Privacy Policy

This policy explains what personal data CaseDrill uses, why, and what your rights are. We keep it short because we collect little.

1. Who is responsible

• tomtech software, Eenmanszaak (sole proprietorship)
• Based in Valkenburg, the Netherlands
• Chamber of Commerce (KVK) number: 99782766
• VAT number: NL005411187B83
• Email: casedrillsupport@gmail.com

Questions about your data: casedrillsupport@gmail.com.

2. What we use, and why

• Email address. To create your account and sign you in with a link. Legal basis: performing our contract with you.
• Account activity. Which cases you started and when, your credit balance, and the record of your purchases (which pack, when, and a payment reference). We need this to give you access, prevent misuse (for example running the free tutorial more than once) and answer questions. Legal basis: performing our contract and our legitimate interest in running the service safely.
• Payment data. Payments are handled by Stripe. We never see your card or bank details. We receive confirmation of the payment and a customer reference. We keep payment records for as long as tax law requires (currently 7 years). Legal basis: legal obligation.
• Your answers and voice. To run the interview, what you type or say is processed by our AI provider (see below) to produce the interviewer's reply, the transcription and the feedback. We do not store your recordings, and we do not store the text of your answers on our servers. Legal basis: performing our contract.
• Trying the tutorial without an account. To offer the free tutorial with no signup, we set a short-lived cookie that proves you started it, and we briefly keep a hash of your IP address (not the address itself) to stop the free tutorial being used to run up costs in bulk. The hash is deleted after 2 days and cannot be turned back into your IP address. Legal basis: our legitimate interest in offering a free sample safely.
• Visitor statistics. We count visits and page views with Vercel Web Analytics. It uses no cookies and does not follow you from site to site or build a profile of you. Legal basis: our legitimate interest in knowing how many people use the service.
• Emails you send us. To answer your question. Legal basis: our legitimate interest in supporting our customers.

We do not sell your data, and we do not use advertising or tracking cookies.

3. Who else handles your data

We use these providers ("processors") to run CaseDrill:

• OpenAI: turns your speech into text, writes the interviewer's replies and feedback, and creates the interviewer's voice. It receives your recordings and answers while you use a case. We use its business API, under which your content is not used to train its models.
• Supabase: our database and sign-in (your email, credits and case history).
• Vercel: hosts the website and provides the visitor statistics.
• Stripe: payments and receipts.
• Our email provider: sends your sign-in links.

Some of these companies are based in, or process data in, the United States. Where that happens we rely on the safeguards the GDPR allows, such as the EU-US Data Privacy Framework or standard contractual clauses.

4. Cookies and similar storage

We use only what is needed to make the site work: a sign-in cookie that keeps you logged in, a cookie that lets you try the free tutorial without an account, and a small browser setting that remembers whether you like coaching tips. Because these are strictly necessary, no cookie banner is required.

5. How long we keep it

• Account and case history: while your account exists.
• Payment records: 7 years, because of tax rules.
• Emails you send us: as long as needed to help you, then normally deleted.

You can ask us to delete your account. We then remove your data, except what we must keep by law.

6. Your rights

Under the GDPR you can ask us to:

• show you the data we have about you;
• correct it, or delete it;
• restrict or stop how we use it, and object to it;
• give you your data in a usable format.

Write to casedrillsupport@gmail.com. We answer within one month. If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

7. Changes

If we change this policy in a way that matters to you, we will update the date above and tell you by email.