1. Scope and operator
This notice applies to Tonari Tutor. Tonari Labs operates the service from Japan, determines the purposes below, and is responsible for the personal information processing described here. Contact: privacy@tonari.ai. The operator's private residential address is not published for personal safety; where applicable law requires legal identity or address details, they will be provided without delay upon request at privacy@tonari.ai.
2. Information and sources
We process extracted or pasted resume and job-description text, including URL strings as text; interview choices; email address, access-code, verification, session, and usage-limit records; live microphone audio; transcripts and session identifiers; AI feedback and scores; optional feedback you submit; and technical data such as IP address, browser, device, timestamps, approximate region, security events, and interactions.
3. Resume and job information
PDF, DOCX, TXT, and Markdown file bytes are read in your browser and are not uploaded as original files. Extracted or pasted text is held in page memory and sent to OpenAI as interview context when you start an interview. Tutor does not fetch pasted URLs; they remain text. Clearing or replacing the text, closing the page, or reloading removes it from browser memory, but does not erase copies already processed by a provider.
4. Microphone and live interview
The three-second microphone check creates a temporary browser-only clip for local playback and revokes its object URL; it is not uploaded. During an interview, microphone audio is streamed to OpenAI for transcription and AI responses. Tonari does not separately create a raw audio file, but OpenAI may process or retain audio, transcripts, and session data under its production settings and terms.
5. Post-call processing
Tonari Tutor is not a zero-retention service. The Cloudflare Worker and Durable Object assemble the finalized transcript and send it to OpenAI's Responses API with application storage disabled to create a structured report. The report appears in the page and may be emailed through Resend. Provider-side safety, abuse-monitoring, and delivery records follow provider terms and production settings.
6. Purposes and legal bases
We use information to verify access, provide and secure practice interviews, tailor questions to your materials, create feedback, enforce demo limits, respond to requests, improve reliability, prevent abuse, comply with law, and resolve claims. Where GDPR or UK GDPR applies, requested features rely on performance of your request or pre-contractual steps; access control, security, diagnostics, and improvement rely on legitimate interests; and legal compliance relies on legal obligation. Other lawful bases may apply by jurisdiction.
7. Providers and disclosures
Cloudflare provides Pages hosting, Worker processing, Durable Objects, protection, rate limiting, and KV storage, including optional product-feedback submissions; OpenAI provides Realtime voice, transcription, and structured feedback generation; and Resend delivers access codes and reports. Browser document-parsing and design assets are served from Tonari Tutor's own origin. We may disclose information to advisers, authorities, or a successor when lawful and necessary. We do not sell personal information or use it for cross-context behavioral advertising.
8. Retention, storage, and transfers
Original file bytes remain on your device, and page-memory document text lasts until cleared, replaced, or the page closes. The browser keeps the verified email and session token until the application invalidates them or you delete site data. Access codes expire within 10 minutes; access/session records within 24 hours. Demo-limit counts persist to enforce the limit. First-party transcript and provider-session state are removed within 30 minutes after finalization; structured report state expires within 24 hours; and optional product feedback in KV expires within 90 days. Provider delivery, security, and platform records follow provider terms or production settings. Processing may occur in Japan, the United States, the EEA, or elsewhere with lawful safeguards where required.
9. Device storage and choices
You can decline or revoke microphone access, avoid providing files or pasted information, clear localStorage and site data, and decline optional feedback. The interview page does not load third-party analytics or feedback scripts. We do not sell or share personal information for targeted advertising.
10. EEA, UK, and Swiss rights
Where applicable, you may request access, correction, deletion, restriction, portability, or a copy; object to processing; withdraw consent where processing relies on it; and complain to a supervisory authority. Rights may be limited by law. We may verify identity and respond within the legally required period.
11. California and other U.S. state rights
Where applicable, you may request categories, sources, purposes, recipients, and specific pieces of personal information; correction, deletion, or portability; opt out of sale, sharing, or targeted advertising; limit certain sensitive-information uses; appeal a denial; and receive equal service. We offer no financial incentive for personal information. A verified authorized agent may submit a request.
12. Japan APPI and other regions
The utilization purposes are in section 6, entrusted processors in section 7, and foreign processing in section 8. Where APPI applies, you may request purpose notification, disclosure of retained data or transfer records, correction, deletion, suspension of use, erasure, or suspension of third-party provision, and may consult Japan's Personal Information Protection Commission. We honor comparable rights in other regions where applicable.
13. AI limits, security, and children
AI interviewer feedback is for practice, may be inaccurate, and is not an employment decision or a solely automated decision with legal or similarly significant effect. We use HTTPS, access tokens, rate limits, provider keys kept server-side, data minimization, and provider security controls, but no system is completely secure. The service is not directed to children under 13 in the United States or the equivalent minimum age elsewhere, and we do not knowingly collect their information.
14. Changes and contact
We may update this notice when features, providers, settings, or laws change. The effective and last-updated dates identify the current version, and material changes will receive proportionate notice. Send questions or rights requests to privacy@tonari.ai and identify Tonari Tutor and the right you want to exercise.