Privacy policy

1. Who we are

KOULI LIMITED ("KoLi", "we", "us") is the data controller for personal data processed through our website at getkoli.io and the KoLi practice app. KoLi is a product of KOULI LIMITED, a United Kingdom company registered in Scotland (Companies House number SC888612).

KoLi provides adaptive interview, pitch, and speech practice with AI coaching. This policy explains what we collect, how we use it, and the choices you have.

2. Data we collect

• Account and profile: email address, name, and settings you provide when you sign up or use the service.
• Practice content: CVs, job descriptions, transcripts, and answers you choose to save when you consent to practice-data storage.
• Voice during sessions: audio is streamed in real time to our AI providers to run practice sessions. KoLi does not store raw audio recordings.
• Session metrics: progress, scores, and usage data needed to run the product (for example, which modes you have tried).
• Payment data: if you subscribe, payment is handled by Stripe. We receive billing status and limited customer identifiers, not full card numbers.
• Technical data: device, browser, IP address, and logs needed to operate, secure, and debug the service.

We do not sell your data. We do not use your voice or practice transcripts for advertising.

3. How we use your data

We use personal data to:

• provide practice sessions, feedback, and coaching features;
• personalise questions and debriefs to your CV and target role;
• manage your account, subscriptions, and support requests;
• improve reliability, security, and product quality;
• meet legal, tax, and regulatory obligations.

4. Third-party AI processing

KoLi's coaching, feedback and simulated conversation features are delivered using AI services operated by third parties on our behalf. We ask for your explicit consent in the app before any of your information is sent to these services, and you can withdraw that consent at any time under Profile > "Your data, your call" > "AI-powered features". If you decline, the AI features are unavailable, but the rest of your account is unaffected.

Which providers we use, and what we send them

• xAI — powers live spoken coaching and simulated conversations. During a live session your microphone audio is streamed to xAI so the coach can hear and respond in real time. We also send the text of the session: transcribed speech, your responses, and relevant context such as your practice goals, previous session scores and any CV or job description details you have chosen to add.
• OpenAI — converts recordings of your speech into text, and generates written assessments and feedback. We send the relevant audio recording or transcript, together with your responses and any CV or job description text needed for the assessment.
• Anthropic — generates interview questions, panels, briefs and written analysis. We send text only: your CV and job description details, your practice context, and your responses.

We do not send your name, email address or payment details to any of these providers. Audio is transmitted over encrypted connections for the duration of a session.

Your camera

Your camera is used only on your own device. The self view, posture and body-language feedback are processed locally in the app and the video is never uploaded, streamed or stored by us or by any third party.

Retention

We do not store your audio recordings. Transcripts, scores and session summaries are stored in your account so you can see your progress over time. Where you have also opted in to helping improve KoLi, these may be used to improve our coaching; you can turn that off separately at any time under Profile.

5. Consent and your control

Sending your information to third-party AI providers requires your explicit consent in the app (an "Accept & Enable AI Features" step). You can withdraw that consent at any time under Profile > Your data, your call > AI-powered features.

Saving practice transcripts, CVs, and job descriptions so we can improve coaching is a separate choice. You can turn that off under Profile, or delete stored practice data using Forget me, which removes your consented practice material from our systems.

Account deletion and data rights requests are described in section 9. For more on security measures, see our Data & security page.

6. Legal basis (UK & EU GDPR)

• Contract: to provide the service you signed up for.
• Consent: where required, including sending information to third-party AI providers, and storing practice transcripts and CVs.
• Legitimate interests: to secure, maintain, and improve KoLi, where those interests are not overridden by your rights.
• Legal obligation: for example retaining payment records for tax purposes.

7. Who we share data with

We use trusted service providers to run KoLi, including:

• xAI — live spoken coaching and simulated conversations;
• OpenAI — speech-to-text and written assessments;
• Anthropic — interview questions, panels, briefs and written analysis;
• Stripe — payments and subscriptions;
• Hosting and infrastructure providers — application hosting, databases, email, and analytics (for example Render, Supabase, Resend, and Vercel on the marketing site).

These providers process data on our instructions and only as needed to deliver the service. We do not sell personal data to third parties.

8. How long we keep data

• Account and profile: while your account is active.
• Consented practice data (transcripts, CVs, job descriptions): while your account is active, or until you delete it with Forget me.
• Live audio: not stored by KoLi.
• Session metrics: while your account is active.
• Payment records: up to 7 years, as required for UK tax and accounting.
• Server logs: typically 30–90 days, unless needed longer for security investigations.
• Marketing and product emails: until you unsubscribe or for up to 24 months of inactivity, whichever comes first.

We may delete or anonymise inactive accounts after a prolonged period without login. We will give reasonable notice before doing so where practicable.

9. Your rights

Under UK and EU data protection law you have the right to access, correct, delete, or restrict use of your data, to object to certain processing, and to data portability where applicable. You can withdraw consent at any time where we rely on it.

To exercise these rights, use Forget me in the app or contact us at info@kouli.io. You also have the right to complain to the UK Information Commissioner's Office (ICO) or your local supervisory authority.

10. Security and international transfers

We use technical and organisational measures to protect your data, including encryption in transit and access controls. xAI, OpenAI and Anthropic process information in the United States. Where your information is transferred outside the UK, we rely on the safeguards required by UK data protection law to protect it, including standard contractual clauses where required.

11. Children

KoLi is not directed at children under 16. If you believe a child has provided us personal data without appropriate consent, contact us and we will take steps to delete it.

12. Changes

We may update this policy from time to time. We will post the current version at getkoli.io/privacy and, where appropriate, notify you of significant changes.