Privacy Policy

Who we are

Sherlock.ai ("Sherlock", "we", "us") provides AI-run interview simulations built from job details you share with us. For any privacy matter, contact privacy@sherlock.ai. This policy is written to comply with India's Digital Personal Data Protection Act, 2023.

Information we collect

Account data. Your email address and authentication events. We use passwordless sign-in; we never store a password.

Interview content you provide. Job emails you forward or paste (company, role, job description, interview dates, and any interviewer names you choose to include), plus any text or code you submit during interview simulations.

Generated content. Interview plans, research dossiers, interview transcripts (including text transcribed from your voice in your browser), evaluations, feedback, report documents, and, if you turn on the optional presence read, an aggregate body-language summary for the round (see "Camera and body language").

Payment data. Payments are processed by Stripe. We store the amount, status, and a Stripe reference; we never see or store your card number.

Technical data. Standard server logs (IP address, browser type, timestamps) for security and reliability.

How we use it

Only to run the service: parsing your interview, researching the company and role from public sources, generating and scoring interviews, producing reports, charging for unlocks, and support. We do not sell personal data, do not use your data for third-party advertising, and do not train our own models on your content.

Interviewer names. If a forwarded email names your interviewer, we store that name as part of your case but do not research, profile, or build any dossier on that person. Our research covers the company and the role only.

Voice

Voice interviews use your browser's built-in speech recognition and synthesis. Your browser vendor (for example Google, for Chrome) may process audio to produce the transcription, under its own privacy terms. We receive and store the resulting text transcript, not audio recordings.

Camera and body language

Some interview simulations offer an optional presence read: a look at body language (posture, how much you face the camera, expressiveness, and hand gestures). It is off until you explicitly turn it on for a round, and the interview works fully without it.

When you turn it on, your camera is analysed entirely on your own device by an on-device model running in your browser. Your video is never uploaded, streamed, or stored by us, and we never receive images or recordings. The only thing saved is a small set of aggregate metrics (for example "faced the camera 78% of the time", "posture steady") and a short written note derived from them. We do not use this to identify you or perform facial recognition. It is advisory only: it is shown separately in your report and never affects your interview score. You can decline it, or turn it off at any time, and you can have the stored summary deleted with the rest of your data.

Who processes data on our behalf

Supabase (database, authentication, file storage), Vercel (hosting), Stripe (payments), DeepSeek (AI model inference over your case content and interview answers), and Resend (email delivery and inbound email intake). Public research may query Reddit's official API with company and role terms only, never your personal data. Each provider acts under its own data-processing terms.

Retention and deletion

Cases, transcripts, and reports are kept while your account is active so you can return to them. Email privacy@sherlock.ai to delete your account: we delete your profile, cases, transcripts, evaluations, body-language summaries, reports, and stored emails within 30 days, except minimal payment records we must keep for tax and accounting law.

Your rights

You may request access to, correction of, export of, or deletion of your personal data, and may nominate someone to exercise these rights on your behalf, at any time via privacy@sherlock.ai. Under the DPDP Act, 2023 you may also raise a grievance with us and, if unresolved, with the Data Protection Board of India. If you are in another jurisdiction with specific data-protection rights (for example the EU/UK GDPR), we honor the rights those laws grant you.

Security

Data is encrypted in transit (TLS) and at rest. Database access is restricted by row-level security so accounts can only read their own data; provider API keys are held in an encrypted vault; payment webhooks are signature-verified.

Age and children's data

Sherlock is intended for users 18 and older. The optional presence read (camera-based body-language summary) is a form of behavioural monitoring, so we offer it only to users who have confirmed in Settings that they are 18 or older; for anyone who has not confirmed this, or who tells us they are under 18, the presence read is turned off and never runs. The rest of the service (creating an interview, the spoken interview, and the written report) does not use behavioural monitoring.

Under the DPDP Act, 2023, personal data of a child (a person under 18) may be processed only with verifiable consent of a parent or lawful guardian, and children's data may not be used for tracking, behavioural monitoring, or targeted advertising. When a user tells us they are under 18, we do not create or run any interview for them until a parent or guardian approves through a consent link we email to an address the user provides; behavioural monitoring (the presence read) stays off for them regardless. A parent or guardian may withdraw consent at any time via privacy@sherlock.ai, and we will stop processing and delete the data.

Changes

We will post any material change here and update the effective date; continued use after a change means you accept it.

Note for launch: the registered legal entity name and registered office address that operates Sherlock.ai must be added to the "Who we are" section above, and this document confirmed by counsel, before public launch. The parental-consent flow for under-18 users is email-based (a consent link to a parent/guardian-supplied address); counsel should confirm this satisfies "verifiable" consent for the intended jurisdictions, or specify a stronger verification step, before minor-facing segments are promoted publicly.