Privacy Policy

Last updated: October 3, 2026

This policy explains what personal data Drillloop collects, why, who it is shared with, and the rights you have over it. It is written to comply with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and, for users in the European Economic Area, the GDPR.

1. Who we are

Drillloop is operated by Stepy Tecnologia LTDA, CNPJ 39.581.412/0001-06, Rua Thereza Scanavez Lamberti, 280, Cxpst 109 Sala 367, Parque da Barra I, São Joaquim da Barra, SP, CEP 14606-366, Brazil ("we", "us"). We are the controller of the personal data described here. For any privacy question or request, including contacting our data protection officer (encarregado), email [email protected].

2. Data we collect

Account

Your name, email address, and password. The password is stored only as a one-way hash; we cannot read it. We also keep your interview credit balance.

What you give us for an interview

The job title and job description, the resume text you paste, and the language you choose for the interview.

Interview transcripts

A text transcript of each interview: what you said (converted from your voice to text) and what the AI interviewer said, along with when the interview started and ended.

Usage records

Technical counts for each interview, such as which AI models were used, seconds of audio transcribed, and tokens or characters processed. We use them to measure cost and prevent abuse.

Waitlist

If you join the waitlist: your name, email address, and the plan you chose.

Technical data

Your IP address and browser user agent, stored with your login session, and server logs that may include IP addresses and request details.

3. What we do not store

Camera video. The camera is required so the interview feels like the real thing, but the video is shown only in your own browser. It is never uploaded to our servers or anyone else's.
Your voice recordings. Each spoken answer is sent to our speech-to-text provider to be transcribed, and we discard the audio right after. We keep only the text.
The interviewer's voice. The AI's spoken replies are generated, sent to your browser, and not saved.
Payment card data. We do not take payments yet. When we do, card details will be handled by a payment processor and will never touch our servers.

4. Why we use your data

To provide the service: creating your account, running interviews built from the job and your resume, and showing you results. Legal basis: performance of a contract (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
To keep the service secure and working: preventing abuse, debugging, and measuring cost. Legal basis: legitimate interest (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).
To contact you about the waitlist, if you joined it. Legal basis: consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)), which you can withdraw at any time.
To meet legal obligations, such as keeping access logs as required by the Brazilian Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014).

We do not sell your data, use it for advertising, or use your interviews to train our own AI models.

5. Who we share it with

We use a small number of service providers to run Drillloop. Each receives only what it needs:

Cloudflare, Inc. (United States and its global network): sits in front of our servers to deliver the site and protect it from attacks. All traffic, including your IP address, passes through it.
xAI (United States): converts your spoken answers to text and the interviewer's replies to speech. It receives your answer audio and the interviewer's reply text.
DeepSeek (People's Republic of China): generates the interviewer's questions and follow-ups. It receives the job title and description, your resume, your name, the interview language, and the transcript so far.
OVHcloud (data center in Canada): hosts our servers and stores our database.

These providers process the data under their own terms and security measures. We may also disclose data when required by law or a court order.

6. International transfers

Some of the providers above process data outside Brazil, including in Canada, where our servers and database are hosted, the United States, and China. These transfers are necessary to run the service you request (LGPD Art. 33). Because your resume and answers are sent to AI providers, we recommend you leave out sensitive information you don't need for practice, such as your ID numbers, home address, health data, or details about other people.

7. Cookies and local storage

We use only cookies that are strictly necessary for the site to work. We do not use analytics, advertising, or tracking cookies, so we don't ask for cookie consent.

Session cookie (drillloop-session): keeps you logged in while you use the site. Expires after a period of inactivity.
XSRF-TOKEN: protects your account against cross-site request forgery. Expires with your session.
Remember me cookie (remember_web_…): set only if you choose to stay logged in. Removed when you log out.
Cloudflare cookies (such as __cf_bm and cf_clearance): set by Cloudflare to tell people apart from bots and keep the site secure.
Local storage (@drillloop/sidebar-collapsed): remembers whether you collapsed the sidebar. It stays in your browser and is never sent to us.

8. How long we keep it

Account data, interview inputs, and transcripts: while your account is active, until you ask us to delete them.
Waitlist entries: until you sign up or ask to be removed.
Login sessions: until they expire or you log out.
Access logs: for at least six months, as required by Brazilian law, then deleted.

9. Your rights

Under the LGPD (Art. 18) and, where applicable, the GDPR, you can ask us to:

confirm whether we process your data and give you access to it;
correct incomplete, inaccurate, or outdated data;
anonymize, block, or delete unnecessary or excessive data;
delete your account and its data;
export your data in a portable format;
tell you who we share your data with;
withdraw consent where we rely on it.

Email [email protected] from the address on your account. We will reply within 15 days. You can also complain to the Brazilian data protection authority (ANPD) or, in the EEA, to your local supervisory authority.

10. Security

All traffic is encrypted with HTTPS, passwords are hashed, our servers accept web traffic only through Cloudflare, and access to data is limited to what is needed to run the service. No system is perfectly secure; if a breach affects you, we will notify you and the ANPD as the law requires.

11. Age

Drillloop is for people 18 and older. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

12. Changes to this policy

If we change this policy, we will update the date at the top. For significant changes, we will notify you by email or on the site before they take effect.