Privacy Policy

1. Scope, and who is responsible for your data

This policy explains what JobSim collects, why, and what you can do about it. We aim to meet the requirements of the Personal Data Protection Act, 2026 of Bangladesh, and, for people in the European Economic Area and the United Kingdom, the GDPR and UK GDPR.

Who is legally responsible depends on how you got your account:

• Individual accounts (including personal and shared simulations). LEAD Academy (the "Operator", "we", "us") is the controller of your personal data and decides how it is used. You can reach our privacy lead at [email protected]. The Operator's registered legal name and registered office are given to you, to a court or to a regulator on written request to that address.
• Organization-managed accounts. The organization that created your access is the controller. We act as their processor, on their instructions. Their privacy notice governs what they do with your results, and requests about that data may need to go to them (see section 11).

2. What we collect

• Account details. Your name, email address and a hashed password. If you sign in with Google, the basic profile information Google returns. We never receive your Google password.
• The profile you build during onboarding. Career goals and target role, work experience, education, skills, certifications, hobbies and interests, workplace preferences, and, where you provide them, location and phone number.
• Simulation activity. Channel and direct messages, reactions, task answers in whatever form the task asks for (text, email, code, diagrams, tables), standup updates, reviews and feedback, attendance (clock-in and clock-out times), final assessment answers and scores, conduct warnings, and the summary and readiness scores derived from all of the above.
• How you work, while you work. Whether a workspace tab is open and visible, and which page, so the simulation knows you are present; how long you spent on a task; basic typing statistics for written answers (time spent, keystrokes and deletions, not what each keystroke was) and attempts to paste; and, during a final assessment, when you left fullscreen or switched away and for how long. Section 5 explains why.
• Voice. Audio and transcripts from the onboarding call and Quick Help calls; voice notes you send in Messages; and recordings you submit for tasks that ask for a voice note. When you speak instead of typing an answer or standup update, the recording is turned into text and not kept: only the text you then send is stored.
• Credentials. When a run finishes, a credential record with your name, the role, your score and its dates, and whether you have made it public.
• Marketing preferences. Whether you have agreed to receive product updates and offers from us.
• Technical and security data. IP address, device and browser information, server logs including timestamps and error traces, and a security log of sign-ins to administrator accounts and blocked attacks.
• Email and verification records. Delivery status for transactional email, and records of the one-time codes issued for sign-up and password reset.
• Consent and acceptance records. When you accepted the Terms and this policy, which version, and the choices you made on consent.

We do not ask for payment card details, government identifiers (such as a National ID, passport or tax number), biometric data, or health information, and you should not enter them into a simulation. See section 5 of the Terms of Service. We do not use voice recordings to identify you.

3. How we use it

• To create and secure your account, and to verify your email address.
• To generate a simulation that fits you. Your profile is what determines the role you are matched to and the team built around you.
• To run the simulation: producing colleague replies and voices, assigning and reviewing tasks, running the standup and final assessment, tracking attendance, and giving you feedback, a summary and a credential.
• To make organization reporting work, where your access is organization-managed.
• To keep simulations fair and safe: detecting abuse, spam and attempts to manipulate AI colleagues or the assessment, and recording warnings, removals and blocks.
• To answer support requests, and to send you transactional email.
• To send you product updates and offers by email, if you have agreed. You can unsubscribe in any email or by writing to us, and it does not affect your use of the Service.
• To measure and improve the Service using aggregated, de-identified data that cannot reasonably be linked back to you, for example to check that scoring is fair. We do not use your personal content to train or fine-tune AI models, and we do not allow our providers to. If that ever changes, we will ask for your separate, opt-in consent first.
• To keep the Service secure and working: debugging, abuse prevention, and capacity planning.
• To meet legal obligations.

4. Legal bases and your consent

We use your personal data only for the purposes in section 3. Depending on the purpose and the law that applies to you, the basis is:

• Your consent, which you give clearly and can withdraw at any time. We ask for it when you sign up (including for the processing and transfers described in sections 7 and 10), before we record your voice, for marketing email, and before we set analytics cookies (section 12). Withdrawing consent does not affect processing that was lawful before you withdrew it. If you withdraw consent that a feature needs, such as voice, that feature may stop working for you.
• Performance of our contract with you, meaning running the Service you signed up for.
• Compliance with a legal obligation.
• Our legitimate interests (security, abuse prevention, fair scoring, improving the product), where GDPR or UK GDPR applies and your rights do not outweigh them. You can object (see section 11).

For organization-managed accounts, the organization is responsible for establishing its own basis for having you use the Service.

5. What we record while you work, and your voice

A simulation is partly a test of how you work, so we record some signals while you use it. We tell you here and again inside the product before you start a simulation and before a final assessment begins.

• Why. To show that you are present, to measure time on task, and to keep assessments fair, including detecting pasted answers and use of other tools or people during a final assessment.
• What it is not. We do not record your screen, your webcam or what each keystroke was. We do not use these signals to identify you or to infer anything about your health or personal characteristics.
• How it is used. The signals feed conduct records and your readiness report, and an organization running your simulation can see them. Signals alone do not decide a result. They are one input, and you can ask for a person to review (see section 6).
• Voice. We record and transcribe voice only for the calls and tasks you choose to use, and you can type instead of speaking in most places. Voice recordings are deleted after 90 days (see section 9).

6. Automated scoring and human review

Scores, reviews, summaries and readiness reports are generated by software, using AI models. They are advisory. We do not use them to make a decision about you that has legal effect, and an organization that views your results makes its own decisions and is responsible for them.

You can ask for any score, conduct record or readiness report to be reviewed by a person, tell us if you think it is wrong, and ask for a correction. Write to [email protected], and a member of our team will review it and reply in writing. For organization-managed accounts, we will pass your request to the organization too.

7. AI processing and sub-processors

Running an AI workplace means your input leaves our servers. Specifically, we share what is necessary with:

• OpenAI (United States). Text generation for your simulation, colleague replies, task briefs and reviews; speech generation for colleagues' voices; speech-to-text for what you say; and real-time voice for the onboarding call and Quick Help. OpenAI's business terms state that data sent through its API is not used to train its models by default, and OpenAI may keep API data for a limited period (currently up to 30 days) to monitor abuse, unless the law requires longer.
• LiveKit (United States). Real-time transport for those voice sessions. LiveKit states that it does not use customer content, transcripts or audio to train its own models.
• DigitalOcean (hosting; servers in New York, United States). Our application, database, cache and vector search run here.
• Cloudflare (DNS, content delivery and inbound email forwarding; global network).
• Google (sign-in with Google, if you use it, and outbound email through Gmail; United States).
• Google Analytics (Google LLC, United States), only if you accept analytics cookies. It receives pages visited, device and browser type, approximate location and how you arrived. Google Analytics does not store full IP addresses. It does not receive your simulation content, messages, answers or scores. See section 12.

We do not sell your personal data, and we do not share it with advertisers. We have agreements with these providers that limit what they may do with your data to providing their service to us. We will update this list before we add a provider that handles your content or personal data, and we publish changes under section 15.

8. Who can see your data

• You. Your own workspace, submissions, feedback and performance view.
• Administrators and HR staff in your organization, if your account is organization-managed. They can see your activity in their simulations: messages, submissions, reviews, attendance, conduct records, the work-signals in section 5 and your readiness report. This is by design, because they set the exercise.
• Anyone with the link to your credential, while you leave it public. It shows your name, the role, the issuer, your score and its dates, and not your messages or answers. You can hide it at any time.
• JobSim staff, where access is needed to operate the Service or answer a support request, under confidentiality obligations.
• The sub-processors in section 7, limited to what their function requires.
• Authorities, where we are legally required to disclose.

Nobody in another organization can see your data. Organizations are isolated from one another, and an administrator's access stops at their own organization's boundary.

9. How long we keep it

We keep personal data for as long as your account is active, and afterwards only as long as we need it for the purposes above or to meet legal obligations. Our periods are:

For organization-managed accounts, retention also follows your organization's instructions and its agreement with us. We may keep data for longer where the law requires it or where we need it to deal with a legal claim, and we tell you when that applies.

10. International transfers

Our providers operate internationally, so your data is processed outside Bangladesh, mainly in the United States. Where that happens we rely on:

• your consent, given when you sign up, and our contract with you, as Bangladesh law allows;
• written data-processing agreements with our providers that require them to protect your data and to use it only for our purposes;
• for people in the EEA or UK, the EU Standard Contractual Clauses (with the UK addendum where it applies) or a provider's certification under the EU-US Data Privacy Framework.

We do not knowingly send data classed by Bangladesh law as restricted or confidential, such as government identity numbers or biometric identifiers, to anyone outside Bangladesh, and we ask you not to enter it. On request we will give you a summary of the safeguards for a transfer of your data.

11. Your rights, and how to use them

Depending on where you live, you may have the right to access your data and see who we shared it with, have it corrected or completed, have it deleted, withdraw consent, object to or restrict processing, receive a portable copy, ask for human review of an automated result, and complain to a regulator. These rights cannot be waived by a contract or notice.

Email [email protected] or write to us from the address on your account. We will verify who you are before acting, and respond within 30 days. If a request is complex we may take longer, and if so we will tell you why and when to expect an answer. If we refuse a request in whole or in part, we will give you the reason in writing.

If you are not satisfied, you can complain to the data protection authority established under Bangladesh's Personal Data Protection Act, 2026, or to the supervisory authority where you live.

If your account is organization-managed, your organization is the controller. We will forward your request to them and act on their instructions, rather than deleting training records they are responsible for keeping. It is usually faster to ask them directly.

12. Cookies and browser storage

We don't run advertising cookies, and we never sell or share data for advertising. We use your browser's own storage to make the product work, and analytics cookies only if you allow them:

• Your sign-in session: an access token and basic account details, held in local storage so you stay signed in. Clearing it signs you out.
• Sign-up progress: the answers you give during sign-up and onboarding are held in session storage while you complete the flow, so moving between steps doesn't lose them. Session storage is cleared when you close the tab.
• Interface preferences: small settings such as whether the workspace sidebar is collapsed and when you last read a channel, and your cookie choice.
• Analytics cookies (optional): if you choose Accept on the cookie notice, we load Google Analytics, which sets cookies named _ga and _ga_<id> (kept up to 2 years) to count visits and see which pages are used, so we can improve the Service. They are not loaded until you accept, and nothing is set if you choose Decline.

You can change your mind at any time with Cookie settings (also at the bottom of our pages), or by clearing cookies and storage in your browser. Clearing storage signs you out. Analytics data is kept by Google for 14 months, then deleted.

13. Children's data

The Service is for people aged 18 and over. Under Bangladesh law a child is anyone under 18, and a child's data may be processed only with the consent of a parent or guardian. We do not knowingly collect data from children. If you believe a child has given us data, contact [email protected] and we will delete it. Where an educational institution wants to enrol learners under 18, it must first agree a separate written arrangement with us, and it is responsible for obtaining verifiable consent from each parent or guardian and any other consent its own law requires.

14. Security and data breaches

Passwords are stored hashed, never in plain text. Traffic is encrypted in transit, access to production data is restricted to staff who need it, and each organization's data is isolated from every other organization's. We test and update these measures as the risk changes. No system is perfectly secure.

If a breach is likely to cause you significant harm, we will tell you without undue delay, and we will tell the regulator within the time the law requires. Report a suspected vulnerability or a compromised account to [email protected].

15. Changes to this policy

We may update this policy. For a material change, including a new sub-processor that handles your content or a new purpose, we will give at least 30 days' notice by email or in the product before it takes effect, and where the law requires your consent we will ask for it. Other changes take effect when posted. The date at the top of this page always reflects the current version.