Privacy Policy

This policy covers Lebah's job-preparation service at lebah.co: importing a job posting, checking your CV against it, generating a cover letter, sitting a practice voice interview, and the report that comes out of it. It also covers the account you create to use them.

Lebah decides what is collected and why, which makes us the controller of that data. Where the law of Indonesia or of your own country gives you rights over it, section 12 says how to use them.

Reading the public pages needs no account and collects nothing beyond the request logs in section 7. If you do not accept this policy, do not create an account, upload a CV, or sit an interview.

Account details. Your email address, a hash of your password (never the password itself), your name if you give one, and the invite code you signed up with. If you choose to sign in with Google, Google sends us your email address, name and profile picture — never your Google password.

Your CV. An uploaded PDF or Word file is parsed in memory and is never written to disk. Only the extracted text is saved, and you can see and edit that text before anything is generated from it. If you save it to your profile it is reused to pre-fill later tools until you replace it.

Profile details for letterheads. The name, job title, postal address, phone number and email you enter for the cover letter generator, if you choose to save them.

What you paste in. Job descriptions, job posting links, and any rough draft you give the cover letter tool.

Interview data. The audio and video recording of your practice interview, its transcript, and the scores, evidence quotes and coaching notes generated from that transcript.

Usage records. Which operations you ran and when, how long each provider call took, what it cost us, and your credit balance. This is how the free tier is priced and how a broken session is spotted.

We do not ask for and have no use for your government ID, your date of birth or your bank details.

• Running the service you asked for: building your interview plan, conducting the interview, producing your analysis, letter and report, and showing you your history across attempts.
• Keeping your account working: signing you in, verifying your email address, resetting your password.
• Metering cost and latency, so the free tier can be priced and a stalled or failed session can be found and refunded.
• Protecting the service against abuse, and meeting a legal obligation where one applies.

We do not sell your data. We do not use it for advertising, and there is no advertising network on this site.

Your CV, your answers, your transcript, your recording and your report are not used to train, fine-tune or evaluate any AI model — ours or anyone else's. They are not added to a dataset. They are not reviewed to improve model quality.

Your text is sent to the AI providers listed in section 5 for one purpose: producing the output you asked for, in that request. Those providers process it under their own terms, on API tiers that do not take training rights over the content sent to them. We choose providers on that basis, but we do not control their policies, and if this matters to you, read theirs as well as ours.

The one deliberate exception is that we read aggregated, content-free usage records — counts, durations and costs — to understand what the service costs to run. Those records carry no CV text, no transcript and no recording.

Running a live voice interview means other companies necessarily touch parts of it. Each receives only what it needs, for as long as the request takes:

• LiveKit Cloud carries the live audio and video between your browser and our interview agent.
• Deepgram converts your speech to text during the interview.
• OpenRouter is the AI gateway that builds your interview plan, generates the interviewer's replies, analyses your CV, writes your cover letter and scores your transcript. It routes to the model named in our configuration, currently Google's Gemini family.
• A speech provider generates the interviewer's voice. Which one depends on our configuration and may change; it is currently reached through OpenRouter, with Cartesia, ElevenLabs and OpenAI as the configured alternatives.
• Cloudflare serves this site, and where object storage is enabled, stores your interview recordings in Cloudflare R2.
• Resend sends account email: address verification and password resets.
• Google, only if you choose to sign in with Google.

We add and change providers as the product changes. A material change to this list is a change to this policy, and is handled under section 14.

The interview is recorded — video and audio — so that you can rewatch yourself. The recording is stored with your report, and only your signed-in account can open it.

Reports are private until you decide otherwise. Sharing is off unless you turn it on, and a shared report deliberately carries the scorecard and nothing else: no recording, no transcript, and no sign that you made any other attempts.

A share link is a capability. Anyone who has the link can open that report without signing in, so treat it like a password. Revoking it takes effect immediately and the link stops working for everyone.

No employer, recruiter or third party is shown your practice results. Nothing about your interview is published or sent anywhere on your behalf.

• A session cookie, set when you sign in. Without it you cannot stay signed in.
• A language cookie, remembering whether you chose English or Bahasa Indonesia.
• A short-lived cookie holding your invite code during Google sign-up, because the code cannot travel through Google's redirect.
• Your browser's local storage remembers your light or dark theme choice. It is never sent to us.

There are no advertising cookies, no analytics cookies, and no third-party trackers on this site. We do not run Google Analytics or any equivalent.

Our server and Cloudflare keep ordinary access logs — IP address, browser user agent, time and the URL requested — for security and debugging. They are not linked to your CV or interview content.

• To the processors in section 5, to the extent each needs to do its job.
• To anyone you deliberately hand a share link to.
• Where the law of Indonesia requires it, or to establish or defend a legal claim. If we are compelled to disclose your data, we will tell you unless we are legally barred from doing so.
• To a successor if the service is transferred to one, in which case this policy travels with the data until it is replaced by one you are notified of.

We do not share your CV, transcript, recording or report with employers or recruiters. There is no route in the product by which they could see them.

The providers in section 5 operate outside Indonesia, principally in the United States and the European Union. Using the interview, the CV check or the cover letter generator necessarily sends the relevant text or audio across borders to them.

We rely on those providers' own transfer safeguards and contractual terms. If cross-border processing is not acceptable to you, the service is not usable — there is no local-only mode.

Traffic runs over HTTPS. Passwords are stored only as hashes. Your reports, recordings and interview rooms are gated on your own signed-in session, and the internal cost console shows spend and latency only — never a candidate's CV, transcript or report.

Being honest about the size of this: Lebah is an early product run by a small team, not an audited enterprise platform. We hold no security certification and have had no external penetration test. Weigh that before uploading a CV containing anything you would not want a stranger to read.

Account data is kept while your account exists. Your CV text, recordings, transcripts and reports are kept until you ask us to delete them, so that your history and your ability to rewatch an old interview keep working.

There is no published retention schedule and no self-service delete button yet. That is a real gap rather than a formality, and we would rather say so than imply a mechanism that does not exist: until it ships, deletion is a request you make and we carry out by hand. Ask, and we will delete your account, your saved CV text, your recordings, your transcripts and your reports.

Content-free usage and billing records — counts, durations, costs — may be kept after deletion for accounting. They contain no CV text, no transcript and no recording.

Depending on where you live, you may have the right to access the data we hold about you, to correct it, to delete it, to receive a copy in a portable form, to object to or restrict how we use it, and to withdraw consent you have given.

To use any of them, contact us at the address at the bottom of this page. We will respond within 30 days. We may need to confirm who you are first, which for an account holder normally means writing from the address the account uses.

If you think we have handled your data badly, you can complain to the data protection authority where you live.

Lebah is not intended for children. You must be at least 17 to hold an account, and we do not knowingly collect data from anyone younger.

If you believe a child has given us their data, tell us and we will delete it.

We will update this page as the product changes. The effective date at the top always reflects the current version.

If a change materially affects how your data is handled — a new category of data, a new purpose, a new kind of processor — we will email account holders before it takes effect. Continuing to use the service after that means you accept the updated policy.