Privacy Policy

1. Who we are and scope

1.1 This Privacy Policy explains how Nepotize Pte. Ltd. (UEN 202641292E), of 7500A Beach Road, #09-324, The Plaza, Singapore 199591 ("Nepotize", "we", "us", "our"), collects, uses, discloses and protects your personal data when you use the Nepotize website and web application (the "Service").

1.2 We are the organisation responsible for your personal data under the Singapore Personal Data Protection Act 2012 ("PDPA"). Where the EU or UK General Data Protection Regulation applies, we are the data controller.

1.3 This policy applies to everyone who visits our website, creates an account, or uses the Service, whether on the free plan or a paid subscription. It forms part of our Terms of Service.

1.4 "Personal data" means any data about an individual who can be identified from that data, or from that data together with other information we have or are likely to have access to.

2. Personal data we collect

2.1 We collect the following categories of personal data.

2.2 We do not ask for and you should not provide: national identification numbers, financial account numbers, health information, or any other sensitive data. If you mention such information in a recording or answer, we process it only as part of that recording or answer and do not extract or profile it.

2.3 If you sign up through a third-party login (such as Google or LinkedIn), we receive your name, email address and profile picture from that provider, as permitted by your settings there.

3. Voice and video recordings

3.1 Recordings are the most sensitive data we hold, so we treat them with extra care.

3.2 Consent. We record only when you press record in a voice or video interview mode. Your browser asks for microphone or camera permission the first time, and you can revoke it in your browser or device settings at any time.

3.3 What we do with them. We transcribe recordings to text, analyse the transcript and (for video) delivery cues such as pace, filler words and eye contact, and generate feedback for you. The AI models that do this are described in Section 5.

3.4 Who sees them. Only you can view your recordings in the Service. Our staff do not watch or listen to recordings except where you ask us to for support, where we need to investigate a security incident or abuse report, or where the law requires. Recordings are not shared with employers, universities or other users unless you expressly choose to share a specific recording.

3.5 No AI training without opt-in. We do not use your recordings to train or improve AI models unless you separately opt in through your account settings. You can withdraw that consent at any time and we will stop using your recordings for that purpose going forward.

3.6 Deletion. You can delete any recording from your account at any time. Deleted recordings are removed from our live systems within 30 days and from backups within 90 days.

3.7 Biometrics. We do not create face or voice templates to identify you, and we do not use facial recognition. Video analysis is limited to presentation feedback and is not used to infer protected characteristics.

4. How we use personal data and our legal bases

4.1 Under the PDPA we collect, use and disclose personal data with your consent, or where an exception applies (such as deemed consent by conduct, legitimate interests, or business improvement). Where the GDPR or UK GDPR applies, we rely on the legal bases in the right-hand column.

4.2 We will not use your personal data for a purpose that is materially different from those listed without telling you first and, where required, getting your consent.

5. AI processing and automated decisions

5.1 Nepotize uses third-party AI models to transcribe your recordings, score your answers and generate feedback. When you use these features, your recording, transcript or written answer is sent to the provider's servers for processing and the result is returned to us.

5.2 Our AI providers are listed in Section 6. We use them under contracts that prohibit them from using your data to train their own models and require them to delete it after processing, except where we state otherwise in Section 6.

5.3 AI feedback and scores are provided to help you practise. They are not used to make any decision that has a legal or similarly significant effect on you, such as a hiring decision. No employer or institution receives your scores from us unless you choose to share them.

5.4 AI output can be inaccurate. If you believe feedback is wrong or unfair, you can flag it in the Service or contact us, and we will review it.

5.5 We may use anonymised, aggregated statistics (for example, average scores by question type) to improve the Service. These statistics cannot be used to identify you.

6. Who we share data with

6.1 We do not sell your personal data. We share it only with the service providers below, who act on our instructions, and in the limited other situations in Section 6.3.

6.2 Each provider is bound by a contract that limits its use of your data to the service it provides to us and requires appropriate security. A current list of the specific providers (sub-processors) in each category is available on request to support@nepotize.com.

6.3 We may also disclose personal data: to professional advisers (lawyers, accountants, auditors) under confidentiality; to a buyer or successor if Nepotize is acquired or merges, in which case this policy continues to apply; to law enforcement, regulators or courts where required by law or to protect our rights, your safety or the safety of others; and with your consent, for example when you choose to share a recording with someone.

7. International transfers

7.1 Nepotize is based in Singapore. The Service is hosted in the United States, and the providers in Section 6 process data there.

7.2 Under the PDPA, we transfer personal data outside Singapore only where the recipient is bound by legally enforceable obligations to protect it to a standard comparable to the PDPA, through our contracts with them.

7.3 Where the GDPR or UK GDPR applies, we transfer personal data outside the EEA or UK only under an adequacy decision, the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards using the contact details in Section 16.

8. How long we keep personal data

8.1 We keep personal data only as long as needed for the purposes in Section 4, then delete or anonymise it.

8.2 We may keep data longer where required by law, to resolve a dispute, or to enforce our Terms. Inactive free accounts may be closed and their data deleted after 24 months of inactivity, with notice by email first.

9. Security

9.1 We protect personal data with technical and organisational measures appropriate to its sensitivity, including encryption in transit (TLS) and at rest, access controls so that only staff who need data can reach it, hashed passwords, logging of access to recordings, and regular review of our providers' security.

9.2 No system is completely secure. If we discover a data breach that is likely to cause significant harm to you, we will notify the Personal Data Protection Commission within 3 calendar days as the PDPA requires, and notify you as soon as practicable, as well as any other regulator required under Section 15.

9.3 You are responsible for keeping your password confidential and for the security of the device you use to access the Service.

10. Your rights

10.1 Under the PDPA you have the right to:

• Access the personal data we hold about you and learn how it has been used or disclosed in the past year;
• Correct an error or omission in your personal data;
• Withdraw consent to our collection, use or disclosure of your personal data, on reasonable notice. Withdrawing consent for data we need to run the Service may mean we have to close your account;
• Data portability of data you provided to us, in a commonly used machine-readable format, where the PDPA's portability obligation is in force.

10.2 You can exercise most of these rights yourself: download your recordings and practice history, edit your profile, delete recordings, and close your account from your account settings. For anything else, email support@nepotize.com. We will respond within 30 days; if we need longer, we will tell you why.

10.3 We may ask you to verify your identity before acting on a request. We may charge a reasonable fee for access requests that are complex, and will tell you the fee before proceeding.

10.4 If you are not satisfied with how we handle your request, you can complain to the Personal Data Protection Commission of Singapore (www.pdpc.gov.sg). Residents of other regions have the additional rights and complaint routes set out in Section 15.

11. Cookies and analytics

11.1 We use cookies and similar technologies (local storage, pixels) for three purposes:

• Strictly necessary — keeping you logged in, remembering your settings, protecting against fraud. These cannot be switched off.
• Analytics — understanding how the Service is used so we can improve it. We do not currently use third-party analytics cookies; if we introduce them, they will be set only with your consent where the law requires it.
• Marketing — measuring the effectiveness of our advertising. We do not currently use advertising pixels; if we introduce them, they will be set only with your consent.

11.2 You can manage non-essential cookies through the cookie banner on our website or your browser settings. Our Cookie Notice lists each cookie, its purpose and its lifetime.

11.3 We honour Global Privacy Control signals from your browser where the law requires us to.

12. Children

12.1 The Service is designed for university students and working professionals. Paid subscriptions are available only to users aged 18 or over.

12.2 Users aged 13 to 17 may use the free plan with the consent of a parent or guardian, who accepts our Terms and this policy on their behalf. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, email support@nepotize.com and we will delete it.

12.3 Where the law of your region sets a higher age for consenting to data processing (for example, 16 in some EU countries), that age applies.

13. Marketing communications

13.1 We send marketing emails (product updates, tips, offers) only if you opt in at sign-up or in your settings. Every marketing email includes an unsubscribe link, and you can also opt out in your account settings. Opting out does not affect service emails such as receipts, renewal notices or security alerts.

13.2 We do not send marketing SMS or make marketing calls. We comply with the Spam Control Act 2007 and the PDPA Do Not Call provisions.

13.3 We do not share your contact details with third parties for their own marketing.

14. Changes to this policy

14.1 We may update this policy as the Service, the law or our providers change. The "Last updated" date at the end shows the current version.

14.2 If a change materially affects how we use your personal data, we will notify you by email or in-app notice at least 30 days before it takes effect, and where the change requires fresh consent we will ask for it. Continuing to use the Service after that date means you accept the updated policy.

15. Region-specific terms

If you are resident in one of the regions below, the following additional terms apply and prevail over any conflicting term elsewhere in this policy.

15.1 European Union / EEA and United Kingdom (GDPR and UK GDPR)

(a) Controller. Nepotize Pte. Ltd. is the controller. We do not currently have an establishment in the EEA or UK. [If we are required to appoint an EU or UK representative under Article 27, their details will be listed here.]

(b) Legal bases. The GDPR column of the table in Section 4 sets out our legal basis for each purpose. Where we rely on legitimate interests, we have balanced them against your rights and you may object (see (c)).

(c) Your rights. In addition to the rights in Section 10, you have the right to: erasure ("right to be forgotten"); restriction of processing; data portability; to object to processing based on legitimate interests or for direct marketing; not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and to withdraw consent at any time without affecting processing already carried out. We will respond within one month, extendable by two further months for complex requests.

(d) Transfers. Transfers to Singapore and the United States are made under the safeguards described in Section 7.3.

(e) Complaints. You may lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

(f) Breach notification. We will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights, and notify you directly where the risk is high.

15.2 United States (including California)

(a) Categories collected and disclosed. In the past 12 months we have collected the categories of personal information listed in Section 2 and disclosed them to the service providers in Section 6 for business purposes. We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended ("CCPA").

(b) Sensitive personal information. Recordings may constitute sensitive personal information. We use them only to provide the Service you requested and do not use them to infer characteristics about you.

(c) Your rights. California residents (and residents of other states with comparable laws, including Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have the right to know what personal information we collect and how it is used, to access it, to correct it, to delete it, to opt out of sale or sharing (we do none), to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. Submit requests to support@nepotize.com or through your account settings. You may use an authorised agent; we will verify the request. We respond within 45 days, extendable once by 45 days.

(d) Children. We comply with the Children's Online Privacy Protection Act and do not knowingly collect personal information from children under 13.

(e) Do Not Track and Global Privacy Control. We treat a Global Privacy Control signal as a valid opt-out of sale or sharing where required.

15.3 Australia

(a) We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 to the extent they apply to us.

(b) Personal information may be disclosed to recipients in Singapore and the United States as described in Sections 6 and 7. We take reasonable steps to ensure those recipients handle it in accordance with the Australian Privacy Principles.

(c) You may complain to us first using the contact details in Section 16. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

15.4 Other regions

If the privacy law of your country of residence gives you rights beyond those in this policy, those rights apply. We may add further regional terms as we expand.

16. Contact and Data Protection Officer

Our Data Protection Officer, appointed under section 11(3) of the PDPA, can be reached at:

Please put "Privacy" in the subject line so we can route your message quickly.