01Who we are
Caseroom is operated by [Operator legal name] (“we”, “us”), [postal address]. We are the controller of your personal data for the purposes of Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”) and, where it applies, the EU and UK General Data Protection Regulation (“GDPR”).
Caseroom is built mainly for candidates in Indonesia and South-East Asia preparing for Big 4 and MBB interviews. All cases use fictional clients. We are not affiliated with any consulting firm. The service is free and we do not take payments.
Questions about this policy can go to [contact email].
02Data we collect
Account data
- Guests: you can use Caseroom without signing up. We create a guest profile with a random name, kept in a cookie in your browser. We don't ask for your email or a password.
- Google sign-in: if you choose it, Google shares your name, email address and profile image with us.
Profile data you choose to add
Target firms, level, interview date, the skill you want to work on, headline, location and languages.
Practice activity
- Case attempts and your self-scores.
- AI interview transcripts, coach notes and AI scorecards.
- Drill results, lesson progress and bookmarks.
- Peer-practice slots you post or join, and feedback you give or receive.
- Community questions, answers, votes and reports.
- In-app notifications.
Technical and security data
- Sessions: the IP address and browser user agent of each signed-in session. We use these for security and to show you the list of devices signed in to your account.
- AI usage records: token counts and timings for each AI request. These do not include the content of your messages. We use them to apply fair-use quotas and control costs.
- Rate-limit counters that protect the service from abuse.
We do not ask for, and you should not give us, sensitive data such as health, religious or financial information.
03How we use your data
We use your data only to run and protect Caseroom. Specifically, to:
- Create and manage your guest profile or account, and sign you in.
- Provide the practice features: cases, the AI interviewer and coach, drills, lessons and progress tracking.
- Match you with practice partners and run the community.
- Keep the service secure: detect bots and abuse, apply rate limits and fair-use quotas, and fix errors.
- Moderate content and enforce our Terms of Service.
- Understand overall usage through cookieless, aggregate analytics so we can improve the product.
Our legal bases are: performing our agreement with you (providing the service you signed up for); our legitimate interests in keeping the service secure, preventing abuse and improving it; complying with legal obligations; and your consent where we ask for it (for example, if you choose Google sign-in). You can withdraw consent at any time.
We do not sell your personal data, and we do not use it for advertising.
04AI features
The AI interviewer, coach and feedback features send case content and the text you write (your interview answers, coach conversations and feedback text) to our AI model provider to generate replies. This is needed for these features to work.
- AI feedback and scores are generated automatically, for practice only. They can be wrong and are not a prediction of how you will do in a real interview. They have no legal or similarly significant effect on you.
- Please do not paste confidential information from real employers, clients or firms into Caseroom.
05What other users can see
- Peer practice: when you practise with someone, they can see your name, headline and location. Video calls take place on third-party services, such as Jitsi or a link the host provides (for example Google Meet or Zoom). Those calls are covered by the provider’s own terms and privacy policy, not ours.
- Community: questions, answers and your name on them are visible to all signed-in users.
- Administrators: a small number of authorised admins can access account and content data to moderate, support users and keep the service safe. Admin actions are audit-logged.
Your practice history, transcripts and scores are not shown to other users.
06Service providers and transfers
We use these service providers (processors) to run Caseroom. They may only use your data to provide their service to us.
- Vercel: hosting, plus cookieless web analytics and speed insights.
- Neon: our Postgres database.
- Cloudflare Turnstile: bot protection when a new guest profile is created.
- Sentry: error monitoring. It is configured not to send interview text.
- Google: sign-in, only if you choose to use your Google account.
- AI model provider (Ollama Cloud, accessed through an OpenAI-compatible API): receives case content and your interview, coach and feedback text to generate replies.
International transfers. These providers may process your data outside Indonesia, for example in the United States or the European Union. When we transfer data abroad, we take steps required by UU PDP and, where relevant, the GDPR to make sure it stays adequately protected, such as relying on contractual safeguards with our providers.
We may also disclose data if the law requires it, to protect the rights and safety of users or the public, or as part of a transfer of the service to a new operator (in which case this policy will continue to apply to your data).
08How long we keep data
- Account data is kept for as long as your account exists. A guest profile is deleted automatically once it has been unused for 90 days, because nobody can get back into it after that.
- When you delete your account (Settings → Account & data → Delete), we delete your account data. The exception is community posts: these stay visible, attributed to “Deleted user”, so that threads remain readable for others. Delete any posts you do not want to remain before closing your account.
- Server logs and backups roll off within about 30 days.
- AI usage records, which contain no message content, may be kept in aggregate for up to 12 months.
09Security and breaches
We protect your data with measures including:
- HTTPS encryption for all traffic.
- Passwords stored only as salted hashes.
- Rate limiting and bot protection.
- Sessions you can review and revoke from your settings.
- Audit logs of admin actions.
No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authority in writing within 3 x 24 hours of becoming aware of it, as UU PDP requires, and tell you what happened and what we are doing about it.
10Your rights
Under UU PDP, and the GDPR if you are in the EU or UK, you have the right to:
- Access and export your data. Settings → “Download my data” gives you a JSON export of your account data.
- Correct your data. You can edit most of it on your profile page.
- Delete your data, by deleting your account or by contacting us.
- Object to processing based on our legitimate interests, or restrict it.
- Withdraw consent where we rely on it. This does not affect processing before you withdrew it.
- Complain to a regulator: in Indonesia, the authority responsible for personal data protection; in the EU or UK, your local data protection authority.
To use any right we cannot handle in-app, email [contact email]. We may need to confirm your identity first. We aim to respond within the time limits set by applicable law.
11Minimum age
You must be at least 18 to use Caseroom. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
12Changes to this policy
We may update this policy as the service changes. The “Last updated” date at the top shows the latest version. If we make material changes, we will tell you by email or in the app before they take effect.
13Contact us
[Operator legal name]
[postal address]
Email: [contact email]
See also our Terms of Service.