Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Overview: which data we process

freelancerjury checks how well your freelancer profile fits the market. For this we process the following data:

• Access data (server log files): IP address, date and time, page requested, browser. Purpose: secure and stable operation (Art. 6 (1) (f) GDPR). Deleted after 14 days.
• Your CV: you upload it as a PDF or DOCX. We remove name, contact details, address, date of birth, client names and links before a profile is stored. The profile we analyse contains only anonymised data (roles, skills, project periods, industries, seniority). In addition, after a successful analysis we store the original CV file you uploaded (PDF or DOCX) so that you do not have to upload it again later for CV tailoring and export. The file contains personal data (e.g. name and contact details), is kept on our server separately from the profile, is used only for that purpose, is never passed to AI services or third parties and is not delivered publicly. A new upload replaces it. Legal basis: Art. 6 (1) (b) GDPR (performing the analysis you requested and the CV features).
• Profile photo from your CV: if your PDF contains a portrait photo, we detect it on our server (without AI and without passing it to third parties), shrink it and show it next to your verdict. It is stored separately from the profile, delivered only to you and deleted together with your CV or account. Legal basis: Art. 6 (1) (b) GDPR.
• Optional details for the analysis: hourly rate, maximum on-site share. Legal basis: Art. 6 (1) (b) GDPR.
• Account and sign-in data: email address, name from the sign-in provider (e.g. Google or LinkedIn), Firebase user ID, subscribed plan. Legal basis: Art. 6 (1) (b) GDPR.
• Waiting list: if your profile is outside the currently supported field (IT), we store your email address to notify you (Art. 6 (1) (a) GDPR, consent). Deleted after 365 days at the latest.
• Results: verdicts, findings and history data for your profile, goals you save in the skill simulator (Pro; skill changes, simulated values and the later profile effect) as well as notifications we send you.

3. Anonymous upload before registration

You can upload your CV before you create an account. The CV is then linked only through a random session key in your browser. If you do not create an account, we automatically delete the anonymous CV after 7 days at the latest.

4. Recipients and service providers

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany; a data processing agreement is in place.
• Sign-in (Firebase Authentication): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Sign-in by email, Google or LinkedIn. Data is transferred to the USA based on the EU-US Data Privacy Framework or standard contractual clauses. We do not pass user data received via Firebase (email address, user ID) on to third parties and use it only for authentication.
• Sign-in with LinkedIn (optional): LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. We only receive the profile data needed for sign-in (name, email address).
• Account and subscription management: webconia GmbH operates the central platform that manages accounts and subscriptions. Email address, user ID, plan and billing status are processed there.
• Payments (Stripe): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter payment data directly with Stripe; we do not store card data. Legal basis: Art. 6 (1) (b) GDPR.
• AI processing (Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA): the text of your CV is sent to the AI model Claude to extract your profile and to word your verdict. Before that we remove the name line, contact details and address information as far as technically possible. Employer and client names in the body text may remain. Data is transferred to the USA based on standard contractual clauses. Processing serves the delivery of the analysis (Art. 6 (1) (b) GDPR). According to Anthropic, data submitted through the API is not used to train its models.
• Market data: the market analyses are based on publicly available project postings captured through the Nexus platform of webconia GmbH. We do not take over contact details from the postings.

5. Automated assessment

The verdict (market-fit score, findings, recommendations) is calculated automatically from your anonymised profile and the market data and worded with the help of an AI model. It serves your information only. There is no automated decision with legal effect or similarly significant effect concerning you (Art. 22 GDPR). We do not pass verdicts on to third parties, in particular not to clients or recruiters.

6. Cookies and local storage

We only use storage that is technically necessary and permitted without consent (Section 25 (2) no. 2 TDDDG, Art. 6 (1) (b) and (f) GDPR):

• Cookie fj_locale: stores your language choice.
• Your browser's local storage: session key for the anonymous CV upload and the sign-in state (Firebase Authentication).
• We do not use advertising, tracking or analytics cookies.

7. Retention

• Server log files: 14 days.
• Anonymous CV without an account: 7 days at most.
• Original CV file (upload): not stored if the analysis fails (temporary buffer for 24 hours at most). After a successful analysis it is deleted together with your CV (anonymous CV: 7 days at most; otherwise together with your account, immediately); a new upload replaces it. Backups are overwritten according to the periods that apply there.
• Profile photo from your CV: deleted together with your CV (anonymous CV: 7 days at most; otherwise with your account).
• Account, anonymised profile and verdicts: until your account is deleted.
• Goals saved in the skill simulator: until you delete them, at the latest with your account.
• Waiting list: 365 days at most.
• Invoicing and billing data: in line with statutory retention duties (Sections 257 HGB, 147 AO).

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7 (3)). You can have your data deleted at any time; account, profile, verdicts and related data are then removed completely. Please contact [email protected].

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

10. Security

Data between your browser and our servers is transmitted exclusively in encrypted form (TLS). Credentials and keys are stored in protected form on the server side. We continuously adapt our protective measures to the state of the art.

11. Changes

We update this privacy policy when services or the legal situation change. The version published here applies.