Privacy Policy

This policy explains what personal information CaseClimb (caseclimb.ai) collects, why, who we share it with, and the choices you have. It applies to the CaseClimb website and app, run by Hamza El Mounhi. Questions or requests: [email protected].

1. What we collect

• Account details: your name and email address, and a password (stored in hashed form by our sign-in provider; we can't read it). If you sign in with Google, we receive your name and email from Google.
• Your preparation profile: the firms you're targeting, your interview date if you enter one, and the focus areas and skills you choose.
• Your practice: what you type in case and fit interviews, the transcripts and scorecards, your numerical test answers and scores, and your progress, levels and readiness score.
• Invitations: if you invite a friend, your personal invite code and how many friends joined and finished an interview. If you join through a friend's link, we record who invited you. Your friend never sees your name or results, and you never see theirs.
• Bookings: if you book a live mock interview, the booking is handled by Calendly. We receive what you enter there, such as your name, email and target firm.
• Messages: anything you send us by email.
• Technical data: your IP address and basic device and browser details, which our hosting provider records in server logs, and counters of how many AI requests your account makes per day (used to prevent abuse).

We don't use advertising or analytics trackers. The app stores your sign-in session, a cached copy of your progress and a few small preferences in your browser's local storage, which it needs to work. We don't sell your personal information.

2. How we use it

• To run the service: sign you in, save your progress, and run your interviews, tests and scorecards.
• To personalise practice: your daily workout, recommendations, and short notes about your strengths and weak spots that the interviewer can use.
• To calculate your readiness score and show how it compares with other candidates. The comparison uses anonymous scores only; nobody's name or details are shown.
• To run the invitation programme: link a new candidate to the friend who invited them and give both of them credits.
• To keep the service safe and fair: usage limits, abuse prevention, fixing bugs.
• To communicate with you: account emails such as email confirmation and password reset, and replies to your messages.
• To improve the product using aggregated, non-identifying statistics.
• To meet legal obligations.

Our team can access account and practice data through administrative tools, to give support, keep the service running and improve it.

3. AI processing

The AI interviewer, the scorecards and the generated numerical questions are produced by Anthropic's Claude models. To do this we send Anthropic what you type in an interview, the case material, and a short summary of your practice history. We do not send your email address or password. Under Anthropic's commercial terms, content sent through its API is not used to train its models by default; please check Anthropic's current terms for details.

Please don't put sensitive personal information (such as health details) or confidential information belonging to an employer or client into your answers. AI output can be wrong or incomplete.

4. Who we share it with

We use service providers to run CaseClimb. They process data only to provide their service to us:

• Supabase: database and sign-in (stores your account and practice data).
• Vercel: website hosting.
• Anthropic: AI processing, as described above.
• Google: sign-in, if you choose Continue with Google.
• Calendly: booking live mock interviews.
• Email delivery: account emails are sent through our sign-in provider or a dedicated email service.
• Payments: paid plans are sold through Lemon Squeezy, which acts as the merchant of record. It processes your payment details, handles taxes and issues your receipt, and tells us which account paid for which plan. We never see or store your card number.

We may also disclose information if the law requires it, to protect our rights and users, or as part of a business sale or restructuring, in which case this policy would continue to apply.

5. Where your data is stored

Your data is stored with our database provider, Supabase, in the United States (US East, N. Virginia). CaseClimb is operated from the United Arab Emirates, so your data is transferred there and to other countries where our providers operate. Where required, we rely on safeguards such as standard contractual clauses.

6. How long we keep it

We keep your account and practice data for as long as your account exists. If you ask us to delete your account, we delete your personal data within 30 days, except where we must keep something by law. Backups are overwritten on their normal cycle. Aggregated statistics that can't identify you may be kept.

7. Your rights (EEA, UK and similar)

If you're in the European Economic Area, the UK or a jurisdiction with similar law, Hamza El Mounhi is the data controller of your personal data. You have the right to: access the data we hold about you; correct it if it's inaccurate; delete it ("right to be forgotten"); restrict or object to certain processing; receive it in a portable format; and withdraw consent at any time where we rely on it. Our legal bases for processing are performing our contract with you (running the service you signed up for), our legitimate interests in operating and securing it, your consent where we ask for it, and compliance with legal obligations. Email [email protected] to exercise any of these rights; there is not yet a self-service delete button, but we act within 30 days. You can also lodge a complaint with your local data protection authority.

8. California privacy rights (CCPA/CPRA)

If you're a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to: know what personal information we've collected about you and why; delete it; correct it if it's inaccurate; opt out of the sale or sharing of personal information; and limit the use of sensitive personal information. We don't sell or share personal information for cross-context behavioural advertising, and we don't use it for any purpose beyond running and improving the service described in this policy, so there's nothing to opt out of or limit. We won't discriminate against you for exercising any of these rights.

In the last 12 months we've collected these categories of personal information, for the purposes described in section 2: identifiers (name, email, IP address); account and practice records (your interview transcripts, scores and progress); commercial information (which plan you bought, held by our payment provider); and internet or device activity (basic browser and device details from server logs). We don't sell or share any of it. To exercise a right above, or to name an authorised agent to do it for you, email [email protected]; we may need to verify it's really you first.

Do Not Track: some browsers can send a "Do Not Track" signal. There's no agreed standard yet for how a site should respond to it, so ours doesn't change behaviour based on it — though since we don't use advertising or analytics trackers in the first place, there's nothing on this site for it to switch off.

9. Security

Data is encrypted in transit, and access to it is restricted. No system is completely secure, so we can't guarantee absolute security. Choose a strong, unique password and keep it private.

10. Children

CaseClimb is not intended for anyone under 16. If you believe a child has given us personal information, contact us and we'll delete it.

11. Changes

We may update this policy. When we make a significant change, we'll update the date below and, where appropriate, tell you in the app or by email.

12. Contact

Hamza El Mounhi, Dubai, United Arab Emirates. Email: [email protected].