Privacy Policy

Privacy Policy

This policy explains how easy-job.ai processes personal data when you visit the website and use our job application services. You can view the website without registering. Account-related features require an account.

1. Controller and contact

EasyJobAI
Owner: Mario Michael Heinrich
Bahnhofstraße 55A
94469 Deggendorf
Germany
Email: team@easy-job.ai
Phone: +4915560907868

2. Website, cookies and usage statistics

2.1 Connection and security data

Requests to our services involve processing IP addresses, browser identifiers and request times. Operational and security logs support troubleshooting, access protection and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is reliable and secure operation. These data are separate from aggregate page view statistics.

2.2 Cookies and local storage

We use cookies and browser storage for requested features (section 25(2) no. 2 TDDDG). Where personal data are processed, Article 6(1)(b) GDPR applies to providing the feature and point (f) to abuse prevention.

• Sign-in: A cookie keeps you signed in. Without “Remember me”, it is a session cookie; otherwise it is valid for up to seven days and renewed during active use. Short-lived supporting cookies protect external sign-in and your session-duration choice.
• Language and appearance: Your language choice is stored for up to one year; the light or dark appearance remains locally until changed or deleted.
• Drafts: Form entries may be stored in your browser; section 3.3 covers resume drafts.
• Payments and security: Necessary cookies may be used during payment processing and protected actions to prevent abuse.

You can delete or block cookies and website data in your browser settings. This may remove sign-in, preferences and local drafts. Google Tag Manager and Microsoft Clarity are disabled; earlier consents do not activate these services. Disabling them does not automatically delete data already held by these providers.

2.3 Page view and referral statistics

We count page views in aggregate by day, language and page, and the external referring domain, such as google.com. These statistics do not store full referral URLs, search parameters, account associations or visitor identifiers and do not create individual browsing histories. IP addresses and browser identifiers are technically transmitted but not stored for recognition in these statistics. The legal basis is Article 6(1)(f) GDPR; our interest is evaluating and improving our offering. Aggregate statistics remain available. Earlier daily recognition identifiers are not renewed and expire after 48 hours.

3. Account, documents and drafts

3.1 Registration and profile

For an account, we process your email address, name, title or gender information, acceptance of the terms of use and, for password sign-in, a password hash. Optional profile information includes professional title, telephone number, address, country of residence, date of birth, nationality and language skills. This supports account management and requested application features (Article 6(1)(b) GDPR). Additional profile information provided voluntarily is processed on the basis of your consent (point (a)). Security and activity data support account protection and abuse prevention (point (f)).

Required fields are marked in the form; without them we cannot provide the account or requested feature. You can omit or change voluntary information. Please provide only information needed for your application.

3.2 External sign-in

If you select an available Google, GitHub or LinkedIn sign-in, you are redirected to that provider. It receives the authentication request and may process your IP address, browser information and use of easy-job.ai. Depending on the provider and your permissions, we receive a provider identifier, name or username, email address, verification status and possibly a profile picture. We do not request mailbox, repository or LinkedIn contact access for sign-in and do not transmit application content.

This information creates, links and secures your account (Article 6(1)(b) GDPR and point (f) for access protection). Provider associations and necessary access tokens are stored in the authentication system. You can remove links if another sign-in method remains available. Account deletion removes our associations and tokens, not your account with the sign-in provider. You can revoke permissions there separately. Section 5 lists providers and international processing.

3.3 Documents and resume drafts

We process uploaded resumes, other application documents and form entries to carry out your requests (Article 6(1)(b) GDPR). AI transmission depends on the feature and file format; see section 4.

The resume generator automatically stores personal details, professional content and settings as a browser draft. Signed-in users additionally have one server-side draft per account. The profile photo is excluded from both drafts. Saving a draft alone does not send content to an AI model.

Further editing replaces account drafts, which are removed on account deletion; there is no separate automatic expiry. Local drafts remain until overwritten, reset or removed by clearing website data. Signing out and server-side account deletion do not automatically remove this browser copy. On shared devices, you should clear website data after editing.

4. AI features and job search

4.1 Resumes and cover letters

For creation, analysis and improvement, we use your selected AI provider from section 5. We transmit professional information, job details, language and instructions as needed for your request (Article 6(1)(b) GDPR).

• Creation from form fields: Name, email address, telephone number, address and date of birth from personal fields are not sent to the AI model. Professional content, title and gender may be transmitted.
• Text analysis: For DOCX/DOC/TXT and PDF analysis with Mistral, we remove recognised personal details before AI transmission. Unusual formats and free text can affect filtering.
• PDF analysis with OpenAI, Anthropic or Google: The original PDF, including any contact details it contains, is transmitted to the selected provider.

Personal information in free text may reach the AI even in filtered features. This is not complete anonymisation. Generated documents and analysed resumes are stored with your account.

4.2 AI headshots

Your selfie or portrait is sent to OpenAI or Google for requested image generation (Article 6(1)(b) GDPR). Generated headshots are stored on our servers, available in your gallery and removed on account deletion. Processing serves image design, not biometric identification.

4.3 AI agent

The agent you start processes your resume, professional profile, search terms, location and radius, salary preferences, exclusions, notes and sending authorisations. Preferences, runs, selected jobs, match explanations, cover letters, researched recipient addresses with sources, sending times and status are stored in your account. Professional information, preferences, notes and job details are transmitted to OpenAI for matching, research and creation.

Form previews may also transmit names and contact details to OpenAI and enter them in fields on an employer's website. The agent does not press a submit button; the website may nevertheless already process entries. Without sending authorisation, the agent does not schedule email sending. For authorised or manually initiated sending, our email delivery provider and your selected employer receive the application including the resume, recipient and reply address. Sending cannot be recalled afterwards. Employers process applications independently.

The legal basis is Article 6(1)(b) GDPR. Usage, status and billing data additionally support secure operation and accountability (point (f)). Match scores support your selection; the agent does not make hiring decisions. The exclusion of personal form fields in section 4.1 does not apply to these form previews and application delivery.

4.4 Interview simulation

For interviews, we process the selected analysed resume, company, position, job advertisement, interview type, language, duration and transcript-storage choice. The AI simulates an interviewer, is not a company employee and makes no hiring decision. The legal basis for carrying out your request is Article 6(1)(b) GDPR.

• Preparation: Experience, education, skills, languages and certifications are sent to OpenAI. The resume's personal section containing name, email, telephone number, address, date of birth, gender and photo is omitted for this context. Free text, the advertisement and answers may still contain personal information. Section 4.1 covers the preceding upload.
• Company research: To prepare the interview, we research publicly available information about the company and the intended position. The resume is not submitted as a search request. OpenAI and participating search services may process the terms; research and sources are stored.
• Conversation and feedback: After microphone permission, audio is transmitted to OpenAI. A transcript is temporarily collected on our servers and sent to OpenAI for feedback, even without transcript storage in your account.
• Account storage: Settings, research, status and feedback are stored. The transcript is stored in the interview record only if you choose this. You can delete interviews; this may be temporarily blocked during preparation. The automatic deletion period is 30 days from preparation.
• Optional recording: At your request, your browser can record your voice and AI responses locally. We do not upload this recording to the cloud. You can listen, download or delete it. It is no longer available on the page after leaving or reloading. You must delete downloads on your device yourself.

The local recording is separate from necessary audio transmission to OpenAI. Operational and billing evidence is stored separately and contains no conversation, resume or feedback content (Article 6(1)(f) GDPR). Deleting an interview does not remove that evidence.

Voluntary ratings and reviews are stored with account and interview associations for up to 730 days, or less on account deletion. They are used exclusively for internal improvement based on our legitimate interest (Article 6(1)(f) GDPR), not published, used for advertising or sent for AI evaluation. Deleting an interview does not remove its review. Please do not include confidential information.

4.5 AI design templates

Style, wishes and language are transmitted to Anthropic for creation. Visual checks use preview pages with fictional example data and layout information, not actual resume data. Personal information in your design wishes may still be transmitted.

The template and creation information are stored in your account. Applying a finished template to your document data takes place on our servers without another AI review of these data. You can delete templates; account deletion also removes them. Previously saved documents using the design remain. The legal basis is Article 6(1)(b) GDPR; operational and billing evidence additionally supports secure operation (point (f)).

4.6 Job search and search statistics

Job titles, locations and filters are transmitted to external job portals and aggregators, including Germany's Federal Employment Agency. We do not transmit names, email addresses or account IDs for this purpose. Search terms may nevertheless contain personal information if you enter it yourself. Processing serves your search (Article 6(1)(b) GDPR). External job and career pages have their own privacy notices.

For aggregate statistics on frequent terms and the number of search users, we store the search term, time and, for signed-in users, account ID for 90 days. Reports show frequencies rather than personal search histories. The legal basis is Article 6(1)(f) GDPR; our interest is evaluating and improving job search. You can object via team@easy-job.ai. Agent requests in section 4.3 are separate from these statistics.

4.7 Country lookup

We use IPinfo to determine your country and transmit your public IP address to the service for this purpose. No account IDs, application content or GPS coordinates are transmitted; we use the country code. The feature supports country-specific requirements and aggregate country statistics (Article 6(1)(f) GDPR). Country information can also be filled in using stored IP addresses.

Query results are cached on our servers and valid for 24 hours; country information may additionally be stored in your account. You can object via team@easy-job.ai. Section 5 covers IPinfo and its processing in the USA.

5. Providers and international processing

Our hosting services use locations in the European Union; our database operates in Germany. External services support AI, sign-in, delivery, payments and country lookup. Data may be processed outside the EU, particularly in the USA. Hosting in the EU does not guarantee exclusively European processing by every provider.

Provider	Use and further information
Cloud hosting providers based in the USA	Website operation and processing of connection, account and service data. Our server locations are in the EU; additional processing in the USA is possible.
MongoDB Atlas	Data storage. MongoDB privacy.
OpenAI	Resumes, cover letters, photos, agent and interviews. According to the provider, content transmitted when we use the service is not used for training by default unless data sharing is enabled. Security logs may generally remain for up to 30 days and longer in exceptional cases; other storage depends on the service. We disable optional content storage for interviews without guaranteeing complete non-retention. Data controls, Data processing terms.
Anthropic (Claude)	Resumes, cover letters and design templates. According to the provider, inputs and outputs processed when we use the service are generally deleted within 30 days; exceptions include security cases, legal obligations or separate agreements. Retention periods, Data processing terms.
Mistral AI	Resume analysis and text generation. Complete non-retention is not promised. Privacy, Contract and data processing terms.
Google (Gemini)	Resumes, cover letters and photos. The terms applicable to our service exclude content use for product improvement. Content may be stored for security and legal purposes and processed in countries with Google facilities. Terms of use, Data processing terms.
Google, GitHub and LinkedIn	External sign-in. Providers generally act as independent controllers for their own services, including international processing. Google, GitHub, LinkedIn.
Email delivery providers based in the USA	Delivery of account notices, requested messages, authorised applications and newsletters where consent has been given. Recipient and reply addresses and message content are processed; processing in the USA is possible.
Stripe	Payments and fraud prevention; processing inside and outside the EU is possible. Stripe may be a processor or independent controller depending on processing. Privacy, Data processing terms.
IPinfo Inc.	Country lookup with processing in the USA. Privacy, Data processing terms.

Processing on our behalf is subject to Article 28 GDPR. International transfers depend on the applicable safeguards, particularly EU Standard Contractual Clauses in the applicable data processing terms or an applicable adequacy decision. You can request information on the specific safeguards and a copy or access to them via team@easy-job.ai. Security certifications alone do not provide a transfer basis. External services' retention periods may differ from section 7.

Employers and external websites process received applications or entered information independently. Disclosure to authorities or for legal enforcement requires an appropriate legal basis, such as legal obligations (Article 6(1)(c) GDPR) or necessary legitimate interests in protecting our rights and preventing abuse (point (f)).

6. Payments, contact and emails

6.1 Credit purchases

Stripe processes payment and billing details needed for payment. We store account association, package, credits, amount, transaction identifier, payment method, status and any refund information. We do not store full card details. The legal basis is Article 6(1)(b) GDPR for the purchase, point (c) for necessary accounting evidence and point (f) for fraud prevention. Section 7 covers retention.

6.2 Contact and account notices

For contact enquiries, we process name, email address and message content to respond. Verification, password resets, payment confirmations, security messages and necessary information about contractual changes are also sent by email. The legal basis is Article 6(1)(b) GDPR for contract-related matters, point (c) for mandatory notices and point (f) for handling other enquiries. Our email delivery provider receives addresses and content needed for delivery; see section 5.

6.3 Marketing and open tracking

Marketing newsletters, vouchers and promotional reminders require your consent (Article 6(1)(a) GDPR). Newsletters are sent to verified email addresses. You can withdraw consent in your email settings. Necessary account notices are independent of marketing preferences.

We do not record whether you open our emails. Personal open tracking is disabled. Loading embedded images involves technical transmission of connection data.

7. Retention and deletion

We retain data as long as needed for the stated purpose or required by law. Our services use the following periods and criteria:

Data	Retention and deletion
Account and application documents	During account use; account deletion removes associated application documents and feature data. Inactive accounts are scheduled for deletion after two years without sign-in and prior warning. Separate legal and security evidence may remain.
Account drafts and design templates	Until replaced, deleted or account deletion; no separate automatic expiry. Browser drafts must be removed on the respective device.
Interviews	30 days from preparation or earlier deletion. Reviews: up to 730 days from submission, or less on account deletion. Downloaded audio recordings remain on your device.
Search statistics, AI operational and service events, Stripe webhook events	90 days. Aggregate statistics without individual association may remain.
Security and activity data	Security events generally 90 days, or 180 days for high or critical severity. IP and profile change histories are limited to the most recent entries. Other technical logs are retained according to the need for troubleshooting and abuse prevention.
Payment and accounting evidence	Where legally required, generally eight years for invoices and accounting vouchers, ten years for books and annual financial statements, six years for business correspondence and other tax-relevant documents. Periods generally start at the end of the relevant calendar year; statutory extensions may apply (section 147 AO, where applicable section 257 HGB).
Credit purchase records	Completed and refunded purchases generally eight years from the end of the year of the latest financial event, or ten years if classified differently. Unsuccessful or cancelled attempts without refunds: 90 days. Open payments, disputes, pending refunds and necessary holds prevent automatic deletion. Credit balances are unaffected.
Contact and email communication	During handling and as long as evidence of the matter is needed; legal obligations or necessary legal defence may extend storage. Marketing preferences and necessary consent evidence are retained according to their purpose.
Email opening data	Where still stored: 180 days from the recorded opening or creation of the associated identifier, or earlier on account deletion.

Automatic cleanup may occur later. Account deletion does not remove browser drafts or downloads on your device, or applications already delivered to employers. Necessary payment and security evidence is retained separately from the account.

Database backups may contain deleted data until the configured backup schedule expires. They serve recovery and are not the regular account database. You can enquire about the precise retention of these copies via team@easy-job.ai. Immediate, irreversible removal from every backup is not promised.

8. Your rights and policy changes

You can exercise your privacy rights via team@easy-job.ai. Subject to the statutory conditions, you have the following rights:

• Access and rectification: Information about your data and correction of inaccurate details (Articles 15 and 16 GDPR).
• Erasure and restriction: Deletion of unnecessary or unlawfully processed data or restriction of processing; statutory retention may prevent deletion (Articles 17 and 18 GDPR).
• Portability: Your provided data in a commonly used machine-readable format where the conditions apply (Article 20 GDPR).
• Objection: To legitimate-interest processing for reasons relating to your particular situation; to direct marketing at any time without giving reasons (Article 21 GDPR).
• Withdrawal: Withdraw consent at any time for the future. Earlier lawful processing remains unaffected (Article 7(3) GDPR).
• Complaint: To a data protection authority, particularly the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, email: poststelle@lda.bayern.de (Article 77 GDPR).

HTTPS protects connections to the website and integrated services. Passwords are hashed; access checks protect account features. Our servers and AI providers can read content needed for processing. This is not end-to-end encryption against those services.

We update this policy when services or legal requirements change. We appropriately inform you of material changes; any necessary new consent is obtained separately.