Privacy Policy

1. Information we handle

• Account and profile: your name, phone number, authentication details, optional email and profile photo, division/district, education institute and level, preparation goals, and other details you choose to provide. Interview background can include your hometown, current location, employment and achievements. These are details you enter, not a request for GPS access.
• Interview practice: selected interview settings, questions, microphone audio, spoken or typed answers, transcripts, optional background information, derived practice measurements, scores, reports and improvement suggestions.
• Learning and career activity: quiz attempts and scores, practice history, progress, streaks, saved questions, saved job circulars, notification choices and reminder settings. Your display name, profile photo and scores may appear to other users in leaderboards or battles.
• Optional CV content: contact details, education, work history, skills, achievements, references and a selected photo. Include another person’s details only with their permission. CV storage differs between the website and app, as explained below.
• Service records: support messages, purchase amounts and references, package/credit history, coupon or referral records, notification tokens, and technical information such as IP address, device/browser information, request errors and operational logs.

2. Why we use this information

We use information to authenticate accounts, provide interviews and feedback, save progress, deliver requested learning and career features, apply account access, handle payments and support, send selected notifications, investigate errors and prevent misuse. Optional interview background helps make questions relevant to your experience.

AI feedback is practice guidance, not an official examination result, hiring decision, medical assessment or verified judgement of your personality.

3. AI services and information sent to them

• Sarvam AI powers the currently enabled Pro voice interview: speech recognition, conversational responses and examiner speech. Interview audio, conversation text and the background you supply can pass through VivaBoard’s voice gateway to Sarvam.
• OpenAI is used for interview evaluations, reports, follow-up/personalized text features and audio-transcription paths. Depending on the feature, it receives transcripts, questions, supplied context, practice measurements or audio. Not every request is sent to every provider.
• Google Gemini has a test integration, but Ultra/Gemini interviews are not enabled in the current public production configuration. Google Firebase/Cloud infrastructure and on-device Google ML Kit are separate from Google’s generative AI service. A future enabled AI integration will require updated disclosure and applicable consent.

Provider retention, model-improvement use and processing locations depend on the provider’s applicable terms and account settings. We do not promise zero retention, a universal no-training arrangement or processing only in Bangladesh. Avoid unnecessary sensitive information in answers, background details or support messages.

Provider information: Sarvam AI · OpenAI API data controls

4. Camera, face analysis and microphone

• Native iOS: the prepared app processes camera preview and face analysis on the device. Raw camera frames are not sent to the voice AI service. Temporary snapshots are used for local analysis; the app attempts to remove them after analysis.
• Android: the inspected native implementation also uses on-device ML Kit face detection and temporary snapshots. Web app: camera images are analysed locally in a browser worker using MediaPipe; downloading its model files is not uploading your camera images.
• Derived measurements, such as face presence, head position, gaze estimates and eye-open scores, may be saved with sessions and accompany evaluations. These are practice indicators, not an identity-verification or face-recognition login system. Microphone audio is different: it is transmitted for speech and interview processing.

5. Cloud records, local recordings and CVs

Account records, interview transcripts/reports and learning history are stored through Firebase services. Selected profile photos are uploaded to Firebase Storage. Audio is transmitted to provide AI services; local review recordings and recovery files can also remain on your device. This does not mean every interview has a cloud audio or video recording.

The standalone website CV generator checks whether your phone number belongs to a registered account. It returns access, not your account profile. CV text and the selected CV photo are assembled in the browser; this builder does not send the completed CV to an AI provider or save it to your account. Its access token is kept in session storage.

The app and web-app CV builders save drafts locally on the device/browser when you use Save. They are not a guaranteed cross-device backup. Exported PDFs, images and files you share remain wherever you save or send them; deleting a VivaBoard account cannot recall those copies.

6. Other service providers and sharing

Google Firebase/Cloud provides authentication, databases, storage and backend hosting; VivaBoard also uses website/voice hosting. MIM SMS receives the recipient number and message for OTP delivery, with BulkSMSBD as a failure fallback. Payment-enabled Android/web flows use EPS and its payment partners. Transaction and referral records support access, accounting and disputes; the first iOS release has no package checkout.

Where enabled for eligible free-tier Android users, Google AdMob may process device identifiers, ad interactions and diagnostic information under its own terms and consent settings. The first iOS release excludes advertising. External video, job, payment or other links can take you to services with their own privacy practices.

Authorized operators can access relevant account, performance, support and transaction records to run the service. We may disclose relevant information to respond to a valid legal requirement, investigate misuse or resolve a dispute. Information can be processed outside your country; no Bangladesh-only hosting promise is made.

Google Firebase privacy & security

7. AI consent and device permissions

The prepared first iOS release includes an AI-sharing consent screen before interview features and a Profile → Privacy & AI consent control to withdraw it. These controls apply when that release is available and enabled; this policy does not announce that an iOS release or its complete backend is already operational. Existing Android/web screens can differ.

You can stop an interview and avoid further AI use, revoke microphone/camera/speech/photo permissions in device or browser settings, or contact us to withdraw consent for future optional processing. Declining a permission can prevent the related feature from working. Withdrawal does not undo processing already completed or automatically delete saved records.

8. Notifications and platform differences

Android push uses Firebase Cloud Messaging tokens linked to your account. The prepared iOS implementation uses separate Expo push tokens, with Expo forwarding messages through Apple Push Notification service after the required configuration and release checks. A token routes notifications; it is not your phone number. Change job-notification choices in the app and system notification permissions in settings.

The first iOS release is access-only for the features available to your account. It has no ads, package checkout, coupon/code redemption or Android home-screen widgets. Existing Android/web purchase and feature behavior is separate. Language preferences, sign-in state, content caches, CV drafts and consent choices can use local browser/device storage. Clearing that storage can remove local settings or drafts.

9. Retention, financial records and backups

Saved account/profile data, transcripts, reports, learning history and support records currently have no fixed automatic deletion period configured in VivaBoard. They remain stored unless removed through an available control or a processed deletion request. We do not claim that these records automatically disappear after 30 or 90 days.

Local recordings and CV drafts can remain until you remove them, clear app/browser data or use the relevant cleanup control. Temporary review and recovery files have different lifecycles; closing a screen is not a guarantee that every local file was erased.

Payment receipts, subscription transactions, pending-payment, coupon and referral/commission records can be retained after account deletion for accounting, refunds, fraud prevention, disputes and applicable legal duties. They may still contain account identifiers. A fixed automatic purge period for these ledgers has not been configured; contact us about the records relevant to your request.

Hosting/provider logs and any backups have their own retention and deletion processes. We have not verified a single backup-erasure deadline across all services and do not promise immediate removal from every backup. Copies exported, shared or retained offline on other devices are outside an account-deletion action.

10. Access, corrections and account deletion

Use available profile, history, CV and local-recording controls to manage your information. You can also email privacy@vivaboard.app to request access, correction, export or deletion. Tell us the registered phone number and what you want changed or removed. We may need to verify ownership, but never send your PIN, OTP, wallet PIN or payment-card security code by email.

In-app account deletion is planned for the first iOS release, but this policy does not announce that the new flow is available. If your installed version does not have a working Delete account control, request deletion through the monitored privacy email above. Uninstalling the app or signing out does not delete your account.

Account deletion covers consumer account data subject to the retained records explained above. Linked admin or representative business records may require a separate verified closure process. We will explain any additional verification, retained records or limitations relevant to your request rather than promise an unverified completion deadline.

11. Security and responsible sharing

The service uses HTTPS/WSS connections, authentication and access controls. These measures reduce risk but cannot guarantee absolute security. Protect your device and login details. Do not include sensitive third-party information in practice answers or a CV without permission. If you believe a child’s information was submitted inappropriately, contact our privacy address so we can review it.

We update this page when the described practices change. The date above identifies this version. A feature announcement or a policy update does not by itself activate an unavailable feature or replace a required consent choice.