Privacy Policy
Voxora AI — getvoxora.com
Last updated: 14 August 2026 · Version 1.0
1. Who we are
This Privacy Policy explains how Voxora AI, operating the website and application at getvoxora.com (“Voxora,” “we,” “us,” or “our”), collects, uses, shares, and protects your personal data when you use our AI-powered mock interview and career-preparation platform (the “Service”). We act as the “Data Fiduciary” for the personal data described below, as that term is used in the DPDP Act and Rules.
By creating an account or using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Service.
2. Personal data we collect
We collect the following categories of personal data, only for the purposes described in Section 3:
2.1 Account data
- Name, email address, and password (hashed by Firebase Authentication — we never see or store the raw value).
- A session identifier stored as a secure, HTTP-only cookie so you stay signed in.
2.2 Career and interview data
- Resume/CV content you upload (PDF), including your work history, education, skills, and project details.
- Voice audio captured during a mock interview session, converted to text by our voice-AI processor.
- Interview transcripts, AI-generated feedback, scores, and performance analytics derived from your interview sessions.
- A persona photo, if you enable the optional animated-avatar feature. Captured by your device's camera and kept in browser local storage only — not uploaded to our servers.
2.3 Payment data
- Subscription status, order ID, and payment ID for our Ultimate plan. Card, UPI, and net-banking details are collected and processed directly by our payment partner, Razorpay, under RBI-regulated, PCI-DSS-compliant infrastructure — we do not receive or store your full card or bank details.
2.4 Technical & usage data
- IP address, used transiently to prevent abuse (brute-force login attempts, mass fake signups) and to enforce fair-use rate limits.
- Standard device/browser information generated automatically by using a web application.
2.5 Communications
- Your email address and message content if you contact us for support, or automated transactional emails we send you (e.g. password reset).
3. Why we collect it — purpose limitation
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and secure your account | Name, email, hashed password, session cookie | Consent / Performance of contract |
| Run AI mock interviews and generate personalised questions | Resume text, voice transcript | Consent |
| Show you feedback, scores, and progress tracking | Transcript-derived feedback, scores | Consent |
| Process your subscription payment | Order ID, payment ID, subscription status | Performance of contract |
| Prevent abuse and fraud (rate limiting) | IP address | Legitimate interest |
| Respond to support requests | Email, message content | Consent / Legitimate interest |
| Comply with law, respond to lawful government/DPB requests | Any of the above, as required | Legal obligation |
We do not use your data for purposes beyond what's listed above — we don't sell your data, and we don't use your resume or interview content to train third-party AI models on our instruction (see Section 5 for what our AI vendors do on their end).
4. Consent
Where consent is our basis for processing, we ask for it clearly at the point of collection — a checkbox at signup you must actively select, referencing this Policy and our Terms of Use. You can withdraw consent at any time by deleting your account (Section 8) or contacting us (Section 11); withdrawal doesn't affect processing that already happened, and may mean we can no longer provide parts of the Service that depend on that data.
5. Who we share data with — processors and third parties
Each of the following processes personal data only on our instructions and only to provide their specific service to us — we do not sell or rent personal data to anyone, and don't share it for their independent marketing purposes.
| Provider | What they receive | Why |
|---|---|---|
| Firebase / Google Cloud | Account data, interview & feedback records | Authentication and database hosting |
| Groq | Resume text (for question generation) | AI inference to personalise your interview |
| Vapi | Live voice audio during interviews | Speech-to-text and voice AI for the mock interview |
| Razorpay | Payment details (handled directly by them) | Subscription billing, RBI-regulated payment processing |
| Our email/SMTP provider | Your email address | Transactional emails (password reset, notifications) |
We may also disclose personal data if required by law, court order, or a lawful request from the Data Protection Board of India or another competent authority, or to protect the rights, safety, or property of Voxora, our users, or the public.
6. Cross-border data transfer
Some of our processors (including Groq and Vapi) are based outside India, so your data may be processed on servers located outside India. The DPDP Act permits cross-border transfer by default, except to countries the Central Government specifically restricts (no such restriction list currently exists). We select processors that maintain industry-standard security practices and review their data-handling terms periodically.
7. Data retention
- Account data: retained while your account is active, deleted (or anonymised) within 30 days of account deletion.
- Resume text and interview transcripts: retained while your account is active; you can request earlier deletion any time. We periodically purge data older than 12–24 months not tied to an active subscription.
- Payment records: retained as required by Indian tax and financial record-keeping law, even after account deletion, limited to the minimum needed for compliance.
- Rate-limit / IP logs: retained only for the duration of the relevant rate-limit window, then discarded.
8. Your rights
Subject to applicable law, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate or incomplete data.
- Erasure — request deletion of your account and associated data, or use the “Delete my account” option in Settings.
- Withdraw consent — stop us processing data that relies on consent (see Section 4).
- Grievance redressal — raise a complaint with our Grievance Officer (Section 11) and, if unresolved, with the Data Protection Board of India.
- Nominate — (DPDP Act) nominate another individual to exercise your rights on your behalf in the event of death or incapacity.
EU/UK/California users may have additional or differently-scoped rights (data portability, objection to processing, opt-out of “sale/sharing” — we don't sell data, so this is generally not applicable) under GDPR/CCPA. Contact us using Section 11 to exercise any of these rights.
9. Children's data
Voxora is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18 — sign-up requires you to self-declare you're 18 or older. If we learn we've collected data from a person under 18 without verifiable parental consent, we will delete it. If you believe a minor has provided us data, contact us at Section 11.
10. Security
- Password hashing via Firebase Authentication; passwords checked against known-breach databases (k-anonymity check that never transmits your actual password) at signup.
- HTTP-only, secure session cookies; rate limiting on login, signup, and password-reset endpoints.
- Signature verification on payment webhooks; we never store your full card/UPI details.
- Access controls restricting who at Voxora can view stored personal data.
No system is 100% secure. If a breach occurs that is likely to affect you, we will notify you and, where required, the Data Protection Board of India, in accordance with applicable law.
11. Grievance Officer & contact
| Grievance Officer | Tekrat Prajapati (Founder) |
| hello@getvoxora.com | |
| Address | [Registered address, city, state, India] |
If you're not satisfied with our response, you may lodge a complaint with the Data Protection Board of India.
12. Changes to this Policy
We may update this Policy from time to time. We'll update the “Last updated” date above, and for material changes we'll provide a more prominent notice (email or in-app banner) and, where required, seek fresh consent.