Privacy Policy

Who we are

Sherlock.ai ("Sherlock", "we", "us") provides AI-run interview simulations built from job details you share with us. For any privacy matter, contact compliance@hisherlock.com. This policy is written to comply with India's Digital Personal Data Protection Act, 2023.

Information we collect

Account data. Your email address and authentication events. We use passwordless sign-in; we never store a password.

Interview content you provide. Job emails you forward or paste (company, role, job description, interview dates, and any interviewer names you choose to include), plus any text or code you submit during interview simulations.

Generated content. Interview plans, research dossiers, interview transcripts (including text transcribed from your spoken answers), evaluations, feedback, report documents, and, if you turn on the optional presence read, an aggregate body-language summary for the round (see "Camera and body language").

Payment data. Payments are processed by Stripe. We store the amount, status, and a Stripe reference; we never see or store your card number.

Technical data. Standard server logs (IP address, browser type, timestamps) for security and reliability.

Security and fraud prevention. When you sign in, create or unlock an interview, or start or finish a round, we record that event with a one-way coded form of your IP address and browser details (a salted hash, not the address itself). We use these records only to prevent abuse, such as one person claiming many free interviews, payment fraud, or automated attacks, and to set fair usage limits. We keep them for up to 12 months. Because their purpose is to prevent abuse, they may be kept for that period after you delete your account, without your email address or name attached.

How we use it

Only to run the service: parsing your interview, researching the company and role from public sources, generating and scoring interviews, producing reports, charging for unlocks, and support. We do not sell personal data, do not use your data for third-party advertising, and do not train our own models on your content.

Interviewer names. If a forwarded email names your interviewer, we store that name as part of your case but do not research, profile, or build any dossier on that person. Our research covers the company and the role only.

Voice

In a spoken interview, the audio of each answer is sent to OpenAI to be transcribed into text, and the interviewer's questions are sent to OpenAI as text to be read aloud. OpenAI processes this under its API data terms. We store the text transcript, not audio recordings: your audio passes through our server to OpenAI and is not kept. Where a deployment uses your browser's built-in speech recognition and synthesis instead, your browser vendor (for example Google, for Chrome) may process the audio under its own privacy terms. You can always type your answers instead of speaking.

Camera and body language

Some interview simulations offer an optional presence read: a look at body language (posture, how much you face the camera, expressiveness, and hand gestures). It is off until you explicitly turn it on for a round, and the interview works fully without it.

When you turn it on, your camera is analysed entirely on your own device by an on-device model running in your browser. Your video is never uploaded, streamed, or stored by us, and we never receive images or recordings. The only thing saved is a small set of aggregate metrics (for example "faced the camera 78% of the time", "posture steady") and a short written note derived from them. We do not use this to identify you or perform facial recognition. It is advisory only: it is shown separately in your report and never affects your interview score. You can decline it, or turn it off at any time, and you can have the stored summary deleted with the rest of your data.

University interviews: integrity notes

When a university or college invites you to an admissions interview on Sherlock, the interview page also records a few notes to help that institution read your answers fairly: whether each answer was spoken or typed, how long it took to start and to give it, and when text was pasted into an answer (how many characters, not what was pasted beyond the answer you sent). If you are 18 or over, it also notes when you leave the interview window or tab, for how long, and, if the course requires fullscreen, when you leave fullscreen. No camera, screen recording, or keystroke logging is used for this.

These notes are shown only to that institution's reviewers, beside your answers and with a plain explanation that each one can have innocent causes. They are never used to change your score or to decide anything automatically; the admissions decision is always the institution's. We do not collect them for interview simulations you run for yourself. They are kept and deleted with the rest of the interview.

After the interview, we also check on our servers whether an answer's wording closely matches another applicant's answer on the same course, and whether a long spoken answer was delivered at a reading pace. The result is shown to that institution's reviewers with the matching wording, as context, never as a score. Where wording matches another applicant, each applicant's reviewers see the other's name.

Some courses also ask applicants who are 18 or over to turn on a camera check. It runs entirely on your own device, like the presence read: it counts how long a second face was in view and how long no face was in view, and only those totals are saved. It never records or uploads video, never keeps images, and does not recognise or identify faces. You can continue the interview without it; reviewers then see that you chose not to turn it on.

Who processes data on our behalf

Supabase (database, authentication, file storage), Vercel or our own servers (hosting), Stripe (payments), DeepSeek (AI model inference over your case content and interview answers), OpenAI (speech-to-text and text-to-speech for spoken interviews, and text embeddings used to search our knowledge base), Groq (AI model inference, only where an operator has configured it as an alternative model), Cloudflare Turnstile (a bot check when you request a sign-in link), and Resend or our own mail server (email delivery and inbound email intake). Public research may query Reddit's official API with company and role terms only, never your personal data. Each provider acts under its own data-processing terms.

Cookies

We use only first-party cookies that the service needs: sign-in cookies that keep you signed in, and a device cookie (sh_did) holding a random identifier, kept for up to 400 days. We store only a one-way coded form of that identifier with the security records described above, and use it only to prevent abuse, never for advertising or analytics. We do not use third-party advertising or tracking cookies.

Retention and deletion

Cases, transcripts, and reports are kept while your account is active so you can return to them. Email compliance@hisherlock.com to delete your account: we delete your profile, cases, transcripts, evaluations, body-language summaries, reports, and stored emails within 30 days, except minimal payment records we must keep for tax and accounting law.

Your rights

You may request access to, correction of, export of, or deletion of your personal data, and may nominate someone to exercise these rights on your behalf, at any time via compliance@hisherlock.com. Under the DPDP Act, 2023 you may also raise a grievance with us and, if unresolved, with the Data Protection Board of India. If you are in another jurisdiction with specific data-protection rights (for example the EU/UK GDPR), we honor the rights those laws grant you.

Security

Data is encrypted in transit (TLS) and at rest. Database access is restricted by row-level security so accounts can only read their own data; provider API keys are held in an encrypted vault; payment webhooks are signature-verified.

Age and children's data

Sherlock is intended for users 18 and older. The optional presence read (camera-based body-language summary) is a form of behavioural monitoring, so we offer it only to users who have confirmed in Settings that they are 18 or older; for anyone who has not confirmed this, or who tells us they are under 18, the presence read is turned off and never runs. The rest of the service (creating an interview, the spoken interview, and the written report) does not use behavioural monitoring.

Under the DPDP Act, 2023, personal data of a child (a person under 18) may be processed only with verifiable consent of a parent or lawful guardian, and children's data may not be used for tracking, behavioural monitoring, or targeted advertising. When a user tells us they are under 18, we do not create or run any interview for them until a parent or guardian approves through a consent link we email to an address the user provides; behavioural monitoring (the presence read) stays off for them regardless. A parent or guardian may withdraw consent at any time via compliance@hisherlock.com, and we will stop processing and delete the data.

Changes

We will post any material change here and update the effective date; continued use after a change means you accept it.

Note for launch: the registered legal entity name and registered office address that operates Sherlock.ai must be added to the "Who we are" section above, and this document confirmed by counsel, before public launch. The parental-consent flow for under-18 users is email-based (a consent link to a parent/guardian-supplied address); counsel should confirm this satisfies "verifiable" consent for the intended jurisdictions, or specify a stronger verification step, before minor-facing segments are promoted publicly.