Privacy Policy

Who we are

Japa Reality Technologies Inc., a company incorporated in Canada, operates My Next Hop (getnexthop.com) and is the data controller responsible for the personal data described in this policy. If you are in the EU or UK, Japa Reality Technologies Inc. is the controller of your personal data for the purposes of the GDPR and UK GDPR. You can contact us about any privacy matter — including exercising your data rights — at admin@japareality.com.

What we collect

When you create an account, we store your username and optionally an email address. We store the sessions you complete — including your answers, AI-generated scorecards, and flashcards derived from your gaps. We do not store raw audio. Voice answers are transcribed in your browser using the Web Speech API and only the text transcript is sent to our servers.

We log page views (path, timestamp, and — for signed-in users — your account identifier) for internal product analytics. This helps us understand feature usage and drop-off points. If you have given analytics consent, we also send anonymised usage events to Google Analytics (GA4) so we can understand which features are used and where people get stuck.

How we use it

• To operate the service — authenticating you, storing your sessions, generating your flashcards, and maintaining your streak.
• To send transactional emails — streak reminders and password reset links — only if you have added an email address and enabled notifications.
• To improve the product — understanding which topics, modes, and flows people use (via internal page-view data and, with consent, Google Analytics).

We do not sell your data. We do not use your answers to train any model. We do not run advertising of any kind.

Legal basis for processing

Under the GDPR and UK GDPR, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — creating and running your account, storing your sessions, generating scorecards and flashcards, and processing your answers with AI to deliver the coaching service you signed up for.
• Consent (Art. 6(1)(a)) — Google Analytics and any non-essential cookies. You can withdraw consent at any time via cookie settings, with no effect on the lawfulness of processing before withdrawal.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure (authentication, rate limiting, fraud and abuse prevention) and understanding feature usage through minimal internal page-view logs, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — retaining limited payment and tax records where the law requires it.

Cookies

We use one essential cookie to keep you signed in (a session token stored as an HTTP-only cookie). No session cookie is set until you create an account and sign in.

If you click Accept all on the cookie banner, we set a Google Analytics cookie (_ga and related) that tracks anonymised page views and events. If you click Necessary only, no analytics cookies are set. You can change or withdraw this consent at any time — it is as easy to withdraw as it was to give: open cookie settings.

Third parties

• Anthropic — your answers are sent to Claude to generate scorecards. Anthropic's API usage policy applies. We do not send your username or email to Anthropic.
• OpenAI — automatic fallback if Claude is unavailable or times out. Same data handling as Anthropic above: your answer is sent to generate the scorecard, your username and email are not.
• ElevenLabs — converts Betty's questions to speech for voice-first Mock Interview (Pro only). Only question text is sent, never your answers.
• Google — when you answer by voice, your browser's built-in speech recognition (Chrome and other Chromium-based browsers route this through Google's servers) transcribes your microphone audio to text.
• Supabase / PostgreSQL — our database host. Data is stored in the EU (Frankfurt).
• Google Analytics — only active if you consent. Data is anonymised (IP addresses are not logged in full).
• Vercel — our hosting provider. Vercel may log request metadata (IP, user-agent) for infrastructure purposes.
• PayPal / Paystack — payment processors. Payment data (card details, billing address) is handled directly by these providers and is not stored on our servers. Their respective privacy policies apply.

A full list of sub-processors with their data location and purpose is available on our sub-processors page.

International data transfers

Your account data is stored in the EU (Frankfurt). Some of the sub-processors above — including Anthropic, OpenAI, ElevenLabs, Vercel, and Google — process data in the United States or other countries outside the EEA and UK. Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses (and the UK Addendum) incorporated into our data-processing agreements with each provider, together with the technical measures described in this policy. You can ask us for more detail on these safeguards at any time.

Retention and deletion

Your account data is kept for as long as you have an active account. You can delete your account at any time from the Settings page — this permanently deletes your profile, all sessions, flashcards, and progress data. Email addresses are removed immediately on account deletion. Internal page-view logs are retained for up to 24 months; Google Analytics data follows the retention configured in GA (14 months). Database backups are retained for 30 days, after which deleted data is purged from backups entirely. Limited payment records may be kept longer where tax or accounting law requires it.

Your rights

If you are in the EU or UK (and, in substance, wherever you are), you have the right to:

• Access — get a copy of the personal data we hold about you. You can download it yourself any time from Settings → Your data, or ask us.
• Rectification — correct inaccurate or incomplete data (username, email, and profile details are editable in Settings).
• Erasure — delete your account and personal data from the Settings page, or ask us to do it.
• Data portability — receive your data in a structured, machine-readable format (the JSON export in Settings → Your data).
• Restriction and objection — ask us to restrict or stop certain processing, including anything based on legitimate interests.
• Withdraw consent — turn off analytics at any time via cookie settings.

To exercise any of these rights, or if you have questions about this policy, email us at admin@japareality.com. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In the EU this is the data-protection authority in your country of residence; in the UK it is the Information Commissioner's Office (ICO). We'd appreciate the chance to resolve your concern first, but that is your right.

Changes to this policy

If we make material changes we will update the date at the top of this page. Continued use of My Next Hop after a change constitutes acceptance of the updated policy.