Privacy Policy

Data Controller

MediaTraining.AI is operated by OF.MediaTech, established in Cork, Ireland, which is the data controller for personal data processed through the platform — except where a customer company or agency acts as controller for its executives' data (see 'Business Customers' below). We comply with the EU/EEA GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, Brazil's LGPD and US state privacy laws (including CCPA/CPRA), as applicable to you. Reach our privacy team at privacy@mediatraining.ai.

1. Data We Collect

We collect the following data when you use MediaTraining.AI:

• Account data: Name, email address, company name, role
• Training data: Interview transcripts, voice recordings, performance scores
• Video data: Webcam recordings during video interview sessions (optional)
• Documents: Press releases, talking points, and other files you upload
• Usage data: Session duration, feature usage, login timestamps

2. How We Use Your Data

• To provide and improve the media training service
• To generate AI performance reports
• To analyze voice and facial expressions during training sessions
• To manage your account, billing, and subscriptions
• To send transactional emails (confirmations, reports, billing)

Legal Bases for Processing

We rely on the following legal bases (GDPR Art 6 & 9; LGPD Art 7 & 11):

• Contract: to deliver the training service, run interview sessions and generate your reports.
• Consent: for optional video recording and facial/voice-expression analysis (special-category/biometric data) and for analytics cookies. You can withdraw consent at any time.
• Legitimate interests: to secure the platform, prevent abuse and improve the product, balanced against your rights and freedoms.
• Legal obligation: to keep billing, invoice and tax records.

Automated Analysis & Human Review

We use AI to analyze your interview (transcript, voice, and — if you enable video — on-device facial-expression metrics) and produce a draft report with scores (overall, clarity, confidence, composure, message consistency), a readiness indication and 'risky moment' flags. This is automated profiling. In company and agency contexts a human reviewer can adjust and sign the report; solo users can request human review. You have the right to obtain human intervention, express your view and contest a result (GDPR Art 22; LGPD Art 20).

Sensitive & Biometric Data

Voice recordings and facial-expression metrics may be special-category/biometric data (GDPR Art 9; LGPD Art 11; 'sensitive personal information' under US laws including Illinois' BIPA). Facial analysis runs on your own device and only derived numeric metrics are stored — never raw facial templates or images sent for analysis. We process this data only with your explicit consent, requested before each recording, and you can decline or withdraw at any time.

3. Third-Party Services

We use the following third-party services to process your data:

• Supabase (EU): Database, authentication, file storage (EU region)
• Vercel (US): Hosting and content delivery
• OpenAI (US): AI interviews (speech-to-text, conversation, voice synthesis) and report generation
• Stripe (US): Payment processing
• Cloudflare R2 (EU): secure storage of session recordings (R2).
• Resend (US): transactional and notification email.
• Recall.ai (US): recording and transcription of live video meetings.
• Google (US): calendar and Google Meet integration (optional).
• Microsoft (US): Outlook calendar integration (optional).
• Google Analytics (US): anonymous usage analytics — loaded only if you accept analytics cookies.

We may update our sub-processors; this list reflects current providers. Business customers can request advance notice of material changes.

International Data Transfers

Your account, project, report and recording data are stored at rest in the European Union (Supabase, Ireland; Cloudflare R2). Some processing takes place in the United States via our sub-processors — live AI voice and report generation (OpenAI), payments (Stripe), live-meeting recording (Recall.ai) and calendar/meeting integrations (Google, Microsoft). These transfers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (SCCs); for transfers from the UK and Switzerland we additionally rely on the UK International Data Transfer Addendum and the Swiss-adapted SCCs (and the UK/Swiss extensions of the Data Privacy Framework where the importer is certified). Request a copy of the safeguards at privacy@mediatraining.ai.

Business Customers (Companies & Agencies)

When a company or agency uses MediaTraining.AI to train its executives, that organization is the data controller for its executives' personal data and OF.MediaTech acts as its processor. Your employer may have provided your details to create your account and may access your sessions, recordings and reports. The organization is responsible for informing you and obtaining any required authorization before recording. You can exercise your rights with your organization or via privacy@mediatraining.ai. A Data Processing Agreement is available to business customers.

4. Data Retention

We keep personal data only as long as necessary for the purposes described:

• Training data: Recordings and voice/facial metrics: deleted after 2 years. Transcripts and reports: kept while your account is active, then deleted with your account.
• Account data: for the life of your account plus a short grace period.
• Billing & invoices: retained as required by tax and accounting law, even after account closure.
• Analytics: per Google Analytics defaults (about 14 months).

When you delete your account, your data and recordings are permanently removed (including from storage), except records we are legally required to keep.

5. Your Rights (GDPR & LGPD)

Under the General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Proteção de Dados (LGPD), you have the right to:

• Access & portability: Export a copy of all data we hold about you, in a machine-readable (JSON) format
• Portability: Receive your data in a portable, machine-readable format.
• Rectification: Correct inaccurate personal data
• Erasure: Permanently delete your data ("right to be forgotten")
• Objection: Object to processing of your data
• Restriction: Request restricted processing
• Withdraw consent: Withdraw any consent you gave (e.g. recording or analytics) at any time, without affecting prior processing.
• Complaint: Lodge a complaint with your supervisory authority — in the EU/EEA our lead authority is the Irish Data Protection Commission (dataprotection.ie), or your local DPA; in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the FDPIC; in Brazil, the ANPD; in California, the CPPA / Attorney General.

California Privacy Rights (CCPA/CPRA)

If you are a California resident: we collect identifiers, professional information, audio/visual data (interview recordings) and inferences, used to provide the service as described above. We do not sell your personal information. Analytics cookies load only if you opt in, and we honor the Global Privacy Control (GPC) browser signal as an opt-out; you can change your choice anytime via 'Cookie settings'. Recordings and inferred metrics are treated as 'sensitive personal information' and used only to provide the service. You have the rights to know, delete, correct, opt out and non-discrimination — exercise them in your settings or via privacy@mediatraining.ai.

Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated by email or in-app, and the 'last updated' date above will change. Continued use after the effective date constitutes acceptance.

7. Contact

For privacy inquiries or data requests, contact us at: privacy@mediatraining.ai

Controller: OF.MediaTech, Cork, Ireland.

For general questions, visit our contact page.