Privacy policy (Datenschutzerklärung)

1. Controller

Saeed Farahi Mohassel, iwanttowork.io, Vereinsstraße 6, 44793 Bochum, Germany. E-mail: [email protected]. We have not appointed a data protection officer and are not required to.

2. In short

• We use no tracking, no analytics and no advertising, and we do not sell personal data.
• We process your data to run your account, store your documents, make the generations you ask for and, if you subscribe, handle your subscription.
• The recipients outside our own servers are named below: our object storage provider, the AI provider, the payment provider, a network provider that forwards encrypted connections, and our e-mail provider.

3. Visiting the website and server logs

The website and our services run on servers we operate in Germany. Connections reach them through a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which forwards the encrypted connection without decrypting it; it sees your IP address only. To deliver pages and keep the service secure, our servers may record technical entries such as your IP address, the time, the address requested and errors. Legal basis: our legitimate interest in a working and secure service (Art. 6(1)(f) GDPR). The entries are kept only as long as needed for these purposes and are then deleted or overwritten.

4. Browser storage and cookies

The website keeps your sign-in in your browser's session storage (it ends when you close the browser), your light or dark choice and a dismissed language suggestion in local storage, the language you chose in a cookie, and unsaved editor drafts in the browser's database. Our sign-in service sets the cookies it needs to sign you in. All of these are strictly necessary for the service you ask for (§ 25(2) no. 2 TDDDG), so we do not ask for consent. We set no other cookies.

5. Your account

To create an account you give your e-mail address, your name and a password; the password is stored only in a form that cannot be read back. We send you an e-mail to confirm your address and, when you ask, to reset your password, through our e-mail provider. The sign-in service is operated by us. Legal basis: the contract with you (Art. 6(1)(b) GDPR). We keep the account until it is erased (section 11).

6. Your profile, documents and files

We store what you enter and create: your career profile, job positions and postings, CV templates, CVs and their versions, photos, exported PDFs and your AI preferences. Data is stored in our database on our servers in Germany; photos, PDFs and backups are stored with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in the European Union, on our behalf (Art. 28 GDPR). Legal basis: the contract with you (Art. 6(1)(b) GDPR). If you choose to include special categories of data in a CV (for example health or religion), we process them because you chose to (Art. 9(2)(a) GDPR). We keep this data until you delete it or your data is erased; backups are overwritten in their normal cycle.

7. AI generations

When you generate or tailor a CV, the parts of your profile and the job posting the AI needs are sent to an AI provider. Our service holds this content only while the generation runs. We keep a record of each generation, including its state, the number of AI calls and tokens and their cost.

• Pro: the content goes to Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, on our account and on our behalf (Art. 28 GDPR). The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where it applies, an adequacy decision (Art. 45 GDPR).
• Free: the content goes to the AI provider you chose, with your own key and under your own contract with that provider; that provider's processing is governed by its terms. Your key is stored encrypted, so that only the background service that runs your generations can read it; we show only its last four characters. It is deleted when you remove it in Settings or when your data is erased.

Legal basis: the contract with you (Art. 6(1)(b) GDPR).

8. Payments for Pro

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details on Stripe's page; we never receive your card or bank details. We give Stripe a reference to your account and your e-mail address, and we receive whether you subscribed, the state and end of the paid period, a customer number and the e-mail address used. Stripe also processes data as a controller in its own right, for example to prevent fraud and meet its legal duties; see stripe.com/privacy. Legal basis: the contract with you (Art. 6(1)(b) GDPR) and our legal duties (Art. 6(1)(c) GDPR). Payment records are kept for as long as tax and commercial law requires, up to ten years.

9. Cancellations

When you cancel a contract on our cancellation page, we process what you enter (type of cancellation, name, e-mail address, contract, date and reason) and send it to you and to us by e-mail. For protection against abuse your IP address is held briefly in memory and not stored. Legal basis: our legal duty to accept and confirm cancellations (§ 312k BGB, Art. 6(1)(c) GDPR). We keep the cancellation as long as we may need to prove it, usually until the end of the third year after the year it was received.

10. E-mail to us

When you write to us, we use your message and address to answer it. Legal basis: the contract with you or our legitimate interest in answering (Art. 6(1)(b) and (f) GDPR). We delete the message when it is settled, unless the law requires us to keep it.

11. Deleting your data

You can delete your documents and your AI key yourself at any time. To erase your account and all its data, write to [email protected]. We then erase your profile, documents, photos, PDFs, generation records, your saved key and our records of your subscription, and delete your sign-in account. Records we must keep by law, such as payment records, are kept until their period ends.

12. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interests (Art. 21). Where you gave consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Write to [email protected]. You also have the right to lodge a complaint with a supervisory authority (Art. 77), for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

13. Other information

You are not obliged to give us data, but without an account and your content we cannot provide the service. We do not make decisions about you based solely on automated processing (Art. 22 GDPR). We update this policy when our processing changes; the date at the top shows the current version.