Security & data handling

This page is maintained by Nenad Blaženović, the operator of Konzul, to answer common security and privacy questions about the service. It describes the practices and controls currently in place. It is a plain-language description, not a certification or an independent audit.

What we ask you for

Konzul only needs what a spoken language rehearsal needs: your email address, and whatever you choose to say or write during practice — names, places, dates, family relationships, studies, work and your motivation.

The simulated consul is instructed never to ask for a passport or ID number, personal identification or TAJ number, tax number, bank or card details, full postal address, phone number or password. If you mention something like that anyway, it is filtered out before the text is stored or sent for processing, and replaced with a neutral placeholder.

Your voice

Recordings are never stored. Your audio is streamed for transcription, used, and discarded. Nothing is written to a recording archive, and no recording is ever attached to your account.

How long we keep things

• Recordings: not kept at all.
• Interview conversation text: deleted 30 days after the session ends.
• Scores, level estimate and progress: kept while your account exists, so the Journal and readiness view keep working after the text is gone.
• Önéletrajz page photos: deleted as soon as the read-through finishes.
• Önéletrajz text: deleted after 90 days.

AI processing

Konzul uses OpenAI models to play the consul, transcribe speech, generate the spoken voice and assess answers. Requests are sent as stateless calls with retention for provider-side model training or dashboard history switched off, and identifiers are redacted before the text leaves our server. Your practice content is not used to train models.

Prompts, model responses and transcripts are never written to our application logs. Errors record a status code only.

Access and account security

• Sign-in is email and password, or Google. Passwords are never stored by us in readable form.
• New and changed passwords are checked against known breached-password lists.
• You are signed out automatically after 30 minutes of inactivity.
• Every practice record is bound to your account at the database level, so one account can never read another's interviews, reports or önéletrajz.
• All traffic is served over HTTPS with strict browser security headers.

Your controls

• Download my data — a machine-readable JSON copy of everything stored about your account.
• Erase my content — removes conversation text, written feedback and önéletrajz reviews while keeping your account.
• Delete account — removes the account and everything attached to it, permanently.

All three are on your Readiness page, under “Your data”.

Shared responsibility

We are responsible for the controls described above. Hosting, database, authentication and storage run on Lovable Cloud infrastructure; speech and language processing run on OpenAI. You are responsible for keeping your password private, for the device you practise on, and for choosing what you disclose during practice — please leave document numbers out of it.

Reporting a problem

If you believe you have found a security or privacy issue, please report it before disclosing it publicly, and do not access other people's data while testing. Contact us through the address in our Privacy Policy and we will respond as quickly as we can.