Privacy Policy

Summary

We store your CV, job ads, and account data on Supabase servers in Zurich, Switzerland. The European Commission has found that Switzerland ensures an adequate level of data protection (adequacy decision). Generated text is produced by Vertex AI in the EU with training opt-out enforced. We do not sell your data and we do not train any model on your inputs.

Controller

The controller under Art. 4(7) GDPR is Gendron Himmels AI Innovations GbR, Bürgerstraße 1, 22081 Hamburg, Germany, represented by its partners Patrick Gendron and Robin Himmels. Email: team@resumecopilot.de.

Data protection officer

We have not appointed a data protection officer, as the statutory thresholds do not currently apply. For any privacy-related matter, reach us at the address above or through our contact form.

Data we process

Account data (email, language preference), application data (your master CV including any profile photo embedded in it, uploaded job ads, generated CVs and cover letters, and intermediate parsed forms we cache to speed up tailoring), and technical telemetry needed to operate the service (error reports, request logs with PII scrubbed).

Profile photos in your CV

If the CV you upload includes a profile photo, we extract that image and store it on our Supabase servers in Zurich, Switzerland alongside the source CV. The photo shares the same retention as the CV it came from. You can hide the photo on any individual tailored CV before exporting, and when you delete your account the photo is removed together with the rest of your CVs within 30 days.

Cached AI inputs and outputs

To avoid re-parsing the same content on every tailoring, we cache derived forms of your uploaded data — for example a structured JSON representation of your master CV. These intermediate caches follow the same retention as the source they were derived from: they are deleted when you delete the source CV, and removed within 30 days when you delete your account.

Special categories of personal data

Tailoring a CV does not require any special categories of personal data within the meaning of Art. 9(1) GDPR (such as health or disability status, religion, trade-union or political-party membership, or ethnic origin). If the CV you upload nonetheless contains such information — for example a note about a disability or a profile photo — we process it solely to provide the service you requested. The legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you give by deliberately uploading and tailoring that content. You may remove such information before uploading, and a profile photo can additionally be hidden per tailored CV.

Purpose and legal basis

We process your data (a) to provide the CV and cover-letter tailoring service you requested and to manage the contract and your account (Art. 6(1)(b) GDPR); (b) to process payments for paid credit packs (Art. 6(1)(b) GDPR); (c) to keep the service secure, stable, and protected against abuse (Art. 6(1)(f) GDPR — legitimate interest in reliable, abuse-resistant operation); (d) for lightweight product analytics via PostHog, solely on the basis of your consent (Art. 6(1)(a) GDPR); and (e) to answer enquiries submitted through the contact form (Art. 6(1)(b) or (f) GDPR).

Subprocessors

We use carefully selected subprocessors: Supabase (database and storage, Zurich, Switzerland — EU adequacy decision), Vercel (hosting, EU), Google Vertex AI (text generation, EU, no training), Trigger.dev (background-job orchestration, USA — IDs-only payloads), Resend (transactional email, USA), Stripe (payment processing), PostHog (product analytics, EU cloud, with consent only), and Sentry (error monitoring). Transfers to third countries (Switzerland, USA) are explained in the following section.

International data transfers (Switzerland and USA)

Some of the providers we use process data in third countries: Switzerland and the USA. Switzerland has an adequacy decision of the European Commission; the USA has no general adequacy decision, so appropriate safeguards under Art. 44 et seq. GDPR are in place for those transfers.

Supabase (database and storage): Our database and file storage run in Zurich, Switzerland. Switzerland is a third country, but the European Commission has found that it ensures an adequate level of data protection (adequacy decision under Art. 45 GDPR), so no further safeguards are needed for this transfer. Backups are stored in Frankfurt (Google Cloud), within the EU.

Trigger.dev (background jobs): We use Trigger.dev — which runs its cloud infrastructure in the USA — to orchestrate background jobs such as generating export PDFs and running scheduled deletion tasks. The transfer is safeguarded by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). We generally send Trigger.dev no CV or other content data: jobs carry only anonymous identifiers (IDs); the actual content is loaded from our servers in Zurich, Switzerland at runtime, processed in memory, and then discarded. A residual, technically unavoidable risk remains that operational and log data (e.g. run logs with IDs and timestamps) are retained in the USA for the duration of run logging (up to 30 days by default); we have deliberately assessed and accepted this residual risk, as the data contains no plain-text content.

Resend (transactional email): We use Resend — which runs its infrastructure in the USA — to send transactional email (e.g. sign-in / magic-link messages or replies to contact enquiries). The transfer is doubly safeguarded: Resend is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR), supplemented by the Standard Contractual Clauses under Art. 46(2)(c) GDPR. We send Resend only the data needed for delivery — your email address and the subject and body of the relevant transactional email, or a magic-link token. CV content is never sent via Resend.

Google Sign-In (optional): If you choose "Continue with Google" instead of an email address and password, Google confirms your identity to us and sends us your name, your email address and, where available, your profile picture. We receive nothing else — Google never sends us your contacts, your calendar or any other Google data, and we never send Google your CV. For this sign-in step Google acts as an independent controller under its own privacy policy and will know that you signed in to Resume Copilot. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR), supplemented by the Standard Contractual Clauses under Art. 46(2)(c) GDPR. The legal basis is Art. 6(1)(b) GDPR (performance of a contract), because you chose this way of signing in. Signing in with an email address and password remains available and involves Google in no way.

Automated processing and AI

Your CV and cover letter are tailored using a large language model (Google Vertex AI, Gemini 2.5) operated in the EU region europe-west1. Google contractually does not use your inputs to train models (training opt-out is configured). For abuse and safety monitoring, Google may log inputs for an unspecified period. There is no solely automated decision within the meaning of Art. 22 GDPR producing legal or similarly significant effects: every AI suggestion is shown to you, can be edited by you, and is only applied after you confirm it. You retain full control over the content.

Cookies and analytics

We use strictly necessary cookies only for sign-in and your active session; the legal basis for storing or accessing information on your device is §25(2)(2) TDDDG, and for the processing Art. 6(1)(f) GDPR. The anonymous-trial cookie is functional and not used for tracking. Two language cookies are functional as well: one remembers the language of the page you last visited, the other a language you chose yourself. They contain only the code “de” or “en”. A cookie for the free CV translation is functional as well: for 24 hours it remembers that this browser has already used its free translation, and it holds nothing about you or your CV. For product analytics we use PostHog (EU cloud) — but only with your prior consent (Art. 6(1)(a) GDPR, §25(1) TDDDG). PostHog is not loaded in your browser before you consent. Separately, our server counts page visits anonymously, as described in the next section. You can reject consent with one click in the cookie banner and withdraw a granted consent at any time, with effect for the future, via the “Cookie settings” link in the footer; the lawfulness of processing carried out before withdrawal remains unaffected.

Anonymous count of page visits, new accounts and features used

When you arrive at our website from outside, by following a link on another website or by typing the address, our server counts that visit. This happens regardless of your choice in the cookie banner. We use only information your browser sends with every page request anyway: the page you opened, the domain of the website you came from (for example “google.com”), and campaign tags in the link (utm parameters). If the link carries an ad platform’s click identifier, we record only which platform it came from, not the identifier itself. We do not record your IP address or anything else that would allow visits to be linked to a person. Nothing is stored on your device for this and no script is run. The counts are stored with PostHog (EU cloud). The purpose is to see through which channels visitors find us. In the same way we count how many new accounts are created and with which sign-in method (email or Google). This count contains neither your email address nor any identifier of your account. Likewise, our server counts how often features in the product are used, for example rewriting a section, switching the template or exporting a PDF. Each of these counts contains only the feature used and fixed attributes such as the chosen template or language. It contains no content from your CV or a job ad, no email address and no identifier of your account, and separate counts cannot be linked to each other or to a person. The purpose is to see which features are used and which we should improve. In the same way, our server counts how often a free tailoring is refused because the limit for your browser or for your internet connection has been reached. This count contains only which of the two limits applied and how many free tailorings had already been used over that connection, never your IP address.So that we can see which of our pages lead to an upload, the counts for uploading a CV, adding a job ad, starting the tailoring and an account created from it also contain the page of our website on which you started the trial (for example “/lebenslauf-muster”). We take that page from the page request your browser sends anyway. We keep it on our server in the EU together with the files of your trial session and delete it with them after 24 hours. We send it to PostHog without any identifier of the session. These counts also contain where you originally came from: the domain of the referring website (for example “chatgpt.com”), the campaign tags in the link and, where present, which ad platform the click came from. We never record the click identifier itself. So that this information is not lost when you move between our pages, a script on our pages keeps it in the browser’s working memory only and attaches it to the address of links within our website. No cookie is set for this and nothing is stored permanently on your device. The information disappears when you close the tab. When you upload a CV, we keep it on our server in the EU together with the files of your trial session and delete it with them after 24 hours. We send it to PostHog without any identifier of the session. To the extent personal data is involved at all, the legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR).

Session recordings

Under the same consent you give in the cookie banner, PostHog (EU cloud) also records how you move through the site: pointer movement, clicks, scrolling and page changes. These recordings contain nothing readable. Every text node and every form field is replaced with a placeholder inside your browser before anything is transmitted — PostHog never receives the original characters. Your CV, your cover letter, your application photo and your signature are excluded from the recording entirely and appear only as an empty area. Nor do we record the data your browser exchanges with our servers in the background, technical log output, or embedded payment fields. The sole purpose is to spot usability problems in our interface; the legal basis is your consent (Art. 6(1)(a) GDPR, §25(1) TDDDG). If you reject in the cookie banner or withdraw your consent, no recording takes place.

Payment processing (Stripe)

Paid credit packs are processed through Stripe. Stripe processes payment and customer data (e.g. email address, payment-method metadata, transactions) as an independent controller under its own privacy policy and statutory retention obligations, in particular under commercial and tax law. Our legal basis is Art. 6(1)(b) GDPR (performance of a contract). When you delete your account we remove the mapping between your account and your Stripe customer record; the Stripe record itself is subject to Stripe's regulatory retention periods.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) to processing based on Art. 6(1)(f) GDPR. Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). A message via our contact form is enough to exercise these rights; you can also start access and erasure from within your account. Independently, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit); you may also contact the authority of your habitual residence.

Retention

We keep personal data only as long as necessary for the respective purposes. Anonymous trial data (uploaded CV, extracted profile photo, parsed JSON form, pasted job ad, and rate-limit counters) is deleted automatically within 24 hours of the anonymous session expiring. Account data and content stored in your account are kept until you delete your account, after which they are removed from live systems and backups within 30 days. If a pasted job ad is turned away (as too short, or because it does not read as a job ad), we keep the pasted text (at most its first 4,000 characters) on our server in the EU for 7 days, without any identifier of you or your session and with email addresses and phone numbers blanked out. This shows us why pasting fails; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Error reports (Sentry) are deleted after 90 days; server request logs contain only pseudonymous request identifiers. Payment data is subject to statutory retention periods (see Payment processing).

Contact for privacy matters

Use our contact form for any privacy-related request — we typically respond within one business day.

Open the contact form