Privacy Policy

Last updated: 9 October 2026

Draft prepared for review — have it checked before publishing.

Finalist AI is provided by Ioannis (John) Papidakis, a sole trader in London, United Kingdom ("we"). We are the controller of personal data processed through Finalist AI under the UK GDPR (and the EU GDPR where it applies). Contact: i.e.papidakis@gmail.com.

What stays on your Mac

Audio from your interview, meeting, call, lecture or microphone is transcribed on your Mac by Apple's on-device speech recognition and is never uploaded. Your chats, transcripts, screenshots and context notes are stored only on your Mac.

What we process to give you answers

Only after you allow it in the app ("How answers are made" — you can switch this off any time in Settings → General → Privacy), when you ask for an answer, the app sends the question, the recent part of the transcript, a short summary of the session, any screenshots you chose, and your context notes to our server, which forwards them to our AI provider (OpenAI) to generate the answer. We do not store this content on our servers; it is processed only to return your answer. OpenAI processes it as our sub-processor under its API terms with storage disabled; it may keep API data for up to 30 days for abuse monitoring unless zero-data-retention applies. Lawful basis: your consent and the performance of our contract with you.

What we store

• Your account. Your email address and an account ID, created when you first sign in. Lawful basis: the performance of our contract with you.
• Sign-in codes and links. When you sign in, we email you a 6-digit code and a link. They work once and expire after 15 minutes. Each signed-in Mac then keeps a sign-in token, which we store only in hashed form and which you can revoke by signing out.
• Device details. A random device identifier created by the app, so we can show your Macs and keep to one live session at a time.
• Free-minute check. A one-way hash of your normalised email address and a one-way hash of your Mac's hardware identifier (the app hashes it before sending; we never receive the identifier itself). We use these only to stop the free 15 minutes being claimed more than once per person or Mac. Lawful basis: our legitimate interest in preventing abuse of the free offer.
• Usage. When each live session started and ended, how many seconds were used, and your remaining balance — to count your minutes and apply fair-use limits.
• Purchase records. Order, subscription and refund details shared by Lemon Squeezy (see below).

We don't store your transcripts, questions, answers or screenshots on our servers.

Payments and subscriptions

Minute packs and Interview Plus are sold through Lemon Squeezy, which acts as our merchant of record and reseller. Lemon Squeezy takes your payment, handles VAT and sales tax, sends your receipt, and manages renewals, cancellations and refunds. Your card details go to Lemon Squeezy and its payment processors — we never see or store them. Lemon Squeezy handles payment data under its own privacy policy.

So that we can add minutes to your account, provide support and handle refunds, Lemon Squeezy shares purchase records with us: your name, email address, country, what you bought, the amount and currency, the order or subscription status, renewal and end dates, and links to your receipts. Lawful basis: the performance of our contract with you, and our legal obligations (for example, accounting).

Analytics

We count a small number of events to understand whether our pricing works — never the content of your conversations. No transcript content, questions, answers or screenshots are ever included.

• On this website: when the pricing page is viewed, and which package's button is clicked. No cookies, no identifiers, nothing stored in your browser, and nothing is sent at all if your browser has Do Not Track or Global Privacy Control switched on.
• In the app: events such as free minutes started or used up, checkout started or completed, and a subscription started or cancelled. These are linked to a shortened one-way hash of your account ID, not your email.

We don't use advertising or tracking cookies, and we don't sell data. Lawful basis: our legitimate interest in running and improving the service.

Service providers

Cloudflare (website hosting, app server and database), OpenAI (AI answers), Lemon Squeezy (payments and subscriptions), Resend (sending sign-in emails — it processes your email address and the message we send). Some are in the United States; transfers rely on the UK International Data Transfer Addendum, adequacy regulations or standard contractual clauses.

Retention

Account, device, balance and usage records are kept while your account exists. If you ask us to delete your account, we delete them, except purchase and usage records we must keep for accounting and tax (up to 7 years) and the one-way free-minute hashes, which we keep so the free offer can't be claimed again. Expired sign-in codes are deleted. Analytics events are kept for 24 months. Order and payment records held by Lemon Squeezy are kept by them as tax law requires.

Your rights

You can ask to access, correct, export or delete your data, or object to processing, by emailing us from your account's email address via the support page. You can complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Children

Finalist AI is for people aged 18 and over.

Changes

We'll update this page and the date above if anything changes.