Privacy Policy

1. Controller

Bernhard Götzendorfer, sole proprietorship (not entered in the Austrian company register), Rittingergasse 15/11, 1210 Vienna, Austria, hallo@bewerbungsgenie.at

2. What data we process

Account data (email), profile data you enter or import yourself (work experience, education, skills; optionally photo and date of birth), uploaded documents, generated documents, usage data.

Photo and date of birth are optional by default and are only included in a template if you explicitly choose to do so.

If you use the Photo Studio, we also process the reference photos you upload, the AI-generated application photos created from them, and counter data on how many photos you can create (count, reason, Stripe event ID, no image content).

If you use the application tracker under “Manage”, we store what you enter there: company, position, link to the posting, status and its history, application date, next step with deadline, notes, reason for rejection and, if you fill them in for the AMS record, where the job information came from, how you applied and a contact person. The purpose is to let you keep track of your applications and create your list for the AMS from them; the legal basis for your own information is the performance of the usage agreement with you (Art. 6(1)(b) GDPR (DSGVO)). The contact person is information about another person that you enter yourself; we process it based on the legitimate interest in documenting your applications traceably and being able to prove them to the AMS (Art. 6(1)(f) GDPR (DSGVO)). We delete this information together with your account; via Settings → Privacy → Export my data you can get it as a file at any time.

3. Purposes and legal bases

Account, profile, job search, document creation and payment processing: to perform the usage agreement with you (Art. 6(1)(b) GDPR (DSGVO)).

Photo Studio: if you upload your own reference photos to have an AI application photo created from them, we process them to fulfil your usage request (Art. 6(1)(b) GDPR (DSGVO)). Before your first upload we show you separate notices that you must confirm.

Security, fraud prevention and error diagnostics (Sentry): based on our legitimate interest in a functioning and secure service (Art. 6(1)(f) GDPR (DSGVO)).

Enquiries by email, for example to hallo@bewerbungsgenie.at: if your enquiry concerns your contract or a purchase, we process your email to perform the contract or to answer questions before entering into it (Art. 6(1)(b) GDPR (DSGVO)). We process requests concerning your rights (Art. 15–21 GDPR (DSGVO)) to fulfil our obligations under Art. 12 et seq. GDPR (DSGVO) (Art. 6(1)(c) GDPR (DSGVO)), and all other enquiries based on our legitimate interest in answering you (Art. 6(1)(f) GDPR (DSGVO)). An AI helps us sort incoming emails (see items 4 and 5). We base AI-assisted sorting on our legitimate interest in assigning enquiries quickly (Art. 6(1)(f) GDPR (DSGVO)); you can object to this (Art. 21 GDPR (DSGVO)). The AI only assigns your email; we read and answer it ourselves. Please do not send us health data or other particularly sensitive information unless your enquiry requires it.

Product analytics (PostHog, only after consent in the cookie banner): based on your consent (Art. 6(1)(a) GDPR (DSGVO)), which you can withdraw at any time.

Invoicing and statutory tax retention obligations: to fulfil a legal obligation (Art. 6(1)(c) GDPR (DSGVO) in conjunction with § 132 BAO (Austrian Federal Fiscal Code)).

4. AI processing

For extraction, matching, text generation, “Ask Genie” (advisory chat) and the interview coach, profile and job data are transmitted to Google LLC (Gemini API). This is based on Google's data processing agreement (Cloud Data Processing Addendum); the transfer to the US relies on the EU-US Data Privacy Framework (Art. 45 GDPR (DSGVO)). We use the paid API tier: your data is not used to train models; Google keeps prompts and responses for up to 55 days, solely to detect abuse, and discloses them where the law requires it. Results are suggestions; the evidence check shows evidence and blocks unsubstantiated claims.

If you use the Photo Studio, we additionally transmit your uploaded reference photos to Google LLC (Gemini API) to create an AI-generated application photo from them, on the same contractual basis as above (paid API tier, no training). Every generated image carries the label „KI-generiert" ("AI-generated") in the image itself and an invisible, machine-readable watermark from the provider; in the app, the notice „KI-generiert · Schau genau, ob es dir wirklich ähnlich sieht." ("AI-generated · Look closely at whether it really resembles you.") appears below it (Art. 50(2) of the EU AI Act).

Automated decisions: no automated decision with legal effect or similarly significant impact takes place (Art. 22(1) GDPR (DSGVO)). The match score ranks job postings for you; it does not decide about you. The AI that helps us sort incoming emails does not decide about you either: we read and answer your email ourselves.

5. Recipients and data processors

We share your data with service providers who process it on our behalf (Art. 28 GDPR (DSGVO)); data processing agreements are in place with them, and copies are available on request. For the AI-assisted sorting of incoming emails we also use an AI service to which the provider’s privacy and data processing terms apply (see below).

Where we base a transfer to a country outside the EU or the EEA on standard contractual clauses (Art. 46 GDPR (DSGVO)), we will also provide you with a copy of these safeguards on request (Art. 13(1)(f) GDPR (DSGVO)); just write to hallo@bewerbungsgenie.at.

Google LLC (USA). AI processing via the Gemini API (see item 4): profile and job data, chat messages, and, if you use the Photo Studio, your reference photos and the application photos generated from them. Transfer based on the EU-US Data Privacy Framework. If you use the Interview Coach, your microphone audio is streamed live to Google during the conversation; we then only store the transcript, no audio recording, inform you before the conversation starts that you are speaking with an AI (Art. 50 of the EU AI Act). We automatically delete the transcript once the retention period has expired (see item 6), or immediately if you delete the transcript in the app or your account. If you practise in writing, there is no audio: your typed answers are sent to Google for evaluation, and we store the questions and your answers like a transcript, with the same retention period and the same deletion.

Supabase Inc.: database, login and file storage (profile, documents, photos). Server location Frankfurt (EU).

Vercel Inc. (USA): hosting of the application with server location Frankfurt, cookieless web analytics and load-time measurement. Transfer based on the EU-US Data Privacy Framework and Standard Contractual Clauses.

Stripe Payments Europe Ltd. (Ireland). Payment processing: name, email, billing address, payment data. Transfer to Stripe Inc. (USA) based on the EU-US Data Privacy Framework.

Resend (Plus Five Five, Inc., USA): sending transactional emails such as login links and confirmations, server location EU (Ireland).

Google Cloud EMEA Limited (Ireland): mailbox (Google Workspace) for emails you send us, for example to hallo@bewerbungsgenie.at, including your address and the content of your message. Transfer to Google LLC (USA) based on the EU-US Data Privacy Framework and standard contractual clauses.

Providers of AI services that help us sort incoming emails: your address and the content of your message, so that the email is filed correctly. The respective provider’s privacy and data processing terms apply to this processing. Where such a provider is located outside the EU or the EEA, the transfer is governed by the provisions in the provider’s terms.

Functional Software Inc. (Sentry, USA): error diagnostics with server location Frankfurt (EU). Personal data and CV content are removed before transmission.

Hetzner Online GmbH (Germany): domain registration and DNS for bewerbungsgenie.at; an internal, non-publicly reachable service on the same infrastructure retrieves an individual job posting at your request when you paste in a link and the direct fetch fails, but does not process any user data while doing so.

PostHog Inc. (USA, EU cloud with server location Frankfurt): product analytics only after your consent in the cookie banner (see item 8), transfer based on Standard Contractual Clauses.

Hetzner Online GmbH (Germany), second purpose: our PDF generation (Gotenberg) runs on a server in Falkenstein and is operated by us — jointly with our sister application BuchhaltGenie. It converts your CV and cover letter into a PDF file and receives the full document content for that purpose. The data stays within the EU; Hetzner only provides the server.

Upstash Inc. (USA, database with server location Frankfurt): cache for the abuse throttle: we count there how many requests come from a device or from your account, so that no one overloads our login or document generation. We do not pass on your IP address itself: it is converted beforehand, using a secret additional value, into a 16-character string from which it cannot be recovered. If you are logged in, we count via your account identifier instead. For the acknowledgement of the withdrawal function we count, per recipient address, how many acknowledgements we send; for this Upstash only holds a non-reversible HMAC hash of the address, never the address itself. For the interview coach in voice mode we count and check reconnections per practice interview via a random identifier. Only these counters and markers with a short lifetime are stored, no profile data, no documents and no email addresses. The legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR (DSGVO)).

We announce changes to this list to you in advance by email and in the app; you can object to them. This list was last updated: 10.10.2026.

6. Retention period

If you delete your account, we completely remove all data linked to you, including profile, documents, applications and photos in storage, except for the statutory retentions listed below. The technical deletion cascade is documented in our deletion concept.

We delete job postings from our database once we have not found them in any source for 90 days, unless someone has saved them or an application in the tracker refers to them.

We delete the original file of a CV import 30 days after you have confirmed the imported data; we store your confirmation before your first email file (.eml), with its time, for as long as your account exists.

We automatically delete your uploaded reference photos from the Photo Studio after 30 days. The application photos generated from them remain until you delete your account.

We delete transcripts from the Interview Coach at the latest 90 days after the conversation ended. If you abandon a conversation without ending it — by closing the tab, for example — we treat it as ended 24 hours after it started, and the period runs from that point. The exception: if one of your own open applications is still linked to the same job at that time, the transcript remains until that application is closed or until you delete the transcript in the app or your account.

We retain invoices and payment records for 7 years from the end of the calendar year, and longer as long as they are relevant to pending proceedings (§ 132 BAO (Austrian Federal Fiscal Code)); after that we delete or anonymise them.

We delete emails you send us, for example to hallo@bewerbungsgenie.at, 12 months after the last message in the conversation. We only delete requests concerning your rights (Art. 15–21 GDPR (DSGVO)) and our replies 3 years after the last message: that is the longest period within which a complaint to the data protection authority is possible (§ 24(4) DSG (Austrian Data Protection Act)), and for that long we must be able to prove that we handled your request (Art. 5(2) GDPR (DSGVO)). If an email is relevant for tax assessment, we keep it for 7 years from the end of the calendar year, and longer as long as it is relevant to pending proceedings (§ 132 BAO (Austrian Federal Fiscal Code)).

We store withdrawal declarations you submit via "Withdraw from contract" (name, email address, contract details, time of receipt) as evidence and to process your withdrawal for 3 years from receipt (Art. 6(1)(c) GDPR (DSGVO) in conjunction with § 13a FAGG (Austrian Distance and Off-Premises Contracts Act)), even if you delete your account before then.

We delete security and access logs after at most 90 days. We retain usage statistics for AI calls (cost and volume data only, no content) for up to 24 months for cost control.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR (DSGVO)).

You can download a copy of your data (access and data portability) yourself as a file at any time: Settings → Privacy → Export my data. You can also delete your account yourself: Settings → Privacy → Delete account. For rectification, restriction, objection and any questions about your data, write to hallo@bewerbungsgenie.at; you can also request access there if the export is not enough for you. We will respond to your request within one month (Art. 12(3) GDPR (DSGVO)).

You also have the right to lodge a complaint with the Austrian data protection authority: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

8. Cookies and analytics

We use only what is strictly necessary. On your first visit we ask whether we may additionally collect usage statistics; without your consent this does not happen (§ 165 TKG 2021 (Austrian Telecommunications Act), Art. 6(1)(a) GDPR (DSGVO)). You can change or withdraw your decision at any time via "Cookie settings" in the footer, with the same prominence as granting it.

Essential (without consent, Art. 6(1)(b)/(f)): sb-*-auth-token: login session (Supabase); bg_consent: stores your cookie decision (6 months); bg_app_locale: stores only the language you chose for the app (1 year, not readable by scripts in your browser); bg_onboarding_dismissed: remembers that you hid the first-steps guide on the overview (1 year, not readable by scripts in your browser); bg_signup_pending: remembers for at most 5 minutes that, and how (sign-in link or Google), you just created your account, only used if you have allowed statistics.

Only for the duration of your visit (your browser's session storage, not a cookie): bg_attr: remembers which channel brought you to us (UTM parameters, referring website as domain only, entry page; search terms shortened, email addresses discarded). We only store bg_attr persistently (as a cookie, 30 days) if you have allowed statistics; on withdrawal we delete the cookie.

Only after consent: bg_ph_id, a random, pseudonymous identifier for usage statistics (12 months). We collect statistics with PostHog (PostHog Inc., USA) exclusively in the EU cloud with server location Frankfurt; transfer to PostHog Inc. based on Standard Contractual Clauses. Events such as "registration completed" or "document created" are transmitted with the pseudonymous identifier or your account ID, never email, name, profile or CV content. No autocapture, no session recording, no loading of additional scripts. If you withdraw consent, we stop collection and delete bg_ph_id.

Error diagnostics: Sentry (see item 5) runs without cookies and without access to storage in your browser; personal data is removed before transmission (Art. 6(1)(f)).

Sentry runs in a minimal mode: without your consent we only capture uncaught errors (error message, requested address, IP address) via an ingest server in the EU. The legal basis is our legitimate interest in a functioning service (Art. 6(1)(f) GDPR (DSGVO)), and Sentry does not set a cookie for this. Performance data (page load timings and session quality) is only added after your consent in the cookie banner; you can withdraw that consent at any time via "Cookie settings", measurement stops immediately.