Privacy Policy / Datenschutzerklärung

1. Data Controller

The data controller for careerops.space is: {{FULL_NAME}}, {{STREET}}, {{ZIP_CITY}}, Germany. For all privacy inquiries, contact {{EMAIL}}.

2. Data We Collect

• Account Data: Email address, name, and profile picture (via OAuth sign-in or email registration).
• Resume Data: Resume content you create or upload, stored in our database.
• Job Search Data: Search queries, job descriptions you submit for evaluation, and AI-generated evaluation reports.
• Payment Data: Transaction records (amount, date, credit balance). Card details are processed directly by Stripe and never stored on our servers.
• Usage Data: Feature usage counts (for credit billing) and timestamps.

3. Third-Party Processors

We use the following processors (Art. 28 GDPR). We keep this list honest and current:

• Hetzner / self-managed VPS (Germany, EU): Application hosting. The Careerops application runs on a virtual private server located in the EU.
• Neon (PostgreSQL — EU and US infrastructure): Database hosting for account, resume, and application data.
• Upstash (Redis): Caching and rate limiting infrastructure.
• Brevo (France, EU): Transactional email (verification emails, receipts, alerts).
• Stripe (Ireland / USA): Payment processing. Subject to Stripe’s Privacy Policy.
• MiniMax (LLM provider — People’s Republic of China): see the dedicated section below.

4. AI Processing by MiniMax — Transfer to China (important, please read)

In plain words: when you use an AI feature (evaluations, resume tailoring, rewrites, cover letters, interview prep), the content you submit — your resume text and the job descriptions you paste — is sent to MiniMax, an AI model provider located in the People’s Republic of China, to generate the result.

• China has no EU adequacy decision. This is a third-country transfer under Chapter V GDPR.
• Legal basis: your explicit consent (Art. 49(1)(a) GDPR), which you give when you actively submit content to an AI feature after being informed here. Possible risks of such a transfer include that Chinese authorities may be able to access data and that EU data-subject rights may not be enforceable in China.
• You can use the non-AI parts of Careerops (tracker, kanban, manual notes) without any data going to MiniMax. If you do not consent, simply do not use the AI features.
• We send only the content needed for the requested operation — not your email address, password, or payment data.

5. Data Retention & Deletion

We retain your data for as long as your account is active. You can delete your account yourself at any time from your account page — this permanently removes your personal data (resumes, evaluations, search history). Payment records are retained as required by German tax law (up to 10 years, § 147 AO).

6. Your Rights (GDPR)

Legal bases: Art. 6(1)(b) GDPR (contract) for providing the Service, Art. 49(1)(a) GDPR (explicit consent) for the MiniMax transfer described above. You have the right to:

• Access & portability: export your data as JSON from your account page.
• Rectification: correct your data via the account page or by email.
• Erasure: delete your account and all associated data via the account page (self-service, immediate cascade delete).
• Restriction and objection to processing.
• Withdraw consent at any time with effect for the future (e.g. by no longer using AI features).
• Complaint to a supervisory authority (in Germany: your state data protection authority or the BfDI).

Contact for all requests: {{EMAIL}}. We respond within 30 days.

7. Cookies

We use only essential cookies (authentication, CSRF). See the Cookie Policy.

8. Security

All data is transmitted over HTTPS/TLS; database connections use SSL; payments are handled by PCI-DSS-compliant Stripe.