Privacy policy
Last updated 18 August 2026
Sotto listens to interviews, so it is worth being precise about what leaves your machine, who sees it, and what we keep. This page says exactly that.
Who is responsible
The controller of the personal data described here is LEGAL-TBD: registered entity name, registered at LEGAL-TBD: registered address. For anything on this page, including access and deletion requests, write to LEGAL-TBD: privacy contact address.
What leaves your machine while you use the app
Interview audio → a speech-to-text provider
To turn speech into text, the app streams microphone and system audio from the interview to Deepgram, a third-party transcription provider. This happens while recognition is running and is what makes the product work; there is no on-device transcription mode today.
Prompt and transcript content → a model provider
To generate an answer, the app sends the current transcript context and your profile's instructions — which can include your CV text, the job description and any notes you attached — to Anthropic, a third-party model provider. That request passes through our relay, which records what it cost.
Screenshots
When you use the screenshot feature, the captured image is sent to the model provider as part of the request. It is not stored on our servers.
What we store when you sign in
An account is required to use sotto's managed model access and to sync your data. When you have one we store:
- Account identity
- Your email address, whether it is confirmed, your password as a salted hash (never in readable form), and — if you signed in with Google or Microsoft — the identifier that provider gives us, together with the first and last name it sends, which we store on the account. We never receive your Google or Microsoft password.
- Interview profiles
- Everything you put in a profile: its name, target role and company, the job description, your extra instructions, model and language settings, and the files you attach, including your CV — stored both as the original bytes and as the extracted text the model is given.
- Interview sessions
- A record of every interview you run while the app is signed in: the profile it used, when it started and finished, and how many answers it produced. This record is stored whether or not recording is turned on.
- Session transcripts
- The transcript of a session turn by turn, with timestamps and the cost of each turn — but only where recording was on while the interview ran. Recording is a per-profile setting and a newly created profile has it on, so unless you turn it off your transcripts are stored. With it off, the session record above is still stored and no transcript is kept.
- Usage and spend
- One record per metered request — provider, model, token counts and cost — plus a daily total. This is what enforces your allowance and what the usage view on your account shows. What we report back to you is measured in credits: the usage view and the data export state the credits a request or a day used, not the provider cost behind them. That underlying cost stays in our records and is available from us on request.
- Subscription state
- Your Paddle customer and subscription identifiers, the plan, its status and period dates, mirrored from Paddle so we can tell what you are entitled to. We do not receive or store card details.
- Credits
- Each grant of credits made to your account: how many it carried and how many are left of it, when it was granted and when it expires, and what it came from — the plan period it covers, or the Paddle transaction if you bought a pack. While an answer is being generated we also hold a short-lived reservation against your balance, which is released when that request settles.
- Operational records
- Server logs, and an audit record of administrative actions taken on accounts. Logs are kept short-term for diagnosing failures.
Why we are allowed to process it
To provide the service you asked for and to bill it — performance of our contract with you. To keep the service working and prevent abuse, including spend limits and rate limits — our legitimate interests. Where the law requires consent, we ask for it. The controls that exist are these: starting and pausing capture in the desktop app, which is what decides whether any audio is being streamed at all; conversation recording, a per-profile setting that governs whether an interview's transcript is kept and sent to your account; deleting a session, which removes its transcript with it; deleting a profile or one of its files; and deleting your account. Signing in is what starts the syncing described above, and there is no separate sync setting to turn off.
Who else sees your data
- Deepgram — interview audio, for transcription.
- Anthropic — transcript context, profile instructions and attached-document text, to generate answers.
- Paddle — your purchase, as merchant of record. Paddle collects the payment details directly; we receive only the resulting subscription state.
- Resend — your email address, to send account emails such as confirmation and reset links.
- Microsoft Azure — our hosting and database provider, in LEGAL-TBD: hosting region.
We do not sell personal data, and we do not use your interview content to train models of our own. What each provider does with data it receives is governed by its own terms; the model and transcription providers are the ones to check if that matters to you.
International transfers
Our providers operate outside your country in some cases, including the United States. Where data leaves the region it was collected in, the transfer relies on the mechanism in that provider's data-processing terms, such as standard contractual clauses.
How long we keep it
Profiles and sessions are kept until you delete them or delete your account. Usage and spend records and subscription records are kept while the account exists. Server logs are kept short-term.
Deleting your account removes your profiles and the files attached to them, your sessions and their transcripts, your usage and spend records, your subscription records, and your credit grants and reservations. Three things outlive it. Where an operator has acted on your account — or on your email address before an account existed, such as granting or withdrawing early access — the audit record of that administrative action stays: that log is append-only, which is what makes operator actions reviewable afterwards. Server logs can still mention your email address for as long as they are kept; they age out on their own rather than being deleted with the account. And Paddle keeps the record of any purchase, because Paddle is the merchant of record for it.
Your rights
You can export your account data, and delete your account, from the account page — no request needed. The export carries your account identity — your email address, whether it is confirmed, the name we store, and any Google or Microsoft sign-in linked to the account — together with your profiles and the text extracted from the files attached to them, your sessions and their transcripts, your usage and spend records, your subscription state, and your credit grants. Two things are left out of it on purpose: the original file bytes, because each attached file is downloadable on its own, and your password hash, which is a credential rather than a fact about you and is of no use to you outside our sign-in. You can also ask us to correct data, to restrict or object to processing, or to explain what we hold. Write to the address above, or use the contact page. If you are in the EU or UK you can also complain to your data-protection authority.
Security
Traffic is encrypted in transit, and passwords are stored only as hashes. Access to production data is limited to the operators who need it, and administrative actions are recorded.
Children
The service is not intended for children, and we do not knowingly collect their data.
Changes
We will update this page when what we do changes. The date above is when it last changed; material changes are announced to account holders.