Privacy Policy

OpenpassAI is operated by Nick Gorgotsias. The business is registered in Estonia. We’re the “controller” of the personal data described here: we decide how it’s used and we’re responsible for it.

This policy covers the website at www.openpassai.com and the app at app.openpassai.com. Questions and requests go to info@openpassai.com.

In the app, we collect what you give us and what you do there:

• Account details: your name, email address, username and profile picture, and your password in a form we can’t read. If you sign in with Google, Google sends us your name, email address and picture.
• Subscription details: your plan, its renewal dates and your payment history. Stripe handles your card details. We never see your full card number.
• Your learning: the certifications you study, your answers and scores, progress, exam-readiness scores, flashcards, study plans, streaks, points, achievements and certificates.
• What you write or say to the AI: your messages to the AI tutor, your answers in voice sessions and mock interviews, and material you add to Exam Studio. In voice features, your speech is turned into text by your browser or by our speech provider. We keep the text, not the recording.
• Career tools: resumes you upload or paste, job descriptions, the job applications you track, and the suggestions and drafts the tools produce.
• Team membership: if you join a team, its admins can see your name, email address and learning progress.
• Invitations: the email addresses of people you invite to a team, a challenge or OpenpassAI. We use them only to send that invitation.
• Referrals: if you join the referral or affiliate program, your referral code, the sign-ups and commissions linked to it and the payout details you give us.
• Notifications: your notification settings and, if you turn on push notifications, the address your browser gives us to deliver them.
• Technical data: your IP address, browser and device type, and records of requests, which our hosting providers log to run and protect the service.
• Messages you send us, such as support emails.

Some things are visible to others. Challenges, live battles and league tables show your name, picture and points to other signed-in learners. A public profile, a Skills Passport, a certificate link or a shared conversation can be seen by anyone with the link, but only after you publish or share it.

On the website, we use Umami to count visits. It sets no cookies and doesn’t store IP addresses. It records the page, the site you came from, your browser, device type and language, and roughly where your connection comes from. It also counts clicks on links to the app. We can’t identify you from this, and a visit isn’t counted if your browser sends a “Do Not Track” signal. The free tools on the website run in your browser: what you type into them isn’t sent to us.

We don’t need sensitive information such as health data, so please don’t add any.

We use personal data only for these purposes, each on a ground that data protection law recognizes:

• To provide the service: your account, lessons, practice, AI answers, career tools, teams and certificates. Ground: our contract with you.
• To take payments, manage subscriptions and keep the records that tax and accounting law requires. Grounds: our contract with you and our legal obligations.
• To keep the service secure and working: preventing abuse, limiting misuse of the AI features and fixing faults. Ground: our legitimate interest in a safe, reliable service.
• To understand, in aggregate, how the service and the website are used, so we can improve them. Ground: our legitimate interest in improving the service.
• To send you service messages, such as sign-in and security emails, billing notices and invitations. Ground: our contract with you.
• With your consent: push notifications and study reminders, microphone access for voice features, and publishing a profile or a Skills Passport. You can withdraw consent at any time in the app or in your browser.

We don’t sell your personal data, show advertising or use your content to train AI models. We don’t make decisions with legal or similarly significant effects by automated means alone.

To answer you, the app sends the content the answer needs to Anthropic, whose Claude models write the response. That can include your message, the lesson you’re on, or a resume you asked it to review.

In spoken features, text is sent to ElevenLabs to be read aloud, and your speech may be sent to ElevenLabs to be turned into text. Where the app uses your browser’s own speech recognition, the browser’s maker may process the audio.

These providers process the content for us in order to return a result. Please don’t put confidential information or other people’s personal details into your messages.

We share personal data only with the companies that help us run the service, and only as far as they need it:

• Supabase: database, sign-in and file storage
• Vercel: hosting for the website and the app
• Stripe: payments, invoices and fraud prevention
• Anthropic: AI-generated answers
• ElevenLabs: speech for the voice features
• Brevo, with Resend as a backup: sending emails
• Google: sign-in with Google, protection against bots on the sign-up form (reCAPTCHA), and fonts in the app
• jsDelivr: delivers a text-recognition library to your browser when you upload a resume as an image
• Umami: visit statistics for the website

Beyond those, team admins see their members’ details, other learners and the public see what you choose to share, and we disclose data when the law requires it. If the business is ever sold or merged, your data would pass to the new owner under this policy, and we’d tell you first.

We don’t sell or rent personal data to anyone.

We’re based in the European Union, and several of the companies above are in the United States. When personal data leaves the European Economic Area, it’s protected by the European Commission’s standard contractual clauses or by the EU–US Data Privacy Framework.

We keep your account and learning data for as long as you have an account.

If you ask us to delete your account, we delete it and the personal data linked to it within 30 days. Copies in backups and server logs are overwritten after that on our providers’ regular schedules.

Payment records are kept for as long as tax and accounting law requires, even after an account is deleted.

What you’ve published stays public until you unpublish it, ask us to remove it or delete your account.

Wherever you live, you can ask us to:

• Show you the personal data we hold about you and give you a copy
• Correct anything that’s wrong
• Delete your data or your whole account
• Stop or limit a use of your data that you object to
• Send your data to you or to another service in a common format

Email info@openpassai.com and we’ll answer within one month. You can change your profile, notification settings and what you’ve published in the app yourself.

If you think we’ve handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate or to the data protection authority in your own country.

The website sets no cookies.

The app uses your browser’s storage to keep you signed in and to remember settings such as your theme and where you stopped in an audio lesson. It doesn’t use advertising or tracking cookies.

Google’s sign-in button and bot check, and Stripe’s checkout, may set their own cookies when you use them.

The service isn’t meant for anyone under 16. If you believe a child has given us personal data, email us and we’ll delete it.

Data travels over encrypted connections, and access to your private data is restricted to your account. No online service can promise perfect security, so use a strong password that you don’t use anywhere else.

If a security incident puts your data at risk, we’ll tell you and the authorities as the law requires.

When we change this policy, we change the date at the top. If a change is significant, we’ll also email you or show a notice in the app before it takes effect.

Questions about privacy go to info@openpassai.com. Other ways to reach us are on the contact page.