytics (page views, referrers, approximate country/device) to understand and improve the product. Our analytics are cookieless.
How we use your data
- To provide the service — run interviews, generate scorecards, and show your history.
- To manage your account, subscription, and billing.
- To operate, secure, maintain, and improve the product.
- To communicate with you about your account or support requests.
- To comply with legal obligations.
We do not sell your personal data.
Sub-processors and third parties
We rely on trusted third parties to run the service. Each processes personal data only to provide their function:
| Provider | Purpose |
|---|---|
| Clerk | Authentication and account management |
| Stripe | Payment processing and subscriptions |
| Anthropic (Claude) | Powers the AI interviewer and scoring |
| Deepgram | Speech-to-text (transcribing your voice) |
| ElevenLabs | Text-to-speech (the interviewer's voice) |
| LiveKit | Real-time audio transport during a session |
| Vercel | Website hosting and analytics |
| PostHog | Product analytics (how the app is used), EU-hosted |
| Cloudflare | DNS, security, and backup storage |
| Hetzner | Server hosting for our backend and database |
Legal bases (GDPR)
Where GDPR applies, we process personal data on these bases:
- Performance of a contract — to provide the service you sign up for.
- Legitimate interests — to secure, maintain, and improve the product.
- Consent — where required (you can withdraw it at any time).
- Legal obligation — where we must retain or disclose data by law.
Data retention
We keep your account and session data for as long as your account is active, and for a reasonable period afterward as needed for legal, accounting, and security purposes. Backups are retained on a rolling basis (currently 30 days) and then deleted. You can request deletion of your data at any time (see below).
Your rights
Depending on your location (including under GDPR), you have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. To exercise any of these, email support@whitepad.app and we will respond within the timeframe required by law. You also have the right to lodge a complaint with your local data protection authority.
Cookies
We use a small number of strictly necessary cookies for authentication (to keep you signed in). Our analytics are cookieless and do not track you across sites. We do not use advertising cookies.
International data transfers
Some of our providers are located outside your country (for example, in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Security
We use industry-standard measures to protect your data, including encryption in transit, access controls, and encrypted, offsite database backups. No system is perfectly secure, but we work to protect your information.
Children
Whitepad is not directed at children and is intended for users aged 16 and over (or the age of digital consent in your country). We do not knowingly collect data from children.
Changes to this policy
We may update this policy from time to time. We will update the "Last updated" date above and, for material changes, take reasonable steps to notify you.
Contact
Questions about this policy or your data? Email us at support@whitepad.app.