Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Overview: which data we process

FreelancerJury checks how well your freelancer profile fits the market. For this we process the following data:

• Access data (server log files): IP address, date and time, page requested, browser. Purpose: secure and stable operation (Art. 6(1)(f) GDPR). Deleted after 14 days.
• Your CV: You upload it as a PDF or DOCX. We read the text and remove contact details, links, addresses, dates of birth, lines with personal-data labels (e.g. "Name:") and the name line in the header before the text goes to the AI (section 5). The profile we store and analyse contains only anonymised data (roles, skills, project periods, industries, seniority); names and client names are additionally removed based on the AI's output. The automatic clean-up is not technically flawless; individual names or details in running text may remain undetected. Legal basis: Art. 6(1)(b) GDPR (performing the analysis you requested).
• Original CV file: After a successful analysis we store your uploaded file (PDF or DOCX) so that you do not have to upload it again for CV tailoring and export. It contains personal data (e.g. name and contact details), is kept on our server separately from the profile, is used only for that purpose, is never passed on to the AI or to third parties and is not served publicly. We store the file per uploaded CV version together with its file name (which often contains your name) and the detected profile photo so that you can find earlier CV versions. We keep the first original, the five most recent uploads and the one of the current version; older files and photos are deleted automatically. Legal basis: Art. 6(1)(b) GDPR.
• Profile photo from the CV: If your PDF contains a portrait photo, we detect it on our server (without AI and without passing it on to third parties), shrink it and show it to you next to your verdict. It is stored separately from the profile, served only to you and deleted with your CV or account. Legal basis: Art. 6(1)(b) GDPR.
• CV tailoring (Pro): Drafts with anonymised profile texts and your answers to follow-up questions, as well as export files (Word or PDF) that contain the name and contact details from your original file. If you paste the text of a job posting, we do not store the text, only a checksum and the requirements detected from it. Legal basis: Art. 6(1)(b) GDPR.
• Voluntary analysis inputs: hourly rate, maximum on-site share. Legal basis: Art. 6(1)(b) GDPR.
• Account and sign-in data: email address, name from the sign-in service (e.g. Google or LinkedIn), Firebase user ID, plan. Legal basis: Art. 6(1)(b) GDPR.
• Payment and subscription data (Pro): plan, status and term of the subscription, invoices and payment status (section 7). Legal basis: Art. 6(1)(b) and (c) GDPR.
• Waitlist: If your profile lies outside the currently supported field (IT), we store your email address to inform you (Art. 6(1)(a) GDPR, consent). Deleted after 365 days at the latest.
• Results: verdicts, findings and history data for your profile, goals you save in the Skill Simulator (Pro; skill changes, simulated values and the later effect on your profile) and notifications we send you.

3. Anonymous upload before registration

You can upload your CV before creating an account. The CV is then linked only through a random session key in your browser. If you do not create an account, we automatically delete the anonymous CV after 7 days at the latest.

4. Recipients and service providers

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany; a data processing agreement is in place.
• Network and delivery (Cloudflare): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (EU representative: Cloudflare Germany GmbH). For technical reasons Cloudflare processes the IP address and request data to forward and accelerate requests and to protect against attacks. Legal basis: Art. 6(1)(f) GDPR (secure and fast operation). Transfer to the USA is based on the EU-US Data Privacy Framework or standard contractual clauses.
• Sign-in (Firebase Authentication): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Sign-in by email, Google or LinkedIn. Data is transferred to the USA based on the EU-US Data Privacy Framework or standard contractual clauses. We do not pass user data received via Firebase (email address, user ID) on to third parties and use it solely for authentication.
• Sign-in with LinkedIn (optional): LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. We receive only the profile data required for sign-in (name, email address).
• Account and subscription management: webconia GmbH operates the central platform through which accounts and subscriptions are managed. Processed there are email address, user ID, plan, subscription and billing status and invoice data.
• Payment processing (Stripe): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter payment data directly with Stripe; we do not store card data. Stripe processes it as an independent controller or on our behalf under Stripe's terms; this may involve a transfer to the USA. Legal basis: Art. 6(1)(b) GDPR.
• AI processing (Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA): see section 5.
• Market data: The market analyses are based on publicly available project postings captured through the Nexus platform of webconia GmbH. We do not take over contact details from the postings.

5. Use of AI (Anthropic)

For several features we use the AI model Claude from Anthropic PBC (USA). The purpose is to provide the features you request (Art. 6(1)(b) GDPR) and to maintain the market data (Art. 6(1)(f) GDPR). Anthropic acts as a processor on our instructions. We base the transfer to the USA on standard contractual clauses. According to Anthropic, it does not use data submitted via the API to train its models.

• CV analysis: What is sent is the text read from your CV after we have removed contact details, links, addresses, dates of birth, lines with personal-data labels and the name line in the header. Employer and client names as well as names in running text may be contained in the text sent, because they are needed for extraction; they are removed from the stored profile only afterwards. The original file and the profile photo are not sent.
• CV tailoring (Pro): What is sent are the anonymised profile texts, skill names, the requirements of the market or the posting, your chosen positioning and your answers to follow-up questions (in each case without contact details and links). If you paste a job posting, its text (without contact details and links) is sent for analysis and is not stored by us. Never sent are the name, contact details, original file, photo and client names from your profile.
• Verdict texts: To phrase your verdict we send only calculated figures, skill names and the type of findings, no CV text.
• Market data and skill pages: To analyse public postings and to generate the texts on the skill pages, we send titles (cleaned), category, skill names and in part the description text of public postings, as well as skill names, type, category and relationships in the skill catalogue. No personal, account or CV data is sent. To maintain the skill catalogue, individual skill labels (technical terms) from CVs and postings may be sent without any link to you personally.
• Limits: The automatic clean-up cannot detect every piece of personal information. Please do not upload documents containing special categories of personal data (e.g. health data) and remove such information beforehand.

6. Automated assessment

The verdict (market-fit score, findings, recommendations) is calculated automatically from your anonymised profile and the market data and phrased with the help of an AI model. It serves solely your information. No automated decision with legal effect or similarly significant impact on you is made (Art. 22 GDPR). We do not pass verdicts on to third parties, in particular not to clients or recruiters.

7. Payment, trial and subscription

The Pro subscription is billed monthly through Stripe; processing and management of the subscription run through the platform of webconia GmbH. Processed are plan, status, start, term and end of the subscription, invoice data (name or company and address, to the extent you provide them, amount, date) and payment status; we do not receive card data. If a free trial is offered, the same applies to it. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations). We retain invoice and accounting data for 10 years because of statutory retention obligations (Section 257 HGB, Section 147 AO); they are exempt from deletion (Art. 17(3)(b) GDPR). If a payment fails, your account moves to the Free plan.

8. Account deletion and retention after termination

• Account deletion by you: You can delete your account yourself at any time in the "Account" area. A running subscription is ended in the process; afterwards we delete your account, your CV (profile, original file, photo), verdicts, history, goals, tailoring drafts and related data, as well as a waitlist entry with your email address.
• What remains: Invoice and accounting data from paid subscriptions remain because of the statutory retention obligation (10 years) and are used only for that purpose. Backups are overwritten according to the periods applicable there.
• Pro data after the subscription ends: When your Pro subscription ends, your Pro data (e.g. history, goals, tailoring drafts, base CV versions) remain stored, locked, for 12 months. They cannot be used during that time. The purpose is that you can pick up where you left off if you subscribe again (Art. 6(1)(f) GDPR). After that we delete them. You can have them deleted earlier at any time by deleting your account (section 8); the purpose then lapses and the data is deleted.

9. Cookies and local storage

We use only technically necessary storage items that are permitted without consent (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). We set no cookies of our own. The language follows the address of the page (/en for English); there is no language cookie.

• Local storage of your browser: session key for the anonymous CV upload (fj_session_token), the most recently selected organisation (freelancerjury.activeTenantId) and the sign-in state of Firebase Authentication.
• Payment page: When you are redirected to Stripe Checkout, Stripe sets technically necessary cookies on its own site for fraud prevention and payment processing.
• We do not use advertising, tracking or analytics cookies and do not use analytics services.

10. Retention

• Server log files: 14 days.
• Anonymous CV without an account: 7 days at most.
• Original CV file (upload): If the analysis fails, it is not stored (temporary storage 24 hours at most). After a successful analysis it is deleted with your CV (anonymous CV: 7 days at most; otherwise with your account, then immediately); older files (including file name and photo) are deleted automatically, we keep the first original, the five most recent uploads and the one of the current version. Backups are overwritten according to the periods applicable there.
• Earlier CV versions: For every CV version we store the profile (skills, projects, anonymized texts, your details) so that you can view your CV history, compare versions and restore earlier versions. For each CV we keep the latest 50 versions; older versions are deleted automatically, while the related verdicts and the history stay. You can delete the original file of a version yourself at any time in the CV history.
• Profile photo from the CV: deleted with your CV (anonymous CV: 7 days at most; otherwise with your account).
• CV tailoring: drafts 30 days at most; export files (Word/PDF) 24 hours at most; pasted job posting texts are not stored.
• Account, anonymised profile and verdicts: until your account is deleted.
• Saved goals in the Skill Simulator: until you delete them, at the latest with your account.
• Pro data after the subscription ends: locked for 12 months, then deleted; at your request earlier at any time through account deletion.
• Waitlist: 365 days at most.
• Invoice and accounting data: 10 years in line with statutory retention obligations (Section 257 HGB, Section 147 AO).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent given at any time with effect for the future (Art. 7(3)). You can delete your account and your data yourself at any time in the "Account" area; for all other requests contact [email protected]. Statutory retention obligations (section 8) remain unaffected.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

13. Security

Transmission between your browser and our servers is exclusively encrypted (TLS). Credentials and keys are stored in protected form on the server side. We continuously adapt our protective measures to the state of the art.

14. Changes

We will adapt this privacy policy when services or the legal situation change. The version published here at the relevant time applies.