Skip to content
careerstelleSign in

Privacy notice

How careerstelle handles your data

Last updated: [date]

careerstelle helps you tailor your CV to a job description. To do that it has to store your CV, which is full of personal data. This notice explains what we collect, why, who else handles it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

The short version: your CVs are private to your account; they are sent to our AI provider only to produce suggestions you asked for and are never used to train AI models; there is no advertising, tracking or analytics; and you can download or delete everything yourself at any time from Settings.

Who is responsible

The controller responsible for your data is:

[Full legal name of the person or company running careerstelle]
[Postal address]
Email: [privacy@careerstelle.com]

For any privacy question or request, write to the email address above.

What we collect and why

  • Account details: your email address, an optional name, and your password (stored only as a one-way hash; we can never see it). Needed to create and secure your account.
  • Your CVs: files you upload (PDF or DOCX), the text we extract from them, and the edits you make. Needed to provide the service.
  • Job descriptions you paste in, and what we derive from them: the requirements, how well your CV matches them, suggested changes, the skills you confirm, and the tailored versions and PDFs you create.
  • Activity records: a log of security-relevant actions in your account (for example signing in, confirming your email, resetting your password, uploading, exporting or deleting a CV), with the time. It never contains your CV content. Used to keep accounts secure and to investigate problems.
  • Security data: to slow down password guessing and spam, we count recent sign-in failures, sign-ups and password-reset requests per email address and per IP address. These counters store only one-way hashes, not the address itself, and expire within a day. After you sign in successfully, we also remember (as hashes) the browser and IP address you used, so that someone else's failed attempts can't lock you out: browsers for 180 days, IP addresses for 90 days after their last use.
  • How you found us: when you create an account, we record the page of ours you signed up from, the website that sent you there (its name only, such as google.com), any campaign tags in the link (such as utm_source), and the country your connection comes from. Used to understand which pages and channels bring customers. No cookie is used for this, and nothing is recorded for visitors who don't sign up.
  • Server logs: like any website, our servers record each request's IP address, time, the page requested and your browser's user agent. Used to run the service, defend it against attacks and fix errors.

A CV can contain more than you might expect, such as a photo, date of birth, nationality or health information. careerstelle doesn't need any of these. Please leave them out if you can; if you include them, we treat them like the rest of your CV and use them only to provide the service you asked for.

How AI is used

To analyse a job description and suggest changes, careerstelle sends the relevant text (the job description and the parts of your CV being compared or rewritten) to OpenAI's API. We send it only when you start one of these steps, and we ask OpenAI not to store the responses. OpenAI does not use API data to train its models. Under its own policy it may keep API data for up to 30 days to detect abuse, then deletes it.

Suggestions are only suggestions. Our own checks reject any that add facts not found in your CV, and nothing changes in a version until you accept it. We make no automated decisions about you within the meaning of Art. 22 GDPR, and the match score is an estimate of how well your CV covers a job's requirements, not a prediction of any employer's decision.

Who else handles your data

We don't sell your data or share it with advertisers. We use these service providers, each under a data processing agreement:

  • Hetzner Online GmbH (Germany): hosts our servers, database, files and backups, in [data centre location, e.g. Germany].
  • OpenAI (USA): AI analysis and suggestions, as described above.
  • Resend (USA): delivers our account emails (confirming your address and resetting your password). It receives your email address and the email itself.

OpenAI and Resend are based in the United States. Transfers to them are covered by [the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as set out in each provider's data processing agreement].

We disclose data to authorities only where the law requires it.

How long we keep it

  • Your account, CVs, uploaded files and versions: until you delete them or your account.
  • Exported PDFs: deleted automatically 30 days after they are created (you can export again at any time).
  • When you delete your account, we immediately delete your files, CVs, job descriptions, versions, suggestions and exports. Activity records are kept without the link to your account. Records of your payments (amount, date, what was bought and the payment provider's reference) are kept without the link to your account for [10 years], because tax and accounting law requires it.
  • How you found us: [2 years] after you sign up, or until you delete your account.
  • Security counters: within a day. Remembered sign-in sources: 90 or 180 days after last use, as above.
  • Server logs: about [14 days].
  • Backups: copies of the database and files are kept for [30 days], so data you delete disappears from backups within that time.

Cookies

careerstelle uses only cookies that are strictly necessary for the service, so it doesn't ask for cookie consent. There are no analytics, advertising or tracking cookies.

  • cvt-auth: keeps you signed in. Removed when you sign out.
  • cvt-auth-…-code-verifier (one or more): hold a random one-time value that makes the links in our emails work only in the browser that asked for them. The value is useless once the link has been used or has expired.
  • cvt-device: a random identifier for a browser that has signed in before, used only on the sign-in page to protect you from lockouts (see above). Kept for 180 days.

Security

All connections use HTTPS. Your CVs and versions can be read only by your own account; the database enforces this for every request. Uploaded files are kept in private storage. Passwords are hashed. Access to the servers is restricted to the people running careerstelle.

Your rights

Under the GDPR you have the right to:

  • access your data, and take it with you (portability): Settings → Download my data gives you everything we store for you as a JSON file;
  • correct it: you can edit your profile and CVs yourself;
  • have it deleted: Settings → Delete account removes everything immediately;
  • restrict how we use it, and object to processing based on our legitimate interests;
  • complain to a data protection supervisory authority, in particular in the EU country where you live or work, or [the authority responsible for us].

For anything you can't do yourself in Settings, email [privacy@careerstelle.com]. We may ask you to confirm the request from the email address of your account, so that nobody else can make it for you. We reply within one month; if a request is complex, we may extend this by up to two more months and will tell you why within the first month.

Children

careerstelle is not intended for anyone under 16. Please don't create an account if you are younger.

Changes to this notice

If we change how we handle your data, we'll update this page and its date. If a change matters to how your data is used, we'll tell you by email before it applies.