Legal
Privacy Policy
What gets collected when you use this site, why it is collected, and how to have it removed. Short version: an email address, what you have read, and what you have booked. No ad networks, no data sales, no dark patterns.
Last updated: 16 August 2026
1. Who is responsible for your data
The data controller for the personal data described in this policy is Vladyslav Moroz, an individual based in Spain, at Calle Ibiza 62, Madrid, Spain ("we", "us"). GetTheOffer.dev is the website we operate. It is a one-person project, so your data is handled by one developer rather than a company.
For anything to do with your personal data, write to vladyslav.moroz.1996@gmail.com. We have not appointed a Data Protection Officer, because we are not required to.
We are established in the EU, so no representative under Article 27 GDPR is required. If that ever changes, this section will name the representative.
2. What we collect
We collect only what the Service needs to work. We do not buy personal data from anyone, and we do not sell or rent yours.
Account data
When you sign in with Google or GitHub, the provider passes us your email address, your display name, your profile picture URL, and their user identifier for you. Of those we store your email address, your display name, and — for Google — the identifier. We request the minimum scopes each provider offers for sign-in — Google: openid, email, and profile; GitHub: your public profile and email address. We never request access to your Gmail, Drive, calendar, contacts, or repositories, and we cannot read them.
Purchase data
When you buy, Lemon Squeezy sends us the email address and name on the order, the order identifier, and which product was bought, so we can unlock your access and credit any mock interview tokens. We never receive or store your card details — those go to Lemon Squeezy and its payment processors only.
Learning activity
Which lessons you have completed, which you have favourited, whether you found a lesson helpful, and your progress through the training drills, each stored against your account so your progress follows you between devices.
Mock interview data
Your token balance and token transaction history, and for each booking: the scheduled time, the Cal.com booking identifier, the meeting link, the booking status, and any answers you give to the intake questions when booking. Sessions are not recorded.
Technical data
Our hosting provider processes your IP address and request metadata in order to serve the site and keep it secure. We derive a coarse country from your IP address (country level only — not a city, not a precise location) so that pages can show country-relevant examples; the IP address itself is not stored in our database. We also collect aggregate, cookieless audience and performance measurements — see the Cookie Policy.
Correspondence
If you email us, we keep the message and our reply so we can deal with the issue and refer back to it.
We do not intentionally collect special category data (health, beliefs, and so on). Please do not put anything of that kind into the intake answers.
3. Why we use it, and our legal basis
Under the GDPR, we rely on the following legal bases:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating your account and signing you in | Account data | Performance of a contract (Art. 6(1)(b)) |
| Unlocking course access and crediting tokens after a purchase | Purchase data, account data | Performance of a contract (Art. 6(1)(b)) |
| Saving your progress, favourites, and training results across devices | Learning activity | Performance of a contract (Art. 6(1)(b)) |
| Scheduling, running, and tailoring mock interview sessions | Mock interview data | Performance of a contract (Art. 6(1)(b)) |
| Answering your emails and providing support | Correspondence, account data | Performance of a contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)) in responding to enquiries |
| Keeping the site secure, preventing abuse, and diagnosing faults | Technical data | Legitimate interests (Art. 6(1)(f)) in operating a secure, working service |
| Understanding aggregate traffic and page performance | Cookieless analytics measurements | Legitimate interests (Art. 6(1)(f)) in improving the site, using measurement that does not identify you |
| Showing country-relevant content | Country derived from IP address | Legitimate interests (Art. 6(1)(f)) in presenting relevant content |
| Notifying you about material changes to the Service or these policies | Account data | Legitimate interests (Art. 6(1)(f)), or legal obligation where the law requires notice |
| Keeping a record of who bought what, and of refunds | Purchase data | Legitimate interests (Art. 6(1)(f)) in being able to prove your entitlement and handle disputes, and legal obligation (Art. 6(1)(c)) where record-keeping law applies |
Where we rely on legitimate interests, we have considered the impact on you and limited the processing accordingly — for example by using analytics that does not set cookies or build a profile. You can object to any processing based on legitimate interests (see section 8).
We do not use your data for advertising, we do not build marketing profiles, and we do not send marketing emails unless you have asked us to.
4. Who else sees it
We use a small number of service providers to run the Service. Each of them only receives what it needs for its part of the job. Providers marked "processor" act on our instructions under a data processing agreement; providers marked "controller" decide their own purposes for the data and have their own privacy notice.
| Provider | What it receives | Role |
|---|---|---|
| Supabase (PostgreSQL database) | Everything we store: account, purchase, learning activity, and mock interview data | Processor |
| Vercel (hosting, Web Analytics, Speed Insights) | Request data including IP address and user agent; cookieless aggregate analytics | Processor |
| Google / GitHub (sign-in) | The fact that you signed in to this site with their account | Independent controller |
| Lemon Squeezy (payments, merchant of record) | Your name, email address, billing and card details, and purchase history | Independent controller for the sale; sends us the order confirmation |
| Cal.com (scheduling and video) | Your name, email address, chosen slot, and intake answers | Processor |
| YouTube / Google (embedded lesson videos) | Only if you press play on an embedded video: your IP address and device data | Independent controller |
We may also disclose data to professional advisers, or to an authority where we are legally required to. If the Service is ever sold or transferred, account data would transfer with it, and we would tell you before that happened.
5. International transfers
Some of the providers above are established in, or host infrastructure in, the United States and other countries outside the EEA. Where personal data is transferred outside the EEA, we rely on one or more of the following safeguards under Chapter V GDPR:
- the European Commission's Standard Contractual Clauses, together with the provider's technical and organisational measures;
- the provider's certification under the EU-US Data Privacy Framework, where it holds one;
- an adequacy decision for the destination country, where one exists.
You can ask us for a copy of the safeguards that apply to a specific provider by emailing vladyslav.moroz.1996@gmail.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and learning activity | For as long as your account exists, then deleted within 30 days of your deletion request |
| Mock interview bookings and intake answers | 24 months after the session, then deleted |
| Token balance and transaction history | For as long as your account exists, since it records what you are still owed |
| Purchase records (order identifier, date, amount) | Kept while your access lasts, and afterwards for as long as any record-keeping obligation applies to us. Lemon Squeezy keeps the full billing and tax record as merchant of record |
| Support correspondence | 24 months after the matter is closed |
| Server and security logs | Short-lived, as retained by our hosting provider |
| Aggregate analytics | Retained in aggregate form only; it does not identify you |
Deleting your account removes your learning activity, favourites, votes, bookings, and intake answers. We keep the minimum purchase record required by law, and we keep a suppression note where one is needed to honour your request.
8. Your rights
If the GDPR applies to you — which it does if you are in the EU or EEA, with equivalent rights under the UK GDPR — you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted where we have no overriding reason to keep it (the "right to be forgotten").
- Restriction — have us pause processing while a dispute about it is resolved.
- Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another controller.
- Objection — object to processing based on legitimate interests, including the analytics and country detection described above.
- Withdraw consent — where we rely on consent, withdraw it at any time, without affecting processing already carried out.
- Complain — lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Agency (AEPD) or the authority where you live or work.
To exercise any of these, email vladyslav.moroz.1996@gmail.com from the address on your account. There is no self-service delete button on the site yet, so deletion is handled by email. We will respond within one month, and will tell you if we need to extend that by up to two further months because the request is complex. There is no charge unless a request is manifestly unfounded or excessive.
Note that deleting your account also ends your access to the course and cancels any unused mock interview tokens. Tell us if you would rather keep the account and have specific data removed instead.
9. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Quiz scoring and progress tracking are automated, but they only record what you did; they do not make decisions about you.
10. Children
The Service is intended for adults preparing for professional interviews and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.
11. Security
The site is served over HTTPS, the database connection is encrypted and certificate-pinned, session cookies are httpOnly, secure, and sameSite-restricted, and incoming payment and scheduling webhooks are signature-verified before we act on them. Access to the production database is limited to people who need it.
No system is perfectly secure. If a breach affects your personal data and is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority as the GDPR requires.
12. Changes to this policy
We will update this policy when what we do with data changes. The date at the top of the page shows the current version. If a change materially affects your rights, we will notify registered users by email.
13. Contact
Vladyslav Moroz
Calle Ibiza 62, Madrid, Spain
vladyslav.moroz.1996@gmail.com