1. Controller
Ahmad Sakka — Saseler Chaussee 30c, 22391 Hamburg, Germany — [email protected]
Privacy Policy
Last updated: 27 October 2026
The German-language version of this document is the legally binding reference in case of any discrepancy in interpretation.
2. Legal bases (Art. 6 GDPR)
Art. 6(1)(b) performance of contract: account (including age verification), upload/analysis/build of the CV, reports. Art. 6(1)(a) consent: statistics/marketing cookies and special-category data (Art. 9) in the CV. Art. 6(1)(c) legal obligations: retention of invoices. Art. 6(1)(f) legitimate interest: platform security, fraud prevention, stable operation.
3. Hosting and storage location
The website and its database are hosted entirely on a VPS at netcup GmbH (Karlsruhe, Germany). All CVs and reports are stored exclusively on this server within Germany/the EU. A data-processing agreement (AV-Vertrag) under Art. 28 GDPR is in place with netcup.
4. Retention of the uploaded file
The original CV file is never stored. Its text is extracted in memory and kept only temporarily — for no more than 24 hours — to link your analysis with the resume-improvement feature, then automatically deleted. Only the derived report remains, which you can delete at any time.
5. AI processing (Anthropic) and third-country transfer
To generate the analysis, the CV text is sent over an encrypted API to Anthropic PBC (USA) — a third-country transfer under the safeguards of Art. 44–49 GDPR (EU-US Data Privacy Framework and/or Standard Contractual Clauses). Anthropic is engaged as a sub-processor under Anthropic's standard Data Processing Addendum, which is incorporated into its Commercial Terms. We have enabled the zero-data-retention option available in our Anthropic account settings; under Anthropic's Commercial Terms, inputs and outputs are not used to train models. The transfer relies on Standard Contractual Clauses (SCC). Anthropic's data-processing terms and sub-processor list: https://www.anthropic.com/legal/commercial-terms · https://trust.anthropic.com
6. Data we collect
Account data (name, confirmation of being 18 or older [older accounts: date of birth], email with double opt-in confirmation, hashed password, language); content data (CV text temporarily, reports, job descriptions); payment data (entirely at our authorised payment partner – no card data on our servers); logfiles (IP, time, browser/system).
7. Server logfiles
Access logs are collected on the basis of legitimate interest (Art. 6(1)(f)) for attack detection and deleted automatically within 7 days (retained only as evidence in an ongoing security incident).
8. Cookies and protection tools
Strictly necessary cookies (session/security): without consent (Art. 6(1)(f) + § 25(2) TDDDG). Cloudflare Turnstile (human/bot check, Cloudflare Inc., USA — transfer with DPF/SCC safeguards). Cloudflare Web Analytics runs cookieless. Google Ads conversion tracking (Google Ireland Ltd., Dublin; possible transfer to Google LLC, USA, under the EU-US Data Privacy Framework/SCC): only with your consent (Art. 6(1)(a) GDPR + § 25(1) TDDDG) via our cookie banner. It is loaded only after you click “Accept” and measures whether a visit from a Google ad leads to a sign-up; for this Google sets cookies (e.g. _gcl_au, up to 90 days). We use Google Consent Mode. You can withdraw consent at any time via “Cookie settings” in the footer. Google’s privacy policy: https://policies.google.com/privacy
9. Payment provider (our authorised payment partner)
Payments are handled by Dodo Payments as Merchant of Record. Your payment data (card, name, email, billing address) is processed directly at Dodo Payments and not stored on our servers. Dodo Payments handles invoicing and international tax compliance. Dodo Payments privacy policy: https://dodopayments.com/legal/privacy-policy
10. Data processing for companies (B2B)
For B2B customers uploading candidate data, we provide an AV-Vertrag (Art. 28 GDPR), available for acceptance in the dashboard and forming part of the contract.
11. Retention and deletion
You can delete your CVs and reports at any time; they are removed from the server immediately. Invoices are excepted and retained: 8 years under § 147 AO.
12. Your rights (Art. 15–21 GDPR)
You have the right of access, rectification, erasure, restriction, data portability, and objection (Art. 21) to processing based on legitimate interest. To withdraw consent or exercise your rights: [email protected].
13. Supervisory authority
You have the right to lodge a complaint: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.
14. Technical measures (Art. 32 GDPR)
Encryption in transit (TLS) and at rest, strict access control, network separation, encrypted backups and data minimisation.
15. Automated processing and transparency (Art. 13(2)(f), 22 GDPR)
There is no solely automated decision. The analysis is a supporting tool with an evaluative logic (matching skills/experience/ATS); the decision remains with a human. Note: systems that score/rank job applicants may be classified as high-risk under the EU AI Act (Annex III); the related obligations will be addressed before commercial launch. AI Act note: obligations for high-risk systems (Annex III) apply — following the Digital Omnibus postponement — from 2 December 2027. Independently, under Art. 50 EU AI Act (from 2 August 2026) we clearly inform you that you are interacting with an AI system and that the outputs are AI-generated.
16. Trying the service without an account (guest preview)
If you use the analysis or the CV improvement/creation without an account, we create a temporary anonymous account for you (no name, no email) solely to carry out that one request and show the preview; legal basis: Art. 6(1)(b) (pre-contractual steps at your request). The CV text and the result are processed as described in sections 4 and 5 (text kept temporarily for no more than 24 hours; processing via Anthropic). If you create an account or sign in on the same device, your result is moved to your account and the temporary account is deleted immediately; otherwise the temporary account and all its results are deleted automatically after 7 days. To allow one free try per network and prevent abuse, we store a keyed cryptographic fingerprint (HMAC) of your IP address — not the IP address itself — for 3 days, after which it is deleted automatically; legal basis: Art. 6(1)(f) (legitimate interest in preventing abuse and controlling costs). Before the temporary account is created, a Cloudflare Turnstile check is performed as described in section 8. The guest session is stored in your browser's local storage and is strictly necessary (§ 25(2) TDDDG).