Privacy Policy

The controller of your data is:

• Mr Marceau Timbal-Duclaux de Martin--Loury, sole trader (entrepreneur individuel, EI), operating the “Vocaway” service.
• Address: 25 rue Broca, 75005 Paris, France.
• SIREN: 999 443 013 — SIRET: 999 443 013 00019.
• Data protection contact: Mr Marceau Timbal-Duclaux de Martin--Loury (no Data Protection Officer is legally required at present).
• Dedicated privacy contact: contact@vocaway.com

• Email address, last name, first name or username, preferred language and theme.
• Password, stored only as an irreversible hash.
• If you sign in with Google: Google ID, name, email address and profile picture provided by Google with your consent. We never receive your Google password.
• Profile and role (individual, student, member or manager of an institution).

• Your voice, captured by the microphone during simulations and streamed live to speech recognition to be transcribed; no audio recording is kept.
• Written transcripts of your exchanges with the AI recruiter.
• Documents you upload (CV, job posting, cover letter).
• Simulation settings, assessment reports, scores, indicators (speaking rate, pauses, verbal tics, speech structure) and progress history.

• History of orders, subscriptions, credit packs, invoices and billing details.
• Bank card details are entered directly with Stripe and are never received or stored by Vocaway.

• When your account is linked to a school or organisation: cohort membership, access code used, credits allocated, participation and aggregated or individual results made available to the institution’s managers within the limits set out in the contract.

• Content of your messages, email address and information needed to handle your request.

• IP address, browser and device type, connection timestamps, access logs, error logs and logs of sensitive actions.
• Preferences saved on your device (language, theme, cookie choices).

Each processing operation is based on a specific legal basis (Article 6 GDPR):

• Creating and managing your account, authentication (including via Google).
  • Legal basis: performance of the contract (Terms of Use) — Article 6(1)(b) GDPR.
• Running simulations: live transcription of your voice, analysis of uploaded documents, responses from the AI recruiter, generation of the assessment report and tracking of your progress.
  • Legal basis: performance of the contract — Article 6(1)(b) GDPR.
• Beta tester programme: answers to the questionnaires completed after Simulations, linked to the Simulation concerned, to improve the AI recruiter, the assessment report and the Platform. They are deleted along with your account.
  • Legal basis: performance of the contract (programme terms accepted on joining) — Article 6(1)(b) GDPR.
• Payments, management of subscriptions and credits, invoicing and accounting.
  • Legal basis: performance of the contract (Article 6(1)(b)) and compliance with a legal obligation to keep accounting and tax records (Article 6(1)(c)).
• Security of the Platform, prevention of fraud and abuse, security logs.
  • Legal basis: Vocaway’s legitimate interest in protecting the Service and its users (Article 6(1)(f)).
• User support and service emails (address verification, password reset, security alerts, account information).
  • Legal basis: performance of the contract and legitimate interest in responding to your requests (Articles 6(1)(b) and 6(1)(f)).
• Cohort management for client schools and organisations.
  • Legal basis: performance of the contract between Vocaway and the institution (Article 6(1)(b)), and the institution’s legitimate interest in monitoring the training of its members (Article 6(1)(f)).
• Non-essential cookies and trackers (audience measurement, where applicable).
  • Legal basis: your consent (Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act), which you can withdraw at any time.

Vocaway does not sell your data and does not use it for advertising purposes.

Your email address and password (or Google sign-in) are required to create an account. Microphone access and voice transcription are essential to run a simulation. Billing data is required for any purchase. Without this data, the corresponding service cannot be provided.

Other information (photo, uploaded documents, details about your profile) is optional.

• You are interacting with an artificial intelligence system: the recruiter is not a real person, and the voice you hear is synthetic, generated by AI.
• To operate, the content of your simulations (audio, transcripts, uploaded documents and instructions) is sent to Mistral AI (France), which provides the language models, speech recognition and speech synthesis. Vocaway contractually requires that this content not be used to train or improve Mistral AI’s models.
• The assessment report is automated scoring produced for training purposes only. It has no legal effect and does not significantly affect you within the meaning of Article 22 GDPR: it is neither an official grade nor a recruitment or admission decision.
• You can challenge an assessment or ask for it to be reviewed by a person by writing to support: contact@vocaway.com.
• Results produced by the AI may contain errors; they should be interpreted as educational advice.

Your data is accessible only to authorised Vocaway personnel and, within the limits of their tasks, to the following processors, who act on instructions and are bound by confidentiality and security commitments:

• Mistral AI SAS — France (European Union)
  • Language models, transcription (Voxtral) and speech synthesis for simulations.
• Stripe Payments Europe Ltd — Ireland, with possible transfers to Stripe, Inc. (United States)
  • Online payment, subscription management, fraud prevention.
• OVH SAS — France
  • Hosting of the application and data.
• OVH SAS (OVHcloud Object Storage) — France
  • Storage of uploaded documents and assessment reports exported as PDF.
• Brevo SAS — France
  • Sending of service emails (email service).
• Cloudflare, Inc. — United States
  • Website delivery (CDN), protection against attacks (web application firewall) and Cloudflare Turnstile anti-bot verification on the sign-up, sign-in, forgotten password and contact forms (processing of the IP address and technical browser characteristics).
• Google Ireland Ltd / Google LLC — Ireland and United States
  • Only if you choose to sign in with Google (authentication).

If your account is linked to an institution, that institution’s designated managers also receive the cohort information described in Article 2.4. Finally, your data may be disclosed to the authorities where required by law.

Simulation data is processed by Mistral AI in France. Some providers may transfer data to the United States: Stripe, Google and Cloudflare. These transfers are covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which these companies are certified, and, failing that, by the European Commission’s standard contractual clauses.

You can obtain a copy of these safeguards by writing to contact@vocaway.com.

• Account: for the entire duration of the contractual relationship.
• Inactive individual or student account with no ongoing subscription: deleted after 3 years without sign-in. A warning email is sent to you 30 days before deletion. Accounts of an institution’s managers and staff are kept for the duration of the contract concluded with the institution.
• Account whose email address has not been verified: deleted 30 days after creation.
• Transcripts, uploaded documents and assessment reports: kept until you delete them or until your account is deleted.
• Account deletion: takes effect at the end of a 30-day grace period, during which you can cancel it by signing in again. After this period, the data is permanently erased.
• Invoices and accounting records: 10 years (Article L. 123-22 of the French Commercial Code).
• Security logs: 12 months maximum.
• Support communications: for as long as needed to handle the request, then no more than 3 years after the last contact.
• Cookie choices: 6 months, after which you are asked again. Proof of these choices (random identifier, version, date, decision) is kept for 5 years and 6 months.

You have the following rights over your data:

• Right of access (Article 15 GDPR) and right to rectification (Article 16).
• Right to erasure (Article 17), subject to legal retention obligations.
• Right to restriction of processing (Article 18).
• Right to object (Article 21) to processing based on legitimate interest.
• Right to data portability (Article 20) for the data you have provided to us.
• Right to withdraw your consent at any time, without affecting processing already carried out.
• Right to set instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).

• Data export: from Settings, you can download a copy of your data in a structured, machine-readable format.
• Account deletion: from Settings, with a 30-day grace period during which you can cancel the deletion.
• Rectification: your profile information can be edited at any time from Settings.
• Cookies: via the “Manage cookies” link at the bottom of every page.

You can also exercise your rights by writing to contact@vocaway.com. We may ask you to prove your identity if there is reasonable doubt. We respond within one month, which may be extended by two months for complex requests; you will be informed if so.

If you believe your rights have not been respected, you can lodge a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

The Service is intended for persons aged at least 15. In accordance with Article 45 of the French Data Protection Act, a minor under 15 may only use the Service with the joint consent of one of the holders of parental authority. If we learn that an account has been created without this consent, we may suspend or delete it.

Vocaway implements appropriate technical and organisational measures, including:

• Encryption of communications (HTTPS/TLS).
• Strong password hashing (Argon2id).
• Sessions protected by secure cookies (httpOnly).
• Strict access control and logging of sensitive actions.

In the event of a data breach that poses a risk to your rights, the CNIL is notified within 72 hours and you are informed without delay if the risk is high.

The Platform uses cookies and local storage that are strictly necessary for it to function. Non-essential trackers are only placed with your consent, which you can change at any time via the “Manage cookies” link. Details are provided in the Cookie Policy.

This policy may change. The version and effective date appear at the top of this page. In the event of a significant change, you will be informed by email or by a notification in your account area at least 30 days before it takes effect.