Privacy policy

1. Who we are

KOULI LIMITED ("KouLi", "we", "us") is the data controller for personal data processed through our website at kouli.io and the KouLi practice app. KouLi is a product of KOULI LIMITED, a United Kingdom company registered in Scotland (Companies House number SC888612).

KouLi provides adaptive interview, pitch, and speech practice with AI coaching. This policy explains what we collect, how we use it, and the choices you have.

2. Data we collect

• Account and profile: email address, name, and settings you provide when you sign up or use the service.
• Practice content: CVs, job descriptions, transcripts, and answers you choose to save when you consent to practice-data storage.
• Voice during sessions: audio is streamed in real time to our AI providers to run practice sessions. KouLi does not store raw audio recordings.
• Session metrics: progress, scores, and usage data needed to run the product (for example, which modes you have tried).
• Payment data: if you subscribe, payment is handled by Stripe. We receive billing status and limited customer identifiers, not full card numbers.
• Technical data: device, browser, IP address, and logs needed to operate, secure, and debug the service.

We do not sell your data. We do not use your voice or practice transcripts for advertising.

3. How we use your data

We use personal data to:

• provide practice sessions, feedback, and coaching features;
• personalise questions and debriefs to your CV and target role;
• manage your account, subscriptions, and support requests;
• improve reliability, security, and product quality;
• meet legal, tax, and regulatory obligations.

4. Voice and AI processing

Live voice sessions are processed by third-party AI providers acting as our subprocessors. Our primary provider for real-time voice is xAI. If xAI is unavailable or a feature cannot use it, we may fall back to OpenAI speech or realtime endpoints. In degraded mode, some features may use deterministic templates, client-side debrief, or browser text-to-speech instead.

Audio is transmitted over encrypted connections for the duration of a session. KouLi does not retain raw audio after the session ends. Providers may process audio according to their own policies; we choose providers with appropriate security standards and use contractual safeguards where required.

5. Consent and your control

Saving practice transcripts, CVs, and job descriptions requires your consent. You can withdraw consent or delete stored practice data at any time using Forget me in the app, which removes your consented practice material from our systems.

Account deletion and data rights requests are described in section 8. For more on security measures, see our Data & security page.

6. Legal basis (UK & EU GDPR)

• Contract: to provide the service you signed up for.
• Consent: where required, for example storing practice transcripts and CVs.
• Legitimate interests: to secure, maintain, and improve KouLi, where those interests are not overridden by your rights.
• Legal obligation: for example retaining payment records for tax purposes.

7. Who we share data with

We use trusted service providers to run KouLi, including:

• xAI — primary real-time voice and AI processing;
• OpenAI — fallback voice and AI processing;
• Stripe — payments and subscriptions;
• Hosting and infrastructure providers — application hosting, databases, email, and analytics (for example Render, Supabase, Resend, and Vercel on the marketing site).

These providers process data on our instructions and only as needed to deliver the service. We do not sell personal data to third parties.

8. How long we keep data

• Account and profile: while your account is active.
• Consented practice data (transcripts, CVs, job descriptions): while your account is active, or until you delete it with Forget me.
• Live audio: not stored by KouLi.
• Session metrics: while your account is active.
• Payment records: up to 7 years, as required for UK tax and accounting.
• Server logs: typically 30–90 days, unless needed longer for security investigations.
• Marketing and product emails: until you unsubscribe or for up to 24 months of inactivity, whichever comes first.

We may delete or anonymise inactive accounts after a prolonged period without login. We will give reasonable notice before doing so where practicable.

9. Your rights

Under UK and EU data protection law you have the right to access, correct, delete, or restrict use of your data, to object to certain processing, and to data portability where applicable. You can withdraw consent at any time where we rely on it.

To exercise these rights, use Forget me in the app or contact us at privacy@kouli.io. You also have the right to complain to the UK Information Commissioner's Office (ICO) or your local supervisory authority.

10. Security and international transfers

We use technical and organisational measures to protect your data, including encryption in transit and access controls. Your data may be processed in the UK, EU, United States, or other countries where our providers operate. Where required, we use appropriate safeguards such as standard contractual clauses.

11. Children

KouLi is not directed at children under 16. If you believe a child has provided us personal data without appropriate consent, contact us and we will take steps to delete it.

12. Changes

We may update this policy from time to time. We will post the current version at kouli.io/privacy and, where appropriate, notify you of significant changes.