Privacy Policy
Last updated: 25 August 2026
This policy explains what personal data DryRun collects, why, what we do with it, and what rights you have over it.
DryRun is operated by David Beakey, trading as DryRun, a sole trader (autónomo) established in Spain, business address Plaza José María Orense 7, 74, 46022 Valencia, Spain. For the purposes of the General Data Protection Regulation (GDPR) and Spanish data protection law (Ley Orgánica 3/2018, LOPDGDD), we are the data controller for personal data processed through the Service.
1. In short
- We collect your CV, the job posting, any context you add, and the text transcript of your spoken answers.
- We do not retain any recording of your voice. Your answers are transcribed as you speak, and only the text is kept.
- We do not use your content to train any AI model, ours or a provider's.
- We use third party providers to run the interview and generate your coaching. They process your data on our instructions and do not train on it.
- We run no analytics, no advertising, and no third party tracking.
- Our data is hosted in the United States, under Standard Contractual Clauses.
- You can ask us for a copy of your data, or ask us to delete it, at any time. Deletion is immediate and permanent.
2. What we collect
Account data. Your name, email address, and password (stored hashed, never in readable form).
Interview inputs. The CV you upload or paste. The job posting you upload or paste. The context you provide about the interview: which round it is, what you expect to be asked, who is interviewing you, how previous rounds went, and anything else you choose to add.
Transcript data. The text transcript of your spoken answers. Your answers are transcribed as you speak. We do not store the audio recording of your voice, and neither does our voice provider.
Interview output. The questions generated for you, the record of the conversation, and your coaching reports.
Payment data. Payments are processed by Stripe. We store only a Stripe session reference and customer reference. We never receive or store your card number.
School access data. Where you access the Service using a school-issued code, we record the redemption of that code and the access it grants.
Technical data. Limited technical data necessary to run and secure the Service, including error diagnostics and a record of how often you call our services (used to detect abuse). Error diagnostics are automatically deleted after 30 days.
Correspondence. Any messages you send us, including school enquiries.
3. Why we process it, and on what legal basis
| What | Why | Legal basis |
|---|---|---|
| Account data | To create and secure your account | Performance of a contract |
| CV, job posting, context | To generate an interview tailored to your role | Performance of a contract |
| Transcripts | To conduct the interview, generate your coaching report, and let you review your history | Performance of a contract |
| Payment data | To take payment and meet accounting obligations | Contract, and legal obligation |
| School code redemption | To provide access arranged by your school | Performance of a contract |
| Technical data | To keep the Service secure and working | Legitimate interests |
| Marketing email | To tell you about the Service | Consent |
Your voice. During an interview, your microphone audio is streamed to our voice provider, ElevenLabs, which transcribes it and conducts the conversation in real time. No recording of your voice is stored, by us or by them. We do not use voice data for biometric identification, voice printing, or any purpose of recognising you as an individual. It is therefore not processed as special category biometric data under Article 9 GDPR.
4. Who we share it with
We use the following processors. Each processes your data on our documented instructions.
| Provider | What it does | What it receives | Location |
|---|---|---|---|
| Supabase (via Lovable Cloud) | Database, authentication, hosting, file storage | All stored data | United States |
| ElevenLabs | Conducts the live spoken interview: speech recognition, the interviewer's reasoning, and the interviewer's voice | Your microphone audio in real time, the interview brief we generate (which includes context derived from your CV and the job posting), and the conversation transcript | United States |
| Lovable (AI Gateway) | Routes our requests to the AI models below | The content of those requests | United States |
| Google (Gemini), via Lovable | Generates your interview questions and coaching feedback | CV, job posting, context, transcripts | United States |
| OpenAI, via Lovable | Transcribes short audio notes you record during setup | Those audio clips | United States |
| Anthropic (direct) | Generates your end-of-interview summary | Your interview transcript | United States |
| Lovable (Email) | Sends transactional email | Your name, email address, and the content of the email | United States |
| Stripe | Payments | Name, email, payment details | EU / United States |
| Cloudflare, Inc. | Bot detection and abuse prevention (Cloudflare Turnstile) on sign-up and free tools | IP address, TLS fingerprint, User-Agent string, site key | United States |
None of these providers uses your content to train AI models. Lovable has confirmed in writing that our data is excluded from model training. Anthropic and ElevenLabs do not train on customer data processed through their commercial interfaces.
What ElevenLabs retains. ElevenLabs is instructed, on every interview, not to record your voice. We have verified that no audio of any kind is retrievable from them. A text transcript of the conversation persists on their systems for a short period after the call ends, and is automatically deleted by us, typically within twenty minutes. Nothing remains after that.
Bot Protection (Cloudflare Turnstile). To protect our website and services against automated abuse — including fraudulent account creation and misuse of our free tools — we use Cloudflare Turnstile, a bot-detection service provided by Cloudflare, Inc.
When you interact with certain parts of our site (such as signing up for an account or using our free interview-question generator), Turnstile automatically collects and processes a limited set of technical signals from your device and connection, including your IP address, a TLS fingerprint, your browser's User-Agent string, and the site key associated with our website. Turnstile uses these signals solely to distinguish human users from automated bots and to block malicious traffic. Cloudflare states that it cannot identify individuals from these signals and does not use them to profile or target users.
Where this information constitutes personal data, we process it on the basis of our legitimate interests in keeping our website and services secure and preventing abuse. Cloudflare acts as our data processor for the purpose of protecting our site, and as an independent data controller for the purpose of improving its own bot-detection technology.
For more detail on how Cloudflare processes this data, see the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.
We do not sell your personal data. We do not share it with advertisers. We run no third party analytics or advertising trackers.
We may disclose data where required by law, or to establish or defend legal claims.
5. International transfers
Our data is hosted in the United States, and our processors are located there. Where personal data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, together with any additional safeguards required, as the transfer mechanism.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as your account is open |
| CV, job posting, context | For the life of your account |
| Voice recordings | Not retained. Never stored, by us or by our voice provider. |
| Transcripts held by our voice provider | Deleted automatically, typically within twenty minutes of the interview ending |
| Transcripts and coaching reports held by us | For the life of your account, so you can review your history |
| Error diagnostics | 30 days |
| Payment records | Six years, to meet Spanish tax and accounting obligations |
When you close your account, we delete your data immediately: your account, your interviews, transcripts, reports, entitlements, code redemptions, preferences, uploaded files, and any conversation records held by our voice provider. The only exception is payment records we are legally required to keep.
Deleted data may persist briefly in encrypted database backups, which are used only to restore the service after an incident and are never accessed for any other purpose. These backups roll off after [CONFIRM: backup retention window from your Supabase Cloud settings] days.
7. Security
All data is encrypted at rest (AES-256) and in transit (TLS). Access is restricted. We retain no voice recordings.
No service can be entirely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours, and notify you where the risk is high.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, object to, and port your personal data, and to withdraw consent where processing is based on consent.
To exercise any of these, email hello@dryrun-interviews.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. As we are established in Spain, the lead authority is:
Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan 6, 28001 Madrid, Spain www.aepd.es
If you are resident in another EU member state, you may also complain to your local supervisory authority. Users in Ireland may contact the Irish Data Protection Commission (www.dataprotection.ie).
9. Students aged 16 and 17, and School Use
9.1 Minimum age. You must be at least 16 to use DryRun. This applies to everyone, whether you sign up directly or access the Service through a school. When you create an account, you confirm that you are 16 or over, as set out in our Terms.
9.2 We are the data controller. DryRun is the data controller for the personal data of everyone who uses the Service, including students aged 16 and 17. We decide what data is collected and how it is used, and we process it as described in this policy.
9.3 The school's role. Where a school arranges access for its students, the school's role is limited to purchasing access and distributing access codes. The school does not control students' personal data, does not instruct us on how to process it, and is not given access to students' interviews, answers, transcripts or coaching reports. Each student uses the Service directly under this policy and our Terms.
9.4 No parental consent step. Because the Service is limited to users aged 16 and over, we do not operate a parental consent process. Each student agrees to our Terms and this policy themselves.
9.5 What this means in practice.
- Interviews are practice, not assessment. No scores, rankings or grades are produced.
- Coaching reports are written for the student, and only the student sees them.
- Teachers and schools see no student data. Not their answers, not their transcripts, not their reports, not whether they completed an interview.
- No recording of a student's voice is ever retained, by us or by our voice provider.
- No student content is used to train any AI model.
9.6 Student rights. A student may exercise any of the rights in section 8, including asking for a copy of their data or asking us to delete it, by contacting us directly.
10. Automated decision making
The Service uses artificial intelligence to generate interview questions and coaching feedback. This is not automated decision making producing legal or similarly significant effects within the meaning of Article 22 GDPR: no decision is taken about you, and no outcome is determined. The coaching report is feedback on a practice exercise.
11. Changes
We may update this policy. Where a change is material, we will notify you by email or in the Service. The date at the top of this page shows when it was last revised.
12. Contact
David Beakey, trading as DryRun Plaza José María Orense 7, 74, 46022 Valencia, Spain hello@dryrun-interviews.com