Trust

Trust & security

Last updated 3 October 2026

Getting ready for an interview means sharing your CV, your answers and your voice. This page explains how Toby protects them, and lists every company that helps us run the service.

Your video stays with youCamera video is only shown on your screen. It's never recorded, uploaded or stored.

Delete any sessionRemove a session, its transcript and debrief whenever you like, from inside Toby.

Not used for AI trainingWe [don't] let our providers, or ourselves, train AI models on your content.

UK GDPRWe handle personal data under the UK GDPR and the Data Protection Act 2018.

How we protect your data

Data is encrypted in transit and at rest [confirm: TLS 1.2+, AES-256].
Only the people who need it to run and support Toby can access your data, and access is logged [confirm].
Payments are handled by [Stripe]. We never see or store your full card number.
Your content is sent to AI providers only to produce your results, and isn't sold or shared for advertising.

Sub-processors

These companies process personal data on our behalf to run Toby. Each one is bound by a contract that requires it to protect your data and use it only for the service it provides to us. Where data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement.

Provider	What it does	Data	Location
[Hosting provider]	Hosts the Toby app and stores your account and sessions	All account and session data	[Region]
[AI model provider]	Writes your prep brief and questions, plays the interviewer and scores your answers	Job descriptions, CVs, notes and transcripts	[Region]
[Speech-to-text provider]	Turns your spoken answers into text during a call	Your voice while you're on a call	[Region]
[Voice provider]	Gives Toby his speaking voice	Toby's questions and replies	[Region]
[Stripe]	Takes payments and handles billing	Name, email and payment details	[Region]
[Email provider]	Sends sign-in, receipt and account emails	Name and email address	[Region]
Google Analytics	Website analytics, only if you agree to it	Usage and device data	[Region]
[Error monitoring]	Helps us find and fix bugs	Technical logs	[Region]

We'll update this list before we add or replace a sub-processor.

Data retention

Sessions, transcripts and debriefs: until you delete them or close your account.
Account details: while your account is open, then [30 days].
Billing records: six years, as UK tax law requires.

Your rights

You can ask us to access, correct, delete or export your data at any time. Email hello@usetoby.ai and we'll reply within one month. Read the full privacy policy and terms & conditions.

For universities and employers

If you'd like to offer Toby to students or staff and need a data processing agreement or a security questionnaire completed, email hello@usetoby.ai.

Report a security issue

If you think you've found a vulnerability, email hello@usetoby.ai with the details. Please give us a chance to fix it before sharing it publicly.