Privacy policy
Last updated: 7 November 2026
BeyondRecruiter gives job seekers honest feedback on their CV for a specific job, written by AI. This page explains, in plain words, what we collect, why, where it is kept, who helps us, and your rights under the EU General Data Protection Regulation (GDPR).
Who is responsible
The controller for your data is Not yet published, Not yet published. Email: Not yet published. Write to this address for any privacy question or request.
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email, first name, password (stored only as a one-way hash), or your Google / Microsoft / LinkedIn sign-in email | Your account and logging in | Art. 6(1)(b) contract |
| Your CV, the job ads you add, and the answers you give (languages, work permit, where you live) | Writing your feedback, fixes and CV rewrites; keeping your CV in your account so you don't upload it again | Art. 6(1)(b) contract |
| Your reviews, applications you track, their status and notes, and your job preferences and profile (for example phone, city, notice period, salary expectation) | Showing your history, your tracker and matching jobs | Art. 6(1)(b) contract |
| Credits, purchases and invoices (we never see or store your card number) | Selling credits and keeping accounting records | Art. 6(1)(b) contract and 6(1)(c) legal duty |
| The IP address used to sign up (deleted after 30 days) and a one-way code of your email after you delete your account | Stopping abuse of the free offer | Art. 6(1)(f) legitimate interest |
| How much AI each request used | Cost control and fair-use limits | Art. 6(1)(f) legitimate interest |
| Job-search tips by email, only if you tick the box | Marketing | Art. 6(1)(a) consent, which you can withdraw any time |
Please don't put special categories of data in your CV (health, religion, political views, ethnic origin). If you do, they are processed only to write your feedback, based on your explicit choice to include them (Art. 9(2)(a)).
Where your data is kept
Your data is stored in a database on servers of our hosting provider in the European Union, encrypted in transit (HTTPS). Backups are kept in the same region. Only the operator can access the database, and only to run and support the service.
Who helps us (processors)
- Anthropic PBC (USA), the AI model (Claude) that writes your feedback. Your CV and the job ad are sent to it for each review. Anthropic does not use this data to train its models and deletes it after a short retention period. Transfers to the USA are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
- our hosting provider, hosting, in the European Union.
- Stripe Payments Europe Ltd. (Ireland), payments, when you buy credits.
- Google, Microsoft or LinkedIn, only if you choose to sign in with them. They tell us your email and first name.
Job searches send only the job title and place you type to job boards (Adzuna, Jooble, Arbeitnow and employers' career sites), never your CV or name. When you open an application form, you are on the employer's own site and their privacy policy applies to what you send them.
We never sell your data and never share your CV with employers or recruiters.
AI and automated decisions
Your feedback, scores, fixes and rewritten CVs are written by AI and are marked as such. They are suggestions only: no decision with legal or similar effect is made about you (Art. 22). Always check that everything in your CV is true before you send it.
How long we keep it
- Your account, CV, reviews and tracker: until you delete them or your account. Accounts unused for 24 months are deleted.
- Invoices and payment records: 10 years, as German tax law requires (§147 AO, §257 HGB), without your CV or reviews.
- Sign-up IP address: 30 days.
Cookies and storage on your device
We use one cookie that keeps you logged in, and your browser's storage for your draft and light/dark theme. These are strictly necessary, so no consent banner is needed. We use no advertising or tracking cookies and no analytics that follow you.
Your rights
You can ask to see your data (Art. 15), correct it (16), delete it (17), limit its use (18), take it with you (20), and object to processing based on legitimate interest (21). In the app, Account → Download my data gives you everything as a file, and Delete my account erases it straight away. You can also write to Not yet published. You have the right to complain to a data protection authority, for example the one where you live or the authority responsible for the operator.
Changes
If we change how we use your data, we update this page and tell account holders by email before the change applies.