Privacy Policy

Last updated: October 25, 2026

This notice explains PMMockr's personal data processing, your choices and how to exercise your rights. It supports our preparation for India's Digital Personal Data Protection Act, 2023 and Rules, 2025. It is not a certification of compliance.

Who we are

PMMockr is operated by PMMockr Group, who is the data fiduciary (controller) for personal data processed through pmmockr.com. Operator and contact details are listed below.

PMMockr is intended for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

Data we collect

Account data: email address, password (stored only as a hash by our authentication provider) or Google sign-in identity, display name, username, avatar, and account role.

Profile data you choose to add: headline, bio, location, country, target companies, skills, and website, GitHub or LinkedIn links.

Interview data: the questions you practice, your typed and spoken answers as text transcripts, private notes you write during an interview, interviewer replies, scores, feedback reports, and timing information such as how long you took to start speaking.

Voice: speech-to-text runs in your browser. Your raw audio is not uploaded by default. If a transcription fails and server-side transcription is enabled, the recorded clip for that answer may be sent to our servers to retry it. Interviewer speech can be generated in your browser or by a hosted speech provider when that route is enabled. Hosted speech receives the text to speak; provider details are listed below.

Camera: the optional interview self-view stays on your screen. If device setup is enabled and you separately consent, it can record a short camera and microphone sample for local review in the current tab. The setup sample and interview camera video are not uploaded. No continuous interview video is recorded.

Payments: our payment provider Razorpay processes your card, UPI or bank details. We receive only the payment status, amount, currency, reference IDs and the access you bought. We never see or store full card or bank numbers.

Usage and device data: pages viewed, features used, device and browser type, approximate location derived from your IP address, request identifiers, error reports and security signals.

Communications: support emails, feedback ratings and comments, and your email preferences.

Optional proctoring: if you start checks and consent separately, your browser may analyse camera observations and, where server collection is enabled, save event types, timing and coverage metadata for authorised review. Optional stills remain in your tab; they are not uploaded. The feature notice explains sampling, limitations, withdrawal and retention.

Why we use it (purpose and legal basis)

To provide account access you request and, after your practice-processing choice, run AI interviews, grade answers, save reports and manage practice tools. We record the notice version and your choices. We rely on your specific consent for the described practice processing. Necessary account authentication and communications requested by you are assessed separately as voluntary provision for a specified purpose under Section 7(a).

To protect accounts and investigate abuse: access checks, rate limiting and security records are limited to security and lawful obligations. We document the applicable Section 7 use or other required legal ground for each activity; we do not rely on a general legitimate-interest basis under Indian law.

To meet legal obligations such as tax invoices, accounting records and responding to lawful requests.

Analytics that help us improve the product (Mixpanel) and marketing measurement (Google, Meta, LinkedIn) only if you allow them in the cookie banner (consent). You can change this at any time from 'Cookie settings' in the footer.

Marketing emails about contests, features and offers only if you opted in at signup or in Settings (consent). Account and transaction emails are sent regardless because they are needed to run your account.

Microsoft Clarity provides masked session recordings, heatmaps and interaction insights to help us find usability problems. It currently loads with the optional marketing tags when you enable that preference. Text is masked using Strict mode. PMMockr's custom Clarity events contain fixed action names, not interview answers, transcripts, resumes, email addresses or payment details. Change your choice from 'Cookie settings' in the footer.

AI processing of your answers

Relevant answers, transcripts, notes and practice input are sent to enabled AI providers to generate replies, coaching and grading. Supported providers include DeepInfra, OpenRouter and OpenAI; routing can vary by feature and configuration. The Sub-processors page identifies their roles. Avoid submitting personal data that is not needed for practice.

We send only what is needed for the interview: the case, the conversation so far and your notes when you finish. We do not send your email address, payment data or password to these providers.

Scores and feedback are generated by AI. They can be wrong and are not a hiring decision. See our AI Disclosure for details.

What is public and what is private

Private by default: your answers, transcripts, notes, reports, email address and payment information.

Leaderboard: your display name, avatar, rank and reputation appear on the public leaderboard only if you opted in. You can turn this off at any time in Settings. A country flag is shown only for a country you selected yourself. Contest rankings show members who opted out as 'PMMockr member'.

Public profile: fields such as headline, bio and links are visible on your profile page only while your profile is set to public.

Showcase: an individual interview report and transcript become visible to signed-in members only if you switch that report to Public. You can make it private again at any time; this stops new views but cannot recall copies others already saw.

Employer screening: if you take an interview through an employer's invitation, your results are shared with that employer. Your score is not shown to you in that flow.

Who we share data with

We do not sell personal data and we do not share it for cross-context behavioural advertising without your consent.

We share data with service providers (data processors) who run parts of PMMockr for us under contract. The full, current list with purpose and location is on our Sub-processors page.

We may disclose data when required by law or a valid government or court order, to protect users or PMMockr against fraud or security threats, or as part of a merger or acquisition, in which case this policy continues to apply.

International transfers

PMMockr is operated from India. Our main database is hosted by Supabase in Tokyo, Japan, with a standby copy in Mumbai, India. Some processors, including our AI providers, are in the United States.

Transfers from India are permitted under the DPDP Act except to countries the Government restricts. For users in the EU/UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) offered by our processors.

How long we keep data

Account, profile, interview transcripts and reports: while needed for the service, then reviewed for erasure on request, withdrawal or purpose completion, subject to identified legal retention. A privacy request stops new practice processing and public sharing immediately; acknowledgement does not mean all records have already been erased.

Temporary recovery snapshots and optional proctoring metadata have a seven-day application expiry. Cleanup completes on a successful retention run. Any separately required security or statutory processing records are retained under their documented legal schedule.

Payment and invoice records: retained for applicable tax, accounting and dispute obligations. We explain the specific retained categories and legal basis when responding to an erasure request.

Processing/security logs and privacy receipts: the retention schedule accounts for applicable cybersecurity requirements and the one-year provisions of DPDP Rules 6 and 8 when they commence. Restricted legal holds may extend retention; data is not reused for marketing.

A deletion response explains any records retained, the reason, applicable period, processor follow-up and how backups are handled. Backup copies must not be restored to active use without reapplying recorded withdrawals and erasure decisions.

Your rights

You can ask to access a summary of your data, correct or update it, delete it, and withdraw consent you gave. Under DPDP you can also nominate another person to exercise your rights in case of death or incapacity, and raise a grievance with us.

If you are in the EU/UK you also have the right to data portability, to object to processing based on legitimate interests, and to restrict processing.

Use Privacy choices and requests in Settings, or email support@pmmockr.com from your account email. You can request access and recipient information, correction, erasure, withdrawal, grievance review or nomination. Requests have a reference and status. We aim to fulfil rights requests within 30 days; identity checks, lawful exceptions or delays will be explained. Shubham Gupta is the responsible contact.

If you are not satisfied with our response, you can complain to the Data Protection Board of India, or to your local data protection authority in the EU/UK.

Cookies and similar technologies

We use essential browser storage to keep you signed in and run interviews. Analytics and marketing tags load only after you allow them. Our Cookie Policy lists each tool.

Security and breach notification

We use encryption in transit, access controls, hashed passwords, rate limiting and monitoring to protect data. No online service is perfectly secure; use a strong, unique password.

Our breach process distinguishes initial notification without delay from the detailed Board report within 72 hours under DPDP Rule 7 when applicable. We assess applicable CERT-In and other reporting obligations separately. Notifications explain the incident, likely consequences, measures and responsible contact.

Changes to this policy

We will post any update here with a new effective date. If a change is material, we will tell you by email or in the product before it takes effect and, where required, ask for your consent again.

Partner signup attribution

If you arrive through a partner link or enter an affiliate code before signup, we use a signed first-party cookie to connect a newly verified account to that partner. A signed attribution token may be retained with the signup identity so email verification on another device can complete the same attribution. Click records use hashed identifiers rather than raw IP addresses. Approved affiliates see aggregate registration counts, purchase counts, commissions and their own settlement records, not referred customers’ email addresses. Financial records are retained for accounting and dispute handling.

Choices, withdrawal and language

You can use account identity and privacy-request functions without agreeing to optional public visibility or marketing. Practice processing requires the described consent and confirmation that you are 18 or older. You can withdraw through the same privacy centre; this stops new practice processing and hides your profile and shared reports. Separate cookie settings and email unsubscribe controls remain available.

You may nominate a person to exercise rights in the event of death or incapacity. Submit a nomination request; we explain the proportionate verification and record the outcome. Do not upload identity documents or private transcripts to the request form.

This notice is currently presented in English. Before agreeing, you may request it in a language in the Eighth Schedule of the Constitution by contacting support@pmmockr.com. Practice remains unavailable until you make your informed choice.

Contact and grievance officer

PMMockr is operated by Shubham Gupta. Business location: Bengaluru, India.

Grievance officer: Shubham Gupta, email support@pmmockr.com. We acknowledge complaints within 24 hours and resolve them within 15 days.

General support: support@pmmockr.com.