Privacy policy

Vinci by Nova Firenze ("Vinci", "we") is an AI coach for learning and interview preparation. It is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], which is the controller of the personal data described here. Questions or requests: [CONTACT EMAIL].

We collect what Vinci needs to coach you, we do not sell it, we do not show ads, and we do not use tracking or analytics scripts.

What we collect

Your account

• Your name, email address and a hash of your password (never the password itself), or, if you sign in with Google or GitHub, the name, email and account id that provider shares with us.
• The invite code you signed up with, your plan and your role.
• For each signed-in session: a session token, when it was created and expires, and the IP address and browser user agent it came from.

What you create while learning

• Your goals and profile answers from onboarding, your syllabus, lessons, quiz answers and progress.
• Code you write and run, mentor conversations, hints, explanations and whiteboard sketches.
• Mock interview transcripts and scorecards, behavioral questions and the stories you write for them.
• Job postings you add and the fit analyses made from them.
• Mastery, readiness and activity records computed from the above.

Your résumé

If you upload a résumé, we read its text and send it to our AI provider to build a structured summary of your experience and skills. Before that, we replace contact and identity details (email addresses, phone numbers, street addresses, profile links, ID numbers, dates of birth and your name) with placeholders. This is pattern based, so it reduces what is shared but cannot guarantee every detail is caught. A PDF résumé is also passed to the AI provider as a file, so please remove your address, phone number, date of birth and ID numbers before uploading. We keep only the file name and the structured summary; the raw résumé text is not stored.

Usage records

To enforce plan limits and understand costs, we record how many AI requests and code runs you make and how many AI tokens they used. We also note which days you used Vinci, to count active users and retention in aggregate. Application logs record errors and request metadata. They are written so they do not contain passwords, tokens, cookies, submitted code or résumé text.

On your device

Vinci sets one session cookie to keep you signed in. It does not use advertising or tracking cookies. Your browser's local storage keeps preferences such as theme, voice settings, editor layout and unsaved drafts; these stay on your device. If you install Vinci as an app, the service worker caches pages you have opened so they work offline.

How we use it

• To provide the service: generate your syllabus and lessons, run your code, mentor you, run mock interviews and score your readiness.
• To secure it: authenticate you, prevent abuse, enforce plan limits and investigate errors.
• To send account email: verification and password reset messages. We do not send marketing email.

Our legal bases are performing our contract with you (providing the service you signed up for) and our legitimate interest in keeping the service secure and working.

Who we share it with

We share personal data only with the providers that run parts of Vinci for us, and only what each one needs:

• Anthropic (AI models). Your lesson requests, code, mentor and interview conversations, stories, job postings and redacted résumé are sent to Anthropic's API to generate responses. Under its commercial terms, Anthropic does not train its models on this data.
• Vercel (hosting), and our database host. They run the application, store your data, and run some of the code you submit in isolated sandboxes.
• Resend (email). Your email address and the content of verification and password reset emails.
• Sentry (error monitoring). When something breaks, a report of the error: the technical details, the page address without any tokens, your browser type and your opaque account id. It never includes your email address, code, résumé or conversations.
• Google or GitHub, only if you choose to sign in with them.
• Your browser's speech service, only if you use voice mode in a mock interview. Speech recognition is provided by your browser, not by Vinci, and browsers such as Chrome send the audio to their own servers (Google, for Chrome) to transcribe it. Only the resulting text reaches Vinci. Spoken replies are synthesised on your device.

If you create a share link for a mock interview scorecard, anyone with the link can see what you chose to include until you revoke it. We may also disclose data when the law requires it.

Some of these providers process data outside your country, including in the United States. Where the law requires it, these transfers rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

We keep your data while your account exists. When you delete your account, your profile and everything you created are deleted at once. Usage records are kept without anything that identifies you, so our cost totals stay correct. Database backups that contain deleted data are overwritten on their normal rotation of [BACKUP RETENTION PERIOD].

Your choices and rights

• Export: download everything your account owns as one JSON file from your account page.
• Delete: delete your account and its data from the same page.
• Correct: edit your name, profile and résumé in the app, or ask us.
• Revoke: turn off share links at any time.

Depending on where you live, you may also have the right to access, restrict or object to processing of your data, and to complain to your data protection authority. To exercise any right, write to [CONTACT EMAIL]. We answer within 30 days.

Security

Traffic is encrypted, passwords are hashed, code you submit runs in throwaway sandboxes without network access, and every request is checked so one account can never read another's data. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

Children

Vinci is not meant for anyone under [16], and we do not knowingly collect their data.

Changes

If we change this policy in a way that matters, we will update the date above and tell you by email or in the app before the change takes effect.