Privacy Policy
Offer — a product analyst interview trainer
Last updated: October 18, 2026
This policy explains what personal data we collect when you use Offer at offerbeta.com (the "Service"), why we collect it, who we share it with, how long we keep it, and what rights you have.
Contents
- 1. Who we are
- 2. Summary
- 3. What we collect, why, and on what legal basis
- 4. Guest mode and your browser
- 5. AI processing
- 6. Who we share data with
- 7. International transfers
- 8. How long we keep data
- 9. Your rights (EU, EEA and UK)
- 10. Additional information for US residents
- 11. Children
- 12. Security
- 13. Cookies and similar technologies
- 14. Changes to this policy
- 15. Contact
1. Who we are
The controller of your personal data is Kanan Shukurlu, a private individual based in Israel ("we", "us"). For any privacy question, write to support@offerbeta.com.
2. Summary
- Guest progress stays on your device. Exercises checked by code work without an account. Your guest progress is stored in your browser, not on our servers.
- An account stores your progress with us. If you sign in, we store your email, sign-in details, progress and the answers you write, so you can continue on any device.
- AI features send your answers to our AI provider. When you chat with an AI character or ask for a review, the text you wrote in that feature is sent to Anthropic to generate the reply or review. Under its commercial terms, Anthropic doesn't train its models on this data.
- Analytics only if you allow it. Then PostHog (hosted in the EU) counts visits and clicks for us, so we can see where people get stuck. It never gets what you type or your email, and it doesn't keep your IP address. You can change your choice at any time in "Cookie settings".
- No selling, no ads. We do not sell your personal data, do not share it for targeted advertising, and do not show ads.
- Your control. You can download your data and delete your account at any time in the account settings.
3. What we collect, why, and on what legal basis
The "legal basis" column refers to the GDPR and the UK GDPR. If you are outside the EU and the UK, the same practices apply; see section 10 for US state rights.
| Data | Examples | Why we use it | Legal basis |
|---|---|---|---|
| Account data | Email address; sign-in method (Google, GitHub or email link); the account ID from that provider; name and profile picture if the provider sends them; account creation and last sign-in time | Create and secure your account, sign you in, contact you about your account | Contract (Art. 6(1)(b)) |
| Practice data | Your progress, levels and scores; answers to in-game emails; chat messages with AI characters; SQL and Python code you write; interview transcripts and reviews (the last 20 are kept); your scores in "Rate the candidate"; posting profiles and job preps (company, role and short requirements extracted from a job posting you pasted, without contacts; a one-way fingerprint of the posting text; your prep plan settings); stories you write for behavioral interviews and your 2-minute intro (story bank); the in-game name you chose; settings such as language | Provide the Service, save your progress, show reviews and history | Contract (Art. 6(1)(b)) |
| Content sent to the AI provider | The messages, answers and code you write in an AI feature; a story from your story bank when you ask for AI notes on it; the task context; your in-game name; the text of a job posting you paste for a tailored mock or job prep, with emails, phone numbers, links and @handles replaced by “[contact]” | Generate the AI character's reply, the review of your answer, AI notes on a story, or a posting profile | Contract (Art. 6(1)(b)) |
| Security and usage-limit data | IP address; browser and device type; request time and the endpoint used; counters of AI requests per account; records of AI use (feature, time, cost); signs of abuse | Protect the Service, enforce fair-use limits on AI features, prevent fraud and abuse | Legitimate interests (Art. 6(1)(f)): keeping the Service secure and its costs under control |
| Communication | Emails you send us and our replies; delivery data of sign-in emails | Answer your requests, send sign-in links and important notices | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Purchase data (Pro pass) | Which pass you bought and when, the amount, currency, tax and discount, the promo code and its channel (the utm tags of the link you came from — only if you allowed analytics), the payment and customer IDs at Dodo Payments, refund and dispute status; a one-way fingerprint of your email (so the first-purchase discount applies once per person; removed when you delete your account); your confirmation that Pro starts right away and when you gave it. We do not receive your card details — Dodo Payments collects them | Give you Pro access, handle refunds and disputes, keep accounting records, apply the first-purchase discount once, compare marketing channels | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for accounting; legitimate interests (Art. 6(1)(f)) for channel statistics |
| Usage analytics (only if you allow it) | Pages and screens you open, buttons you click, and game steps with rough results (for example, "interview graded, score 70–84"); the page address and the site you came from; browser, device type, screen size, language and time zone; approximate location (country and city) worked out from your IP address; a random ID of your browser; your account ID if you're signed in. We never send what you type or your email, and PostHog doesn't store your IP address | See which features help and where people get stuck or leave, to improve the Service | Consent (Art. 6(1)(a)) |
| Consent records | Your choice in the cookie banner or in "Share usage analytics" (account settings) and when you made it | Remember and respect your choice | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
What we do not collect. We do not ask for, and you should not enter, sensitive personal data (for example, health, religion, political opinions, sexual orientation or government ID numbers). We don't receive your card details — Dodo Payments collects them (section 6).
Your answers may contain personal data you choose to write. Remove names and contacts of other people (for example, recruiters in a job posting) before pasting text into the Service.
Job postings you paste ("Prepare for a job"). Without AI, the posting is read on your device. We keep the requirements we found (without contacts) and a one-way fingerprint of the text so we don't read it twice. We don't store the posting text. Lines with emails, phone numbers or links are dropped when the posting is read on your device; when AI reads the posting, these contacts are replaced with “[contact]” before the text is sent. You can remove a prep at any time ("Remove this prep"); this deletes its requirements and fingerprint from your progress.
Story bank. Your behavioral stories and 2-minute intro are part of your progress: on your device and, if you're signed in, in your account. A story goes to the AI provider only when you ask for AI notes on it, with emails, phone numbers and links replaced by “[contact]”. Please leave out names, health or family details and employers' confidential figures. A deleted story leaves your bank and account at once; how long copies and AI notes stay is in section 8.
How we use your answers beyond running the Service. We do not read your answers, except (a) when you send them to us for support, (b) when we investigate a security incident or abuse, or (c) when we compute aggregated, de-identified statistics to improve tasks and rubrics (legitimate interests). We do not use your answers to train AI models.
4. Guest mode and your browser
In guest mode, and as a local copy for signed-in users, the Service stores data in your browser's local storage: your progress, settings and interface state. The practice database runs inside your browser, and nothing from it is sent to us. To run Python and pandas exercises, your browser downloads the Python runtime (Pyodide) directly from jsDelivr, a public content delivery network, which sees your IP address as part of the download. We have no contract with jsDelivr. See the Cookie Policy for the full list of what is stored.
If you allow analytics, it works in guest mode too: the usage data from section 3 is sent under a random ID instead of an account.
When you sign in for the first time on a device with guest progress, we ask whether to copy that progress to your account. Nothing is uploaded without your confirmation.
5. AI processing
Provider. AI features use models from Anthropic, PBC (USA). Anthropic processes the data on our behalf under its commercial terms and data processing addendum.
What is sent. Only what is needed for the reply or review: your messages, answers and code in that feature, the task context, your in-game name, a story from your story bank when you ask for AI notes on it, and the text of a job posting you pasted when AI reads it (with contacts masked). We do not send your email address or your sign-in provider details.
Training. Under Anthropic's commercial terms, Anthropic may not use our API data to train its models.
Retention at Anthropic. Under Anthropic's published policy, inputs and outputs are deleted automatically within 30 days. Content flagged for a usage-policy violation may be kept for up to 2 years.
Scores are not automated decisions about you. The Service scores your practice answers with code and AI against our rubrics. These scores are training feedback inside the Service. They do not produce legal effects or similarly significant effects for you, and they are not shared with employers. If you think a review is wrong, write to support@offerbeta.com.
6. Who we share data with
We share personal data only with the parties named in this section, and only to the extent each one needs. The service providers in the table process it on our behalf under their data processing terms, which require them to protect it.
| Provider | What it does for us | Data location | Data involved |
|---|---|---|---|
| Supabase, Inc. | Sign-in and database for accounts, progress and purchases | EU (Ireland) | Account data, practice data, purchase data |
| Render Services, Inc. | Hosts our application server | EU | Requests passing through the server, including content sent to the AI provider; server logs |
| Anthropic, PBC | AI replies and reviews | USA | Content sent to the AI provider (section 5) |
| Resend, Inc. | Sends sign-in emails | USA | Email address, email delivery data |
| Cloudflare, Inc. | DNS for our domain; forwarding of email sent to support@offerbeta.com; bot protection (Turnstile) on email sign-in | Global network; USA | IP address, browser and device signals collected by the bot check; emails you send to support@offerbeta.com |
| PostHog, Inc. | Usage analytics, only if you allow it | EU (Frankfurt, Germany) | Usage analytics (section 3); your IP address arrives with each request but isn't stored |
Payments. Dodo Payments (Dodo Payments, Inc. and its affiliates) sells the Pro pass as our online reseller and Merchant of Record (Terms, section 9). When you pay, Dodo Payments collects your payment details, billing email, country and, where tax requires it, postal code as an independent controller under its own privacy policy (dodopayments.com/legal/privacy-policy). To open the payment window, we pass Dodo Payments the email address of your account (pre-filled; you can change it), your language and color theme, and internal IDs of your account and purchase, so the payment is linked to your account. We receive from Dodo Payments only what we need to give you Pro: the payment and customer IDs, what was bought, the amounts, tax and discount, and refund or dispute status. The code of the payment window is part of our site and loads only when you start a purchase; the window itself comes from Dodo Payments' servers.
Sign-in providers. If you sign in with Google or GitHub, that company processes your data as an independent controller under its own privacy policy. It tells us that you have signed in and shares the account details listed in section 3. It does not see your activity in the Service.
Support email. Mail you send to support@offerbeta.com is forwarded by Cloudflare to our mailbox at Google (Gmail, USA), where your emails and our replies are kept (section 8).
Other cases. We may disclose data if the law requires it, to protect our rights or the safety of users, or to a successor if the Service is transferred. In a transfer, this policy will continue to protect your data, and we will tell you in advance.
7. International transfers
Some providers are located in, or may access data from, the United States or other countries outside the EU/EEA and the UK. When we transfer data there, we rely on one of these: an adequacy decision (including the EU–US Data Privacy Framework and the UK Extension, where the recipient is certified), or the European Commission's Standard Contractual Clauses together with the UK Addendum. You can ask us for a copy of the relevant safeguards at support@offerbeta.com.
8. How long we keep data
| Data | How long |
|---|---|
| Account data and practice data | While your account exists. "Delete account" in the settings removes it from the live database at once (a request by email: within 30 days); backups are overwritten within a further 30 days. |
| Sign-in log (email, IP address, time of sign-in events) | Kept by Supabase, our sign-in service, for security, with no fixed limit yet. Deleting your account doesn't remove it; write to us and we'll delete your entries. |
| Inactive accounts | We may delete an account that has not been signed in to for 24 months. Before that, we email you, and the account stays if you sign in within 30 days. |
| Interview archive | The last 20 interviews, of them at most 5 behavioral mocks; older ones are removed automatically. You can delete the transcript of a behavioral mock yourself (“Delete transcript” in its debrief): the transcript leaves your progress and account at once (another device you’re signed in on won’t bring it back), its score stays if it was graded; older automatic backups of your progress are replaced over the next saves. |
| Story bank | While you keep it: up to 30 stories (up to 40 for a while after merging progress from two devices, until you delete a few) and your 2-minute intro. A deleted story leaves your bank and account at once; older automatic backups of your progress are replaced over the next saves. |
| Saved AI results (interview debriefs and AI notes, with short quotes from your text) | Up to 2 days, so a dropped connection doesn't cost you a review; deleted at once when you delete your account. |
| Content at the AI provider | Deleted by Anthropic within 30 days under its policy; content flagged for policy violations up to 2 years (see section 5). |
| Server logs (Render and our server) | Up to 30 days. We do not write the text of your answers into server logs. |
| Usage-limit counters | Daily counters up to one month; counters of trial AI sessions and of a Pro pass's AI allowance — while your account exists. |
| Records of AI use (feature, time, cost) | While your account exists. After you delete your account, they stay without anything that links them to you, for cost accounting. |
| Usage analytics (PostHog) | 1 year — how long PostHog keeps events on our plan. Withdrawing consent stops collection at once and removes the analytics ID from your browser. Deleting your account also deletes the analytics linked to it; PostHog removes those events within about a week. |
| Purchase records (Pro pass) | As long as accounting law requires. After you delete your account, purchase records stay without your email or account; only the Dodo Payments payment ID remains, so refunds and disputes that arrive later can still be matched and channels compared. The content of payment notifications from Dodo Payments is trimmed to what we need (no card or address data) and deleted after 90 days; a short record of each notification (its ID and type) is kept up to 400 days so it is never processed twice. |
| Support emails | 24 months after the request is closed. |
| Consent records | Until you change your choice or delete your account; in your browser, until you clear it. |
| Guest data in your browser | Until you clear it; we cannot access it. |
We may keep data longer if the law requires it or to establish, exercise or defend legal claims. In that case we keep only what is needed, only for as long as it is needed.
9. Your rights (EU, EEA and UK)
You have the right to:
- access your data and get a copy;
- portability — receive the data you gave us in a structured, machine-readable format (JSON);
- rectification of inaccurate data;
- erasure of your data;
- restriction of processing in certain cases;
- object to processing based on legitimate interests;
- withdraw consent at any time (for analytics: "Cookie settings" on the site, or "Share usage analytics" in the account settings); withdrawal does not affect earlier processing. A Global Privacy Control or Do Not Track signal from your browser counts as refusing analytics;
- complain to a supervisory authority — in the EU/EEA, the authority in your country; in the UK, the Information Commissioner's Office (ICO).
How to exercise them.
- Download: Account settings → "Download my data". You get a JSON file with your account data and practice data.
- Delete: Account settings → "Delete account". This deletes your account and practice data as described in section 8.
- Anything else: write to support@offerbeta.com from the email address linked to your account.
We answer within one month. In complex cases this can be extended by two more months, and we will tell you if it is. We may ask you to confirm your identity.
10. Additional information for US residents
This section applies to residents of California and of other US states with comprehensive privacy laws, to the extent those laws apply to us.
Notice at collection. In the last 12 months we collected the following categories of personal information, from you, from your device and from your sign-in provider, for the purposes described in section 3:
| Category | Examples | Retention |
|---|---|---|
| Identifiers | Email, account ID, sign-in provider ID, IP address; a random analytics ID if you allow analytics | See section 8 |
| Internet or other electronic network activity | Server logs, usage-limit records; pages, screens and buttons you use if you allow analytics | See section 8 |
| Geolocation data | Approximate location (country and city) from your IP address, if you allow analytics | See section 8 |
| Professional or employment-related information | Job postings you paste; answers to work-like tasks | See section 8 |
| Inferences | Scores, levels and simulated outcomes about your practice performance | See section 8 |
| Commercial information | Pro passes bought, amounts, promo code, refunds | See section 8 |
We disclose these categories to the service providers in section 6, and to Dodo Payments as the seller of the Pro pass, for business purposes only.
We do not sell or share personal information. We do not sell it, and we do not share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it.
Your rights. You can ask to know what personal information we collect, use and disclose; to get a copy; to delete it; and to correct it. We will not treat you differently for exercising your rights. You can use an authorized agent; we may ask the agent for proof of authority and ask you to verify your identity. We answer within 45 days (extendable once by 45 days with notice).
To make a request, use the account settings or write to support@offerbeta.com.
11. Children
The Service is not intended for children. You must be at least 16 to use it. We do not knowingly collect personal data from anyone under 16, and in particular from children under 13. If we learn that we have, we will delete it. If you believe a child has given us personal data, contact support@offerbeta.com.
12. Security
We use encryption in transit (HTTPS), access rules at the database level (row-level security, so each account can access only its own data), the principle of least privilege for staff and services, and we keep the AI provider's key on our server only. No system is perfectly secure. If a breach affects your data, we will inform you and the authorities as required by law.
13. Cookies and similar technologies
We use strictly necessary browser storage to run the Service, and analytics storage only if you allow it. We don't use advertising cookies. Details are in the Cookie Policy.
14. Changes to this policy
If we make material changes, for example adding a new provider or a new purpose, we will tell you in the Service or by email before they take effect. If a change requires your consent, we will ask for it.
15. Contact
Kanan Shukurlu, Israel · support@offerbeta.com