Back to account

Privacy Policy

As of: October 2026

This is an English courtesy translation. In case of any discrepancy, the German version prevails and is legally binding. The applicable law remains the GDPR and the German Federal Data Protection Act (BDSG).

1. Controller

The controller within the meaning of the GDPR is:
Alexander Vitanyi
Pettenkoferstr. 10, 10247 Berlin, Germany
Email: support@jacvault.de

2. Collection and processing of personal data

We collect and process personal data only insofar as this is necessary to provide a functional service as well as our content and services. Personal data is generally collected and processed only with the user’s consent or where another legal basis permits it.

3. What data we process

In the course of using JACVault, we process the following categories of personal data:

  • Account data (email address, first and last name)
  • CVs and application documents you upload
  • Payment data (processed exclusively via our payment service provider Stripe)
  • Server log files (IP address, timestamp, pages accessed, browser and device information)
  • Session data (session cookies to keep you signed in)
  • Communication data (emails to our support)

4. Purpose of data processing

We process your data for the following purposes:

  • Provision and improvement of our services
  • Management of your user account
  • Handling of payments and subscriptions
  • AI-assisted analysis and optimization of your application documents
  • Sending of transactional emails (account confirmation, invoices, password reset)
  • Security and abuse prevention (server logs)
  • Communication regarding your account and our services

5. Legal bases

Your data is processed on the following legal bases:

  • Art. 6(1)(b) GDPR – performance of a contract (account access, subscription)
  • Art. 6(1)(a) GDPR – consent (e.g. at signup)
  • Art. 6(1)(c) GDPR – legal obligation (e.g. retention of invoices)
  • Art. 6(1)(f) GDPR – legitimate interests (server logs, security)

6. Server log files

When you access our platform, technical access data is automatically recorded in server log files. This includes the IP address, the time of access, the URL accessed, the HTTP status code as well as browser and operating system information. This data is used exclusively to ensure operation, for error diagnosis and to defend against attacks, and is deleted after 14 days at the latest. The legal basis is Art. 6(1)(f) GDPR.

7. Sign-in via social login (OAuth)

JACVault offers the option to sign in via third-party providers (Google, Microsoft, LinkedIn). When you use a social login, data is exchanged between JACVault and the respective provider. The scope of the data transmitted depends on the privacy settings of your third-party account. As a rule, the email address, name and a unique identifier are transmitted.

JACVault stores from these providers only the data necessary to create an account (email, name). The providers’ own privacy policies apply to their data processing:

8. Disclosure of data to third parties and processing on our behalf

Your personal data is only disclosed to third parties insofar as this is necessary to perform the contract. Data processing agreements (DPAs) pursuant to Art. 28 GDPR are in place with all processors we use. We use the following service providers:

Microsoft Azure OpenAI Service – AI-assisted processing of application documents. Processing exclusively in EU data centers, no training on user data, GDPR-compliant, DPA in place. Microsoft privacy statement

Google Gemini (Google Cloud EU) – AI-assisted processing of application documents. Processing exclusively in EU data centers, no training on user data, GDPR-compliant, DPA in place. Google Cloud privacy notice

Google Cloud Storage (Belgium, EU) – Storage of CVs and application documents, encrypted with AES-256, GDPR-compliant, DPA in place. Google Cloud privacy notice

Stripe Inc. (USA) – Payment processing. Stripe processes payment data only and has no access to application documents. As Stripe is based in the USA, the data transfer takes place on the basis of the European Commission’s adequacy decision pursuant to Art. 45 GDPR (EU-US Data Privacy Framework, DPF), under which Stripe is certified. Stripe privacy policy

Scaleway, S.A.S. (France, EU) – Sending of transactional emails (account confirmation, password reset, invoices). Scaleway processes the user’s email address as well as the subject and content of the respective message for this purpose. Registered office: 8 rue de la Ville l'Evêque, 75008 Paris, France (share capital EUR 214,410.50, R.C.S. Paris 433 115 904). Sending runs exclusively through the fr-par (Paris) region; processing therefore takes place within the EU and no transfer to a third country occurs. A data processing agreement pursuant to Art. 28 GDPR is in place. The service offers no open or click tracking; our emails therefore contain neither tracking pixels nor links rewritten to a provider domain. Scaleway privacy policy

To ensure the stability of and to diagnose errors in our mobile app (iOS/Android), we use Sentry, a service provided by Functional Software, Inc. (45 Fremont Street, San Francisco, CA 94105, USA). Diagnostic data is processed and stored within the European Union (Frankfurt data-residency region); no transfer of this data to the USA takes place. Only technical error data is transmitted: device model, operating system and app version, error and crash stack traces, and a pseudonymous user identifier (internal account ID – no name, no email address). The contents of your applications, CVs, cover letters or job postings are not transmitted to Sentry – the relevant fields and network payloads are stripped on the device before any error report leaves it. The legal basis is our legitimate interest in a stable, error-free app pursuant to Art. 6(1)(f) GDPR. A data processing agreement (Art. 28 GDPR) is in place with Sentry. Further information: https://sentry.io/privacy/.

9. Transactional emails

In the course of using the service, JACVault sends transactional emails via the service provider Scaleway (France) to the email address provided at registration. This includes in particular: account confirmation, password reset, payment confirmations and invoices, as well as notices of important changes to the service or account. The legal basis is Art. 6(1)(b) GDPR.

10. Retention period

We store personal data only for as long as is necessary for the respective processing purposes or as statutory retention obligations require (e.g. 10 years for invoices pursuant to §§ 147 AO, 257 HGB). After you terminate your account, your application documents and profile data are deleted within 30 days. Server logs are deleted after 14 days at the latest.

11. Automated decision-making

JACVault does not make automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you. The service’s AI-assisted suggestions are working aids only, which the user reviews and uses on their own responsibility.

12. Your rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw a given consent (Art. 7(3) GDPR)

To exercise your rights, please contact: support@jacvault.de

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The authority responsible for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI).

13. Cookies and session data

JACVault uses only technically necessary cookies to maintain your session (session cookie). No tracking, analytics or advertising cookies are used. The legal basis is Art. 6(1)(f) GDPR.

During a demo guest session (section 16) we additionally set a second, likewise strictly necessary cookie that only indicates that a demo is running (so that we can show the right notice when it expires or when you sign in). Both cookies of the guest session expire after 24 hours.

14. Data security

We take comprehensive technical and organizational measures to protect your data:

  • All data transfers are exclusively encrypted via HTTPS (TLS).
  • CVs and application documents are stored encrypted with AES-256 in Google Cloud Storage in Belgium (EU).
  • All other personal data (account data, usage data) is stored encrypted in our internal database.
  • The AI services we use operate their infrastructure exclusively within the EU and do not use your data to train models.

15. Browser extension (JACVault extension)

The optional JACVault browser extension (Chrome) helps you capture job postings and import your own professional profile. It is an add-on to the web app and requires a JACVault account.

  • Data processed: Only upon your active action (clicking “Capture”) does the extension read the visible text of the page you currently have open — for a job posting: title, company, location and posting text. For the profile import we process the profile PDF you exported yourself from LinkedIn. There is no silent background reading.
  • Transmission: Captured data is transmitted solely to our backend (app.jacvault.de) into your personal JACVault account, authenticated via your existing session. No sharing with third parties, no selling, no tracking.
  • Permissions: Access to a website is granted by you per page at runtime, not at installation. A session token is stored locally in your browser so the extension stays connected to your account.

The legal basis is Art. 6(1)(b) GDPR (provision of the function you requested). You can uninstall the extension at any time without giving reasons.

16. Demo guest session

You can try JACVault without signing up. From the moment you open the demo, we count, to prevent abuse, how often the demo is opened and demos, simulations or document generations are started from an IP address. The IP address serves only as the key of a counter in our cache and expires after 24 hours at the latest; we do not store it with any account.

As soon as you change something in the demo, we create a guest session for you: a temporary account without a name and without an email address, into which two fictional sample applications including profiles and documents are copied. We store your changes in this guest account.

  • Cookies: For the guest session we set two strictly necessary cookies (session and demo notice), both expiring after 24 hours (see section 13). No consent is required for this (§ 25(2) no. 2 TDDDG).
  • Deletion: After 24 hours we automatically delete the guest account with all changes and the associated files. If you sign up, we remove all content of the demo session; no content from the demo is carried over to your account.
  • Interview simulation: If you start an interview simulation in the demo, your answers are sent to our AI providers in the EU for evaluation (Microsoft Azure OpenAI, data centre in Sweden; Google Vertex AI, EU multi-region). We delete them with the demo after 24 hours; the providers keep them for up to 30 days for abuse monitoring.

The legal basis for the guest session and the simulation is Art. 6(1)(b) GDPR (providing the function you requested); for the abuse counters it is Art. 6(1)(f) GDPR (protecting our service against overload and abuse).

17. Usage measurement (PostHog, without cookies)

To understand how many visitors use the demo, whether they sign up afterwards and how new accounts get started, our server sends a small number of events to PostHog (PostHog, Inc.), processed via PostHog’s EU infrastructure and via our own address t.jacvault.de. These are the events: demo opened, guest session started, sign-up completed, first profile created, CV uploaded and first application created — each with a few details such as the page, the language or the sign-up method. The last four events are measured for all accounts, not only for accounts from the demo.

  • Without cookies and without access to your device: the events are sent by our server, not by your browser. For “demo opened” the page creates a random identifier that exists only in the memory of the open page and is not stored on your device.
  • Without IP address, name or email address: PostHog does not receive your IP address; location lookup is switched off. Instead of your account ID we transmit a pseudonymous identifier that only we can link to your account.
  • Person profile: the events themselves do not create a person profile at PostHog. When a guest session starts, we link the page’s random identifier with the guest account’s pseudonymous identifier; in doing so PostHog may create a pseudonymous profile, which likewise contains no name, email address or IP address.

The legal basis is our legitimate interest in measuring and improving our service (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR), e.g. by email to support@jacvault.de. A data processing agreement pursuant to Art. 28 GDPR is in place with PostHog. The events are deleted after 12 months at the latest.

18. Currency and changes

This privacy policy is currently valid and is dated October 2026. We reserve the right to amend this privacy policy if our services change or if data protection requirements change. In the event of material changes, users will be informed by email.