Version of September 13, 2026
This is an English translation provided for convenience. The Polish-language version is the legally binding original and governs in the event of any discrepancy.
Lukasz Aszyk, operating as a sole proprietorship (JDG) under the trade name xlrt.cloud
ul. Złota 75A/7, 00-819 Warszawa, Poland
NIP (Polish tax ID): 5881835893
Contact for data protection matters: kontakt@intervue.pl · full contact details: Contact
The controller operates the website intervue.pl (the "Service") - an AI-based mock-interview practice tool, covering a free voice-demo interview, user accounts and paid interview packs.
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Waitlist | e-mail address, optionally an indicated role area, sign-up source | consent - Art. 6(1)(a) GDPR | until the service launches and introductory communications end, or until consent is withdrawn - whichever comes first |
| Free voice demo with AI | voice (real-time audio stream), demo conversation transcript | legitimate interest - Art. 6(1)(f) GDPR (enabling the demo the user knowingly initiated) | audio is not recorded by the Service; transcripts held by the voice-technology provider are deleted after 7 days at the latest |
| User account (calibrated practice) | e-mail address, account identifier (Firebase Auth), creation date | contract - Art. 6(1)(b) GDPR (providing the practice-interview service) | until the account is deleted |
| Interview calibration | company and role name, seniority level, job-posting text, optional experience description | contract - Art. 6(1)(b) GDPR | the raw job-posting text stays exclusively in our EU database and is never sent to the voice-technology provider - only generated question areas and a short, anonymized experience summary reach the conversation |
| Calibrated practice interview | voice (real-time stream), conversation transcript, session metadata | contract - Art. 6(1)(b) GDPR | audio is not recorded by the Service; transcripts held by the voice-technology provider are deleted after a maximum of 30 days |
| Technical and security logs | IP address, technical request data | legitimate interest - Art. 6(1)(f) GDPR | up to 30 days |
| Package purchase and payments | e-mail address, purchased package name and price, transaction identifier, payment status and date, optionally VAT invoice details (name or company name, address, tax ID) | contract - Art. 6(1)(b) GDPR (fulfilling the purchase); legal obligation - Art. 6(1)(c) GDPR (tax and accounting law) | billing records are kept for the period required by Polish tax law (generally 5 years from the end of the calendar year in which the tax became due) |
| Marketing communication (e-mail) | e-mail address plus proof of consent: date and time, source (registration, starting an interview, checkout or the account panel), version of the consent wording, language, IP address and browser identifier at the moment consent was given or withdrawn | consent - Art. 6(1)(a) GDPR, and Art. 10 of the Polish Act on Providing Services by Electronic Means | until consent is withdrawn; the record of consent being given and withdrawn is kept for 3 years after withdrawal, solely to demonstrate compliance (Art. 7(1) GDPR) |
| Usage statistics (Google Analytics 4) | site-usage data (pages visited, events, approximate location, device data), cookie identifiers | consent - Art. 6(1)(a) GDPR (consent banner; the tool loads only after clicking "Accept") | per Google Analytics' retention settings (up to 14 months); consent can be withdrawn by clearing cookies and declining the banner |
| Ad-effectiveness measurement (Meta Pixel and Conversions API) | site-usage data (pages visited, events), cookie identifiers (incl. _fbp) and the ad click identifier (fbclid, stored as _fbc), device data, IP address. On account registration, when a conversation starts and on purchase we additionally send a hashed (SHA-256) e-mail address and account identifier - never in plain form - and on purchase also the order amount and type. These events are also sent from our server (Conversions API), only with the consent given in the banner. | consent - Art. 6(1)(a) GDPR (consent banner; the tool loads only after clicking "Accept") | per Meta's policy (_fbp cookie up to 90 days); consent can be withdrawn by clearing cookies and declining the banner |
| Ad-effectiveness measurement (TikTok Pixel and TikTok Events API) | site-usage data (pages visited, events), cookie identifiers (incl. _ttp) and the ad click identifier (ttclid), device data, IP address. On purchase we additionally send a hashed (SHA-256) e-mail address and account identifier - never in plain form - together with the order amount and type. Some events (the purchase) are sent from our server rather than the browser, so that a purchase paid by bank transfer after the page was closed is still attributed correctly. | consent - Art. 6(1)(a) GDPR (consent banner; the tool loads only after clicking "Accept", including for the server-side send) | per TikTok's policy; the click identifier is kept for up to 30 days; consent can be withdrawn by clearing cookies and declining the banner |
Analytics and marketing tools (Google Analytics 4, Meta Pixel, TikTok Pixel) are loaded only after consent is given in the banner - until then, no analytics or marketing cookies are set.
During the voice demo, your voice is processed by ElevenLabs Inc., based in the USA. The transfer is based on standard contractual clauses (SCCs) approved by the European Commission, supplemented by minimization measures: we do not send the provider your surname or account data, audio is not retained by us, and demo transcripts are subject to short, automatic deletion (within 7 days at the latest). In the demo the AI recruiter asks for your first name - if you give one it will appear in the transcript held by the provider and is deleted along with it. Giving a name is not required: the conversation continues without it.
In connection with the processing of your data, you have the right to: access your data, rectify it, erase it, restrict processing, port your data, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal).
Requests are handled by contacting kontakt@intervue.pl - we respond within one month at the latest. You also have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (uodo.gov.pl).
Providing data is voluntary. Joining the waitlist and using the demo are not conditions for browsing the Service - however, without your data we won't be able to notify you of the launch or run the demo interview.
The Service uses artificial intelligence to conduct the demo conversation, which we disclose before it begins. The demo is for illustration and practice only - we do not make automated decisions that produce legal effects concerning you, we do not carry out employment assessments, and we do not analyze emotions or biometric characteristics.
We may update this policy as the Service develops (e.g. the launch of user accounts and payments). The current version is always available at intervue.pl/polityka-prywatnosci (Polish original) and intervue.pl/en/privacy (this translation), together with its version date.