Tietosuojaseloste

This Privacy Policy describes how Fornix AS ("Fornix," "we," "us," or "our") collects, uses, processes, and protects your personal data when you use Fornix Interview, our AI-powered interview preparation platform (the "Service").

We are committed to protecting your privacy and ensuring transparency about our data practices. This policy complies with the EU General Data Protection Regulation (GDPR), the Norwegian Personal Data Act, and applicable healthcare data protection regulations including HIPAA where relevant.

We collect and process the following categories of personal data:

2.1 Tilitiedot

• Full name and email address
• Authentication credentials (encrypted passwords or OAuth tokens)
• Profile information and preferences
• Organization or company affiliation (if applicable)

2.2 Haastattelutiedot

• Interview session recordings (audio and transcripts)
• Transcripts of your spoken responses
• Uploaded CVs and resumes
• Job descriptions and role information
• Interview intensity settings and preferences
• AI-generated feedback and performance evaluations
• Practice history and progress metrics

2.3 Tekniset ja käyttötiedot

• Device information (browser type, operating system)
• IP address and general location data
• Session logs and interaction patterns
• Performance and error diagnostics
• Usage events about your visit (which pages and demo features are opened, how long pages are viewed). These are stored server-side without cookies or device identifiers and are not used for advertising or cross-site tracking

2.4 Maksutiedot

• Billing identifiers and subscription status (processed by Stripe)
• We do not store credit card numbers or payment details directly

2.5 Muisti

• Short notes Fornix keeps about you so it can fit itself to you ("Memory"), such as how you like things written, what you want from a job, and what keeps coming up in your practice
• They are learned from what you write in the agent chat and from the feedback and transcripts of your practice interviews, or saved when you ask
• Fornix asks before keeping sensitive details, such as your health, unless you choose to have them saved automatically
• Notes are encrypted in your browser like your other saved content, and no workspace you belong to can read them

2.6 CV:t ja työhakemukset

• Se, mitä kirjoitat ja suunnittelet CV Coachissa ja Työhakemusvalmentajassa, tallennetaan Canvasina. Rekisteröidyillä tileillä sisältö salataan selaimessasi holviavaimellasi ennen tallennusta, joten tallennuspalvelimemme eivät voi lukea sitä. Canvas säilytetään, kunnes poistat sen tai tilisi, ellei jonkin työtilasi sääntöjen mukaan sitä poisteta aiemmin
• Näissä työkaluissa on uusi editori. Siinä Canvas sisältää myös ulkoasun, käsin tekemäsi muutokset ja lisäämäsi valokuvat, kaikki salattuina samalla tavalla
• Uudessa editorissa lataamasi tiedosto luetaan selaimessasi, eikä itse tiedostoa tallenneta. Vain se, mikä päätyy Canvasiisi, tallennetaan, myös PDF-tiedostosta otettu valokuva tai logo
• Uudessa editorissa tallentamasi väripaletit (Brändipaketti) salataan samalla tavalla. Ne näkyvät Kirjastossani, jossa voit poistaa ne, sisältyvät lataamiisi tietoihin ja poistetaan tilisi mukana
• Word-tiedostoa luotaessa teksti kulkee palvelimemme kautta vain tätä vientiä varten, eikä sitä säilytetä

We process your personal data for the following purposes, based on legitimate legal grounds under GDPR:

3.1 Palvelun tarjoaminen

• Conduct AI-powered interview simulations
• Generate personalized interview questions based on job descriptions and CVs
• Provide feedback, evaluations, and performance analytics
• Generate improved CV
• Maintain your practice history and progress tracking
• Manage your account, authentication, and security
• Keep and use Memory so the assistant can fit itself to you. It is on by default: you can read, edit and delete every note in My Library, and change it or turn it off in Settings

3.2 Laskutus ja tilausten hallinta

• Process payments and manage subscriptions
• Track usage credits and billing cycles
• Issue invoices and receipts

3.3 Palvelun kehittäminen

• Identify and resolve technical issues
• Enhance user experience and platform functionality
• Develop new features and capabilities
• Understand which product surfaces are used, through aggregated usage analytics (see the Cookies section)

3.4 Lainmukaisuus ja tietoturva

• Comply with applicable laws and regulations
• Prevent fraud, abuse, and unauthorized access
• Respond to legal requests and enforce our terms
• Maintain system security and integrity

We do not sell, rent, or trade your personal data. We only share data with trusted third-party service providers necessary for operating our Service, under strict data processing agreements:

4.1 Infrastruktuuri ja hosting

• Google Cloud Platform / Firebase: EU-based hosting, authentication, databases, and file storage
• All data is hosted exclusively within the European Union

4.2 Tekoäly- ja mediapalvelut

• AI Model Providers: Interview question generation, feedback analysis and the assistant, including the Memory notes a request needs (GDPR-compliant processors)
• Tekoälymallien tarjoajat, CV:itä ja työhakemuksia varten: Uudessa editorissa: viestisi, asiakirjan teksti ja työpaikka, jota haet, valitsemasi osa sekä pyynnön tarvitsemat Muisti-merkinnät. Kun lataat tiedoston: sen nimi ja teksti sekä PDF-tiedostosta lisäksi kuvat enintään kolmesta ensimmäisestä sivusta, joissa näkyy kaikki sivuilla oleva, myös mahdollinen valokuva, sekä fonttien, kokojen ja värien mittaukset, jotta ulkoasu voidaan luoda uudelleen. Suunnitteluesimerkiksi liittämäsi kuva lähetetään samalla tavalla. Kuvia ja mittauksia käytetään vain kyseisen pyynnön toteuttamiseen, eikä Fornix tallenna niitä. Editorissa lisäämääsi valokuvaa ei lähetetä kuvana. PDF-vienti käyttää selaimesi tulostusikkunaa, joten asiakirjasi ei mene PDF-palveluun
• LiveAvatar/HeyGen: AI avatar generation for realistic interviewer personas
• LiveKit: Real-time video and audio infrastructure

4.3 Maksujen käsittely

• Stripe: Secure payment processing and subscription management
• Stripe complies with PCI-DSS standards and GDPR

4.4 Analytiikka ja tuki

• Analytics platforms for aggregated usage insights
• Customer support and communication tools
• System monitoring and error tracking services

All third-party processors are carefully vetted and bound by data processing agreements (DPAs) ensuring GDPR compliance and appropriate security measures.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Active Accounts: Data is retained while your account is active and for the duration of your subscription
• Interview Sessions: Practice recordings, transcripts, and feedback are retained for the lifetime of your account to enable progress tracking
• Memory: Notes are kept until you delete them or your account. Turning Memory off stops it learning and using notes, and does not delete them
• After Account Deletion: Most personal data is deleted within 30 days. Some data may be retained longer for legal compliance and tax requirements (7 years for financial records), dispute resolution and fraud prevention, and aggregated, anonymized analytics (which cannot identify you)
• Backup Systems: Deleted data may persist in encrypted backups for up to 90 days before permanent deletion

As a data subject under GDPR, you have the following rights:

To exercise any of these rights, please contact us at hello@fornix-interview.com. We will respond to your request within 30 days.

We implement industry-leading security measures to protect your personal data:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Strict role-based access with multi-factor authentication for our team
• Regular Audits: Security assessments and penetration testing
• Data Minimization: We only collect data necessary for service provision
• Pseudonymization: Where possible, data is processed in de-identified form
• Incident Response: Documented procedures for data breach notification within 72 hours as required by GDPR

Despite our best efforts, no system is 100% secure. If you suspect unauthorized access to your account, please contact us immediately.

Your data is stored and processed exclusively within the European Union. We do not transfer personal data outside the EU/EEA.

In the rare event that a transfer to a third country becomes necessary, we will ensure appropriate safeguards are in place (such as EU Standard Contractual Clauses) and obtain your explicit consent where required.

We use essential cookies and similar technologies to:

• Maintain your login session and authentication
• Remember your preferences and settings
• Analyze usage patterns (aggregated data only)
• Ensure security and prevent fraud

Product analytics are optional and off by default. Without your consent, analytics operate without cookies or device identifiers and we only receive aggregated, modeled statistics. If you choose to share product analytics (during signup or in Settings), analytics cookies are used and your visit activity may be linked to your account when you sign up during that same visit. This linking is limited to activity within the visit that created your account; separate visits are never stitched together.

You can manage cookie preferences through your browser settings. However, disabling certain cookies may limit Service functionality.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other operational needs.

We will notify you of material changes by email or through a prominent notice on our Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: