Privacy Notice

1. What we collect

When you use Candour, we collect:

• Your email address and password (password is never visible to us in plain form — our sign-in provider handles this).
• Your institution affiliation, if you select one at signup.
• An internal account identifier.
• The full text of your practice conversations with our AI-played counterpart.
• The AI-generated debrief for each session — scores, strengths, growth areas, and any flagged critical issues.
• A record of when you sign in.
• If you contact us through an enquiry form, the details you submit and your IP address.
• If you report a problem, what you tell us — plus basic technical details about your browser, screen and app version, so we can reproduce it.

2. Why we collect it

To run the practice-conversation and debrief features themselves, to secure and authenticate your account, to prevent abuse of the service, to investigate problems you report, and to understand how the product is being used so we can improve it.

3. Where your data is processed

Candour is hosted in Singapore, and your account data is stored there.

The AI conversation and debrief-scoring features use a cloud AI service in a configuration that may route the underlying AI processing through data centres outside Singapore, in order to use the best-available model quality. This means the content of your practice conversations may be processed outside Singapore.

4. Who can see your data

You can always see your own conversations and debrief history.

A small number of platform administrators can also access trainee accounts' conversations and debrief results — this is necessary to operate the service, investigate issues, and support institutions using Candour for training programmes. This can include looking up results for a list of trainees at once, for programme-review purposes.

5. How long we keep your data

We currently retain conversation transcripts, debrief results, and sign-in records for as long as your account remains active. We are finalizing a specific retention period and an automatic deletion schedule — this section will be updated once that work is complete.

6. Your choices

You can ask us for a copy of your data, or ask us to delete your account and associated data, by contacting us (see below). We don't yet have a fully self-service way to do this in the product itself — requests are currently handled manually while we build that out.

7. Contact

If you have questions about this notice or your data, please reach us through the contact form on our homepage.