Privacy Policy

1. Controller

The controller for data processing in connection with the JobBuddy website, the JobBuddy desktop application and the associated mobile application (together the "Service") is the operator named in the imprint at https://ionix.cc/imprint ("we"). The contact details provided there also apply to privacy inquiries.

2. Overview: Local Data Storage as the Guiding Principle

JobBuddy is designed as a locally operating application: your core data – imported job postings, CV data, documents, text fragments, cover letters and application management – is stored in a local database on your device and generally remains there.

Data is transmitted to us only to the extent required for individual features. Important: the AI features are the core function of the Service – content you provide for them (in particular your CV, uploaded documents and job posting texts) is transmitted to our servers and passed on to external AI providers, i.e. to third parties, in order to generate the results (Sections 6 and 12). All cases of transmission are described in Sections 5 to 10. We use no third-party advertising tracking or analytics services for marketing purposes, neither on the website nor in the app.

3. Website: Hosting and Server Logs

When you visit our website, the web server processes, for technical reasons, your IP address, the date and time of access, the requested resource, the referrer, and browser and operating system information (user agent). This data is required to deliver the website and to ensure stability and security.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website). Server logs are stored only for a short period and subsequently deleted, unless they are needed to investigate specific security incidents.

The website does not use cookies requiring consent and does not use tracking or analytics services.

4. App: Local Processing on Your Device

The content processed in the app – in particular job postings, CV data, uploaded documents, rating criteria, text fragments and cover letters – is stored locally on your device. We do not receive a copy of this data, except as described in Sections 5 to 10.

You can delete this data yourself at any time by removing the respective content in the app or by uninstalling the app.

To the extent you process personal data of third parties with the app (e.g. contact details of contact persons from job postings), you do so on your own responsibility. Where the app is used purely personally for your own job search, the exemption for purely personal or household activities (Art. 2(2)(c) GDPR) will regularly apply.

5. Account, Licensing and Installation Identifier

For the use of paid features (credits, subscriptions) we process account data, in particular your email address, license and subscription status, and your credit balance. A technical installation identifier (token) is used to authenticate the app to our servers.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The data is stored for the duration of the contractual relationship and beyond that to the extent statutory retention obligations (e.g. under commercial and tax law) so require.

6. AI Features: Transmission of Content to Us and to External AI Providers

When you use AI features (in particular the rating of job postings and the generation of cover letter drafts), the content required for this is transmitted to our servers. This may include, in particular: the text of the respective job posting, excerpts from your CV and documents, your text fragments and rating criteria, and your inputs and instructions.

To generate the AI results, we pass this content on to external AI providers (operators of large language models) acting as processors or sub-processors on our behalf. Currently, these are in particular OpenAI, Anthropic and OpenRouter (OpenRouter is an intermediary service that routes requests to the connected model operators, e.g. DeepSeek). These providers may process your content on servers outside the EU/EEA, in particular in the USA (see Section 12 for the safeguards). The specific providers used may change; the current version of this privacy policy is authoritative.

This content is processed exclusively to generate the respective result (e.g. rating or text draft) and return it to your app, and for abuse prevention and billing control. We do not use your content to train our own AI models.

For positively rated job postings, the app may additionally perform automated company research. In doing so, the company name and the location of the job posting are transmitted via our servers to an external AI provider with web search capability (currently Perplexity, connected via OpenRouter). To calculate travel times, the app also transmits — provided you have entered one or more home addresses in your job profile — your home address(es) (only in an obscured form to protect your privacy, in particular with a randomly altered house number and imprecise position) and the destination directly to OpenStreetMap services: the Nominatim geocoding service of the OpenStreetMap Foundation (United Kingdom) and the routing service of FOSSGIS e. V. (Germany). These services also receive your IP address; their own privacy policies apply. Providing your home address is voluntary; without it, no travel times are calculated.

Please only provide content via the AI features whose processing by external AI providers you agree to, and avoid particularly sensitive information (e.g. health data, information on religion or trade union membership) unless it is required for your application.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Transmitted content is stored only as long as necessary for providing the feature, abuse prevention and billing.

7. Payments (Stripe)

Purchases of credits and subscriptions are processed via the payment service provider Stripe (Stripe Payments Europe, Ltd., Ireland, or affiliated companies). In doing so, Stripe processes your payment and contact data (e.g. name, email address, payment method), in part under its own data protection responsibility. Information on this can be found in Stripe’s privacy policy (https://stripe.com/privacy).

We ourselves do not receive complete payment data, but essentially transaction references and status information.

The legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations).

8. Telemetry and Error Reports

To ensure stability and improve the Service, the app transmits technical telemetry data to us: error reports (error message, stack trace, affected feature, app version, operating system, installation identifier and technical context information), metrics on search runs (e.g. strategy used, portals addressed, number of AI requests, number of jobs found and imported, duration and status), and aggregated event counters.

The scope is technically limited (deduplication, per-session caps, batched transmission). The content of your documents is not part of the telemetry; however, error reports may in individual cases contain fragments of processed content where these form part of the error message.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, error-free and abuse-free operation). You may object to this processing in accordance with Art. 21 GDPR (contact details in the imprint).

9. Shared Job Profiles

When job postings are imported, the app may transmit metadata and content of the imported postings (in particular title, company, location, URL, source domain and description) to us. We store these job profiles, deduplicate them and may make them available to other users of the Service in order to enable an up-to-date shared job database.

Job postings may incidentally contain personal data (e.g. names and contact details of the contact persons named in the posting). This data originates from publicly accessible job postings and is processed exclusively in the context of the respective posting.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating a shared, up-to-date job database for the users of the Service). Data subjects may object to the processing and request deletion (contact details in the imprint); we will then remove the affected job profiles from the database.

10. Automatic Updates

The app automatically checks whether updates are available. For technical reasons, your IP address, the app version and platform information are transmitted to the update server in the process.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing up-to-date and secure software) or Art. 6(1)(b) GDPR to the extent updates are required for the performance of the contract.

11. Retention Periods

Unless stated otherwise above: server logs are deleted after a short period. We store account data for the duration of the contractual relationship plus statutory retention periods. Content transmitted for AI features is stored only for the duration of providing the feature and for a limited time for abuse prevention and billing control. Telemetry data is deleted or aggregated after a reasonable period. We store shared job profiles until they are deleted – for example following an objection or because they are outdated.

12. Recipients; Processors; Third-Country Transfers

We use service providers to deliver the Service, in particular hosting providers (for the website, server services and update delivery), the payment service provider Stripe (Section 7) and external AI providers for the AI features (Section 6; currently in particular OpenAI, Anthropic and OpenRouter). To the extent these service providers act as processors, they do so on the basis of contracts pursuant to Art. 28 GDPR.

To the extent data is transferred to countries outside the EU or the EEA in this context – for the external AI providers, such third-country transfers take place in particular to the USA – we ensure an adequate level of data protection through appropriate safeguards, in particular adequacy decisions of the EU Commission or EU standard contractual clauses (Art. 44 et seq. GDPR).

Data is disclosed to other third parties only if we are legally obliged to do so or if you have consented.

13. Your Rights

You have the following rights vis-à-vis us with regard to your personal data: the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

Right to object (Art. 21 GDPR): to the extent we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

You may withdraw any consent given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the supervisory authority at your habitual residence.

There is no statutory or contractual obligation to provide personal data; however, certain features (e.g. paid features requiring account data) cannot be used without certain data.

14. No Automated Decision-Making

The AI-assisted ratings and text drafts of the Service are mere aids for your own decision-making. We do not make any decisions concerning you that are based solely on automated processing and that produce legal effects or similarly significantly affect you (Art. 22 GDPR).

15. Data Security

Transmissions between the app or website and our servers are encrypted (TLS). We take state-of-the-art technical and organizational measures to protect your data against loss, misuse and unauthorized access, and we limit processing to what is necessary.

16. Changes to This Privacy Policy

We will update this privacy policy when the Service, the legal situation or our processing operations change. The current version is available on the website; the date of the current version can be found at the top of this policy.