Privacy policy

Policy text from the Bossed app. Site copy synchronised on 5 September 2026.

This privacy notice for DREAMPRESS LTD (doing business as Bossed AI) ("Bossed AI", "we", "us", or "our") describes how and why we collect, store, use, and/or share ("process") your information when you use our websites at bossed.ai and app.bossed.ai and our applications (the "Services").

Questions or concerns? If you do not agree with our policies and practices, please do not use our Services. If you have any questions, contact us at our contact form.

1. What information do we collect?

Information you provide to us

Account information — your email address and password. Passwords are stored only as a salted hash by our authentication provider; we never see them.
Profile information — your name, employment history, skills and education, either typed in or extracted from a CV you upload.
CV or résumé files — the documents you upload so we can read your background out of them.
Job details — job titles, job descriptions and job-listing URLs you save or import.
Onboarding answers — the responses you give in the setup questionnaire, which we use to produce your baseline readiness score.
Interview audio and transcripts — your microphone audio during a practice interview, the text it is transcribed into, and the full conversation with the AI interviewer.
Grades and readiness scores — the scores, feedback and progress history generated from your interviews.
Marketing preference — whether you have asked to receive marketing email from us, and when you last changed that choice. It is off unless you turn it on, and you can turn it off again at any time in Settings.
Support correspondence — anything you send us by email.

Information automatically collected

Device and connection information — IP address, browser or device type, operating system version.
Usage information — the screens you view, the actions you take, the time and date of visits, and errors or crashes.

We do NOT collect your precise location, and we do not read your device contacts, photos or files other than a CV you deliberately upload.

Payment information

Payments are handled by Stripe. Your card details go directly to Stripe and are never stored by us. We receive only your subscription status, plan, billing period and the last four digits and brand of your card.

2. How do we process your information?

To create and maintain your account and keep you signed in.
To run practice interviews — this includes transcribing your speech, generating the interviewer’s questions, and speaking the replies back to you.
To grade your interviews and track your readiness over time.
To take payment and manage your subscription.
To understand how the Services are used so we can improve them.
To diagnose problems, protect against fraud and abuse, and keep the Services secure.
To communicate with you about your account, updates and support.
To send marketing communications where you have consented, which you can withdraw at any time in Settings or from the unsubscribe link in any such email.
To comply with our legal obligations.

We do not sell your personal information, and we do not use your interview recordings or transcripts to train our own AI models.

3. What legal bases do we rely on?

If you are in the UK or the EU, the UK GDPR and GDPR require us to explain the legal bases we rely on:

Performance of a contract — to provide the Services you have signed up for, including running and grading interviews and taking payment.
Legitimate interests — to analyse how the Services are used so we can improve them, to diagnose problems, and to prevent fraud and abuse, where those interests do not override your rights.
Consent — for non-essential cookies and analytics where consent is required, and for marketing emails. You can withdraw consent at any time.
Legal obligations — to keep accounting records and to respond to lawful requests.

4. When and with whom do we share your information?

We share information with service providers who process it on our behalf, under contract, only for the purposes we set:

Supabase — authentication, database and file storage. Your account, profile, CV, saved roles, transcripts and scores are stored here, in the EU (eu-central-1, Frankfurt).
OpenAI — your interview audio is sent for speech-to-text transcription, and the interviewer’s replies are sent for text-to-speech.
Google (Gemini) — your CV, job descriptions and interview transcripts are sent so we can extract your background, understand the role, generate interview questions and grade your answers.
Firecrawl — when you import a job by URL, that URL is fetched on our behalf.
Stripe — payment processing and subscription management.
Mixpanel (EU data residency) — product analytics.
Google Ads — measuring whether our advertising led to a sign-up or a purchase, and showing our ads to people who have visited. When you are signed in, a hashed (not readable) form of your email address is included so a purchase can be matched to the ad you clicked. In the UK, the EEA and Switzerland, advertising cookies are only set with your consent (see section 5).
Cloudflare — hosting and delivery of the website.
Meta (Facebook and Instagram) — the Meta Pixel and Conversions API measure advertising results and support advertising audiences. We share page and subscription events, payment amount and currency, advertising click/browser identifiers, IP address and browser information, and a hashed form of your account ID and email when signed in. We do not send your CV, interview recordings, answers or scores to Meta. In the UK, the EEA and Switzerland, both browser and server advertising events wait for your cookie consent. A decline is honoured everywhere.

We may also disclose information where required to comply with the law, respond to lawful requests from public authorities, enforce our Terms, protect our rights or safety or those of others, or investigate fraud. If we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction; we will tell you if that happens.

We may share aggregated, anonymised information that cannot identify you.

5. Do we use cookies and other tracking technologies?

We use essential cookies and similar technologies (including browser local storage) to operate the Services — for example to keep you signed in and remember your preferences. We use Mixpanel, with data hosted in the EU, for product analytics, and Google Ads conversion tracking to measure our advertising, which sets Google's advertising cookies. If you are in the UK, the EEA or Switzerland, we ask for your consent in the cookie banner before either sets non-essential cookies: until you accept, Mixpanel does not run and the Google tag runs in a restricted "consent mode" that sets no advertising cookies and sends Google only cookieless signals. Outside those regions they run from your first visit. You can change your choice at any time in Settings or by contacting us.

The Meta Pixel uses the _fbp and _fbc advertising cookies, lasting up to 90 days, to associate visits and purchases with ads. We retain the corresponding server attribution information for up to 90 days after its last update. Outside the UK, the EEA and Switzerland, Meta tracking runs from your first visit unless you decline. You can withdraw your choice in Settings under Cookie preferences; this stops future browser and server advertising events and clears our Meta advertising cookies.

6. Is your information transferred internationally?

Your account data, uploads, transcripts and scores are stored in the European Union (Frankfurt), and our analytics data is held in the EU.

Some of our AI and payment providers process data outside the UK and EEA, including in the United States. Where that happens we rely on appropriate safeguards, including the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses. Details can be provided on request.

7. How long do we keep your information?

We keep your personal information only for as long as necessary for the purposes set out in this notice, unless a longer period is required or permitted by law (for example tax and accounting records). In general we keep your account data, profile, CVs, transcripts and scores for as long as you have an account with us. When you delete your account we delete or anonymise that information; where it survives in backups we isolate it from further processing until deletion is possible.

8. How do we keep your information safe?

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls so that you can only read your own records, and restricted administrative access. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Do we collect information from minors?

The Services are for adults. You must be at least 18 to use them, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will deactivate the account and delete the data. If you believe we hold data about a child, contact us at our contact form.

10. What are your privacy rights?

Depending on where you live, you may have the right to request access to and a copy of your personal information, to have it corrected or erased, to restrict or object to how we process it, and to data portability. Where we rely on consent, you can withdraw it at any time.

The easiest way to exercise these rights is through your account settings, or by using our contact form. We will respond in accordance with applicable data protection law. You can close your account and request deletion of your data at any time.

If you are in the UK you also have the right to complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA you can complain to your national data protection authority.

11. Controls for do-not-track features

Most browsers include a Do-Not-Track feature. No uniform standard for responding to it has been finalised, so we do not currently respond to Do-Not-Track signals. If that changes we will update this notice.

12. Do we make updates to this notice?

We may update this privacy notice to reflect changes in our practices or for legal, operational or regulatory reasons. We will post the updated notice, revise the "Last updated" date, and where the changes are material we will notify you.

13. How can you contact us?

Contact: our contact form

Company: DREAMPRESS LTD (Company Number 14591818)

Registered office: 29 Waterloo Road, Wolverhampton, England WV1 4DJ, United Kingdom