Privacy Policy

Who we are

Training Turk, operated by the founder until a company is registered, is responsible for your personal information. In legal terms we are the controller under the GDPR and UK GDPR, the Data Fiduciary under India's Digital Personal Data Protection Act 2023, and the business under California privacy law.

The founder is based in Dubai, United Arab Emirates. Once a company is registered, [ENTITY NAME] of [REGISTERED ADDRESS] takes over this role and we will update this policy.

Contact us about privacy at support@trainingturk.com.

What this policy covers

This policy covers the Training Turk website and service. It does not cover Mercor, micro1 or other sites we link to; they have their own policies.

It applies wherever you live. Later sections add rights for people in the EU, the UK, India, Australia and California.

Information we collect

We collect:

• Account details: your name, email address and profile picture from your sign-in provider. We never receive your password.
• Resume: the cleaned text we read from the PDF or Word file you upload. We do not keep the file itself.
• Voice recordings of your interview calls, kept for 30 days.
• Transcripts of your answers, with word timings, and what the interviewer said.
• Exercise work: rubrics, grades, comparisons, written deliverables and code you produce in the service.
• Scores, feedback and reports the service produces about your work.
• Call records: microphone and connection checks, when you joined and left, reconnections, and the recording consent you gave before the call.
• Payment records: what you bought, the amount, the date and the status, and a transaction ID for crypto payments. We never see your full card number.
• Usage logs: pages visited, actions, timestamps, browser and device type, IP address and error reports.
• Country and time zone, from your browser or IP address or from you. Never your precise location.
• Records of your choices, such as when you accepted our terms, and messages you send us.
• Saved jobs: the roles you bookmark, so they appear on your dashboard.
• Apply clicks: when you use an Apply button, which job, which page you clicked from and, if you are signed in, your account. Apply buttons are referral links: Mercor or micro1 may pay us a referral bonus if you are hired. We do not send them your details; they see only our referral code on the link.

Your voice, camera and microphone

During a call your voice travels to our call provider and speech provider, which turn it into text as you speak.

We store a recording of each answer in private storage for 30 days, then delete it. We use it to produce an accurate transcript, to check quality and to settle disputes about a call.

After each answer, a speech provider transcribes the recording again, more carefully than is possible live, and your answer is graded from that transcript.

Your camera image is shown only on your own screen, to help you practise. It is never sent to us or stored. The face and lighting checks before a call run on your device.

Voice can count as biometric or sensitive data in some places. We do not use your voice to identify you. [verify: Illinois BIPA, Texas and Washington biometric laws, GDPR Article 9]

Removing personal details

Before your resume text or transcripts go to our AI provider, we automatically remove email addresses, phone numbers, links and your name.

Before content is used for training or shared with anyone outside our providers, we also remove your account ID and resume details and replace them with a random ID. We commit not to re-identify anyone and require the same of those we license to.

Removal is automated and may miss something, such as a name spelled unusually or an employer you mention aloud.

Please leave out sensitive information

We do not need health details, religious or political beliefs, ID numbers, your home address or your date of birth. Please keep them out of your resume and your answers.

If you include them anyway, we use them only to provide the service, and you can delete them at any time.

How we use your information

We use your information to:

• create and run your account and sign you in;
• run interviews and exercises, transcribe your answers, and produce scores, feedback and reports;
• grade your resume and fit interviews to you;
• process payments, add and return credits, and issue refunds;
• keep the service secure, prevent fraud and misuse of the refund rules, and enforce our terms;
• fix errors and understand, in aggregate, how the service is used;
• send service messages, such as receipts, security notices and notices of changes;
• build and improve AI, and license de-identified content to third parties, as described in the next section;
• keep records the law requires and respond to lawful requests.

AI training and licensing

As our Terms of Service explain, content you create in the service (answers, transcripts, exercise work and feedback) may be used to train, test and evaluate AI models, ours and other people's.

We may license or sell access to that content, for example to AI research labs. It goes out only in de-identified form, under a random ID, without your name, contact details or account details.

This is a condition of using the service, so there is no separate opt-in. You can stop future use by deleting your account. Content already de-identified and delivered cannot be recalled.

We do not sell your personal information, such as your name, email or resume, and we do not use it for targeted advertising. [verify: whether licensing de-identified content is a sale or sharing under CCPA and other US state laws]

Our legal bases (EU and UK)

If the GDPR or UK GDPR applies to you, we rely on:

• Contract: to provide your account, interviews, exercises, reports, credits and refunds.
• Legitimate interests: to keep the service secure, prevent fraud, fix errors, measure usage, and build and license de-identified datasets. You can object; see your rights below. [verify: legal basis for training and licensing under GDPR, and whether consent is needed]
• Legal obligation: to keep tax and accounting records and respond to lawful requests.
• Consent: for recording the call, which we ask for before each call, and where the law requires it for transfers. You can withdraw consent at any time.

Automated scoring

Scores and feedback are produced automatically by AI, as practice feedback only.

They do not lead to any decision about you with legal or similar effects, and we never share them with a hiring platform or employer. If you think a score is wrong, tell us and we will look.

Our service providers

We use the providers below. Each processes information only as needed for the purpose shown. We will update this list when providers change. [verify: final speech and language-model providers after the recogniser test, DECISIONS.md 2.8 and 5.4]

Stripe, NOWPayments and Google also act as independent controllers for some purposes, such as fraud prevention, under their own policies.

• Supabase: database, sign-in and private file storage, including recordings and resumes, United States
• Vercel: website hosting, United States, with a global delivery network
• LiveKit: the live call, and speech recognition and the interviewer's voice through its inference service, United States
• AssemblyAI: speech-to-text during the call, through LiveKit, United States
• Deepgram: backup speech-to-text during the call if AssemblyAI is unavailable, through LiveKit, United States
• ElevenLabs: a second transcript of each recorded answer, used for grading, United States [verify: ElevenLabs' processing location, how long it keeps audio and transcripts, whether it uses them to train its models, and whether its zero-retention option should be turned on]
• Inworld: the interviewer's synthetic voice (it receives only the interviewer's lines), United States
• DeepSeek: AI grading and generation of questions, feedback and summaries, on redacted text, People's Republic of China
• Stripe: card payments, United States and other countries where Stripe operates
• NOWPayments: cryptocurrency payments, location as stated in its privacy policy
• Google: sign-in, United States
• Cloudflare Turnstile: bot protection, United States, with a global network
• Sentry: error monitoring, United States

Who else receives information

Licensees, such as AI research labs, receive de-identified content only, under contracts that forbid re-identification.

We may disclose information where the law requires it, or to protect our rights, our users or the public.

If the service moves to a company, including the one we plan to register, your information moves with it under this policy, and we will tell you.

International transfers

The founder is in the United Arab Emirates and our providers are in several countries, including the United States and the People's Republic of China. Your information will be processed outside your home country.

Where the GDPR or UK GDPR applies, we protect transfers with recognised safeguards, such as the European Commission's standard contractual clauses and the UK addendum, or an adequacy decision. You can ask for a copy.

Important notice: AI processing in China

Our language-model provider, DeepSeek, processes data on servers in the People's Republic of China.

We send it redacted resume text, redacted transcripts and exercise work, and the job details needed for grading. We never send your name, contact details, links, profile picture, recordings or payment details.

Where the law requires it, we ask for your explicit consent to this transfer before you first use a feature that needs it.

Risks you should know about:

• China has no adequacy decision from the European Union or the United Kingdom.
• Chinese law may let public authorities access data held by companies there, with limited ways to challenge it.
• It may be harder to enforce your rights against a provider in China.

How long we keep information

We keep information only as long as we need it:

• Voice recordings: 30 days after the call, then deleted.
• Camera image: never stored.
• Account, resume, transcripts, exercise work, scores and reports: until you delete them or your account.
• De-identified training records: kept without a time limit, under a random ID that no longer links to you.
• Inactive accounts: deleted after 24 months without a sign-in, with at least 30 days' email notice. We keep a minimal record of unused credits so you can reclaim them.
• Payment records: as long as tax and accounting law requires, anonymised as far as possible when you delete your account. [verify: retention period required by tax law]
• Usage logs and error reports: up to 90 days.
• Support messages: while we handle your request and a reasonable time after.
• Backups: deleted data may stay in encrypted backups for a short time until overwritten. [verify: backup period at the database provider]

Download and delete your data

You can download your data from your account settings at any time, as a machine-readable file with your profile, resumes, transcripts, exercise work, scores, reports and payment history.

You can delete your account from your account settings. This removes your profile, resumes, recordings and anything that links content to you. Payment records are anonymised and kept only as tax law requires.

De-identified content already in training sets or delivered to licensees cannot be recalled, because it no longer links to you. Unused credits are lost when you delete your account, so ask for any refund first.

Cookies and analytics

We use only essential cookies, to keep you signed in, protect your account and remember basic settings. We do not use advertising or tracking cookies.

Our analytics are cookieless and count visits in aggregate. Cloudflare Turnstile may process your IP address and browser signals to check you are a person. [verify: analytics provider to name before launch]

Payment pages run by Stripe or NOWPayments may use their own cookies under their own policies.

How we protect your information

We use encryption in transit, access controls, and private storage for recordings and resumes. Our providers secure the systems they run for us.

No system is perfectly secure. If a breach affects your information, we will tell you and the authorities where the law requires.

Your rights in the EU and UK

We reply within one month, or tell you if a complex request needs up to two more months.

If the GDPR or UK GDPR applies to you, you can:

• access your information and get a copy;
• have it corrected;
• have it erased;
• receive it in a portable, machine-readable format;
• object to processing based on legitimate interests, including training and licensing;
• ask us to restrict processing in some cases;
• withdraw consent where we rely on it;
• complain to your data protection authority, or to the Information Commissioner's Office in the UK.

Your rights in India

Under the Digital Personal Data Protection Act 2023, you can get a summary of the data we process and who we shared it with, have it corrected or erased, withdraw consent, nominate someone to act for you, and have grievances handled.

Grievance Officer: [GRIEVANCE OFFICER NAME, EMAIL]. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Your rights in Australia

We handle your information in line with the Australian Privacy Principles, to the extent the Privacy Act 1988 applies to us. You can ask to access or correct it; we usually reply within 30 days.

We disclose information to providers outside Australia, mainly in the United States, and to DeepSeek in China with your consent. If you consent to that transfer, APP 8.1 does not apply to it, and you may find it hard to seek redress in China.

If you are not satisfied with how we handle a complaint, you can contact the Office of the Australian Information Commissioner.

California

In the past 12 months we collected identifiers, customer and commercial records, internet activity, general location, audio (call recordings), professional information (your resume), and inferences (scores and feedback), for the purposes in this policy.

You can ask to know, delete or correct your personal information, and we will not treat you differently for doing so. You or an authorised agent can email support@trainingturk.com; we verify the request and reply within 45 days.

We do not sell or share personal information as California law defines it, and we honour Global Privacy Control signals. De-identified content is licensed as described above. [verify: CCPA treatment of the licensing programme and any Do Not Sell or Share link]

People in other countries

If you live elsewhere, including the United Arab Emirates, you may have similar rights under local law, and we will handle your request in line with it. [verify: which UAE data protection law applies, onshore or DIFC]

How to make a request

Email support@trainingturk.com, or use the download and delete tools in your account settings.

We may ask you to write from the email address linked to your account. Requests are free unless clearly unfounded or excessive.

Children

The service is only for people aged 18 or over. If we learn we hold information about someone younger, we delete it.

Changes to this policy

We may update this policy, for example when providers change. We will tell you about important changes by email or a notice on the site.

If a change is material, we will ask you to review it at your next sign-in.

Contact us

You can reach us using the details below.

• Service: Training Turk (operated by the founder until a company is registered)
• Company name, once registered: [ENTITY NAME]
• Address: [REGISTERED ADDRESS]
• Email: support@trainingturk.com
• Grievance Officer for users in India: [GRIEVANCE OFFICER NAME, EMAIL]