Privacy policy

1. Controller

[PLACEHOLDER: name or company incl. legal form]

[PLACEHOLDER: street and number]

[PLACEHOLDER: postcode and city]

• Email: [PLACEHOLDER: email address]
• Phone: [PLACEHOLDER: phone number]

2. Hosting, server logs and backups

We run our own servers in Germany. A telecommunications provider supplies the internet connection; it only transmits data and processes no content on our behalf.

When you open a page, the server processes technically necessary data: time, requested address, IP address and browser identifier. Purpose: delivering the pages, secure and stable operation, fending off attacks, for example by limiting sign-in attempts. Legal basis: Art. 6(1)(f) GDPR. The application logs contain no content, no file names and no text from your documents or applications. Retention: logs are overwritten continuously (rotation).

So that nothing gets lost, we back up the database and the stored files every night, encrypted, on our own systems. Backups are kept on a sliding schedule for up to 24 months (14 daily, 8 weekly, 24 monthly). Your content is also encrypted there with your account’s key (section 4). Deleted data disappears from the backups when this period ends at the latest; if a backup is ever restored, the application deletes deleted accounts again as soon as it starts. Legal basis: Art. 6(1)(f) GDPR.

3. Account

For your account we process your name, email address and password (stored only as an Argon2id hash), your language and, if you set them up, passkeys (the public key only) and the two-factor secret (encrypted). For every sign-in we store the time, IP address and browser identifier so that you can see and end your sessions in the settings.

Purpose: providing the account and secure sign-in. Legal basis: Art. 6(1)(b) GDPR. Retention: until the account is deleted; expired sessions and links (address confirmation, password reset) are deleted daily.

4. Documents, profile and applications

You upload documents (such as your CV, references and certificates), maintain your profile, save job ads as a link or text and create applications with a cover letter and CV. For companies you can store contact persons and notes. For each application we store its status, history, notes and the result of the ATS check; when you send it, we keep the sent PDF files unchanged.

All of this content, file names and notes included, is encrypted with a key of its own for your account (AES-256-GCM) before it is stored. That key is itself encrypted with a master key that is neither in the database nor in the backups.

When we fetch a job ad from a link, our server sends a plain request without cookies and without any information about you to the ad’s website; for LinkedIn, to its public guest page.

Purpose: creating and managing your applications as you request. Legal basis: Art. 6(1)(b) GDPR; for details about other people that you enter (such as contact persons at companies), Art. 6(1)(f) GDPR, our legitimate interest being to let you manage your applications. Please upload only documents you need for applications; go-bewerbung needs no special categories of personal data such as health information. Retention: until you delete the content or your account.

5. AI features (Anthropic)

To read your documents and job ads, build your profile, write and revise cover letters and CVs and make improvements after the ATS check, we use AI models (Claude) from Anthropic Ireland, Limited, Dublin, Ireland; Anthropic, PBC in the USA is also involved in the processing. Only when you start one of these features do we send the content it needs: depending on the feature, the document concerned (file and extracted text), your profile, the job ad and the text of the application.

Anthropic processes this content as our processor (Art. 28 GDPR) under its data processing addendum and does not use it to train AI models. According to Anthropic, API inputs and outputs are deleted within 30 days unless longer storage is needed to fight abuse or for legal reasons. Transfers to the USA are covered by the EU standard contractual clauses (Art. 46(2)(c) GDPR).

For each AI call we store only its type, model, status, duration and token counts, no content, to enforce usage limits. Legal basis: Art. 6(1)(b) GDPR; for the usage records Art. 6(1)(f) GDPR, our legitimate interest being protection against abuse and cost. Retention of the usage records: 13 months.

AI results are suggestions that you check and change before sending. go-bewerbung does not invent facts and only adds skills missing from a job ad once you have confirmed them.

6. Cookies and browser storage

We only use strictly necessary cookies: a session cookie (HttpOnly, Secure, SameSite=Lax) that is set when you sign in and holds a random session identifier, plus one cookie each for your chosen language and appearance. In your browser’s storage we only remember whether this device has a passkey; the installable app keeps an offline page, but no content.

This storage is strictly necessary for the service you request; no consent is needed (§ 25(2) no. 2 TDDDG). The session cookie becomes invalid when you sign out, after 7 days without use and after 30 days at the latest.

There are no analytics, marketing or third-party cookies.

7. Emails

We only send service emails: confirming your address, resetting your password, confirming a new address, the notice that your address changed and the confirmation that your account was deleted. They contain no content from your documents or applications. Legal basis: Art. 6(1)(b) GDPR.

8. Security log

Security events such as sign-ins, failed sign-in attempts, changes to your password, passkeys or two-factor sign-in, deleting documents and exporting your data are logged with time, IP address and browser identifier, without content. Purpose: protecting your account and investigating abuse. Legal basis: Art. 6(1)(f) GDPR. Retention: 12 months; your account’s log is deleted together with the account.

9. Recipients and transfers outside the EU

The only recipients of your data are Anthropic for the AI features (section 5) and the provider named in section 7 for sending emails. Data is transferred to a third country for the AI features (USA, EU standard contractual clauses) and, for emails, only if section 7 says so. We do not sell data or pass it on for advertising.

10. Your rights

• Access (Art. 15 GDPR) and data portability (Art. 20 GDPR): under Settings → Your data you can download all your data as a ZIP file at any time, with a machine-readable JSON file and your original files.
• Rectification (Art. 16 GDPR): you edit your profile, documents, companies and drafts yourself. Sent applications stay unchanged as the record of what was sent.
• Erasure (Art. 17 GDPR): you delete documents, drafts and companies one by one, and your account with all its data under Settings → Delete account. Content, files and your account’s key are deleted immediately.
• Restriction of processing (Art. 18 GDPR).
• Objection to processing based on legitimate interests (Art. 21 GDPR).

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live or work.

Contact for privacy requests: [PLACEHOLDER: email address]

11. No automated decisions

The ATS check rates your documents automatically against technical rules so that applicant tracking systems can read them. It is a tool for you and makes no decision about you. We make no automated individual decisions and do no profiling (Art. 22 GDPR).

12. Changes

We update this policy when the service or the law changes. We tell signed-in users about material changes in advance.