Privacy

What Career Sentinel does with your data, in plain language first and legal detail after. Auf Deutsch →

The short version

Your CV file is never stored. We read it once, keep the details we extracted, and discard the file itself.
A photo only if you add one yourself. It is optional, it never goes to Anthropic, and you can delete it any time. Details in section 3.
Your CV content goes to Anthropic in the USA to be read and to write your documents. Everything we store sits on servers in the EU. Details in sections 4 and 7.
No advertising, no selling, no sharing with employers. We never send anything to a company on your behalf. You always press send yourself.
Nobody trains an AI on your CV. Anthropic does not use data sent through its API for training.
One click deletes everything. Settings, "Delete my account and all data". No email, no waiting.
Only cookies you need to sign in: one for the app. If you sign in with Google or LinkedIn for the free CV check, two more, one for a day and one for ten minutes. No analytics, no tracking, no consent banner.

1. Who is responsible

Maher Chehab
Schönestraße 23
70372 Stuttgart-Bad Cannstatt, Germany
Email: hallo@careersentinel.de

No data protection officer is appointed. Career Sentinel is run by one person and does not meet the thresholds in Art. 37 GDPR / § 38 BDSG.

2. Your account

What: your email address, the time you signed up, and a session cookie.

Why: to give you an account and keep you logged in. There is no password. You get a one-time link by email that works for 15 minutes, and the session then lasts 30 days.

Legal basis: Art. 6(1)(b) GDPR, performance of a contract (providing the service you asked for).

The cookie is strictly necessary under § 25(2) TDDDG, so it needs no consent banner. It holds a signed reference to your account and nothing else. We set no other cookies. The one exception is the free CV check: if you sign in there with Google or LinkedIn, it sets two short cookies (section 3b).

3. Your CV and the answers you give

The file itself is never stored. You upload a PDF, we read the text out of it, and the file is gone. We keep only the structured details: your professional headline, years of experience, roles, skills, languages, education and work history, and the contact email found in the CV.

We also keep the answers you give us: your German level, your city, whether you are looking for a career role or income work, your answer about your right to work in Germany if you give one, and anything you write in the "in your own words" box.

About your right-to-work answer: it touches on your residence status, so it is optional and "prefer not to say" is always fine. We use it for one thing: judging whether a job is realistically open to you, for example a 25 hour a week job on a Chancenkarte. We don't use it to write your CV or cover letters.

Why: to restructure your CV for the German market, to score job postings against your actual situation, and to write application documents for specific jobs.

Legal basis: Art. 6(1)(b) GDPR. This is the service.

Your photo, only if you add one. On your CV page you can add a photo to go on your downloaded CV. We do not take it from your CV file. We turn it into a passport-size picture (35 x 45 mm) and throw away the original and its hidden data, like where and when it was taken. We keep that one small picture, on our servers in the EU, and use it for nothing except putting it on your CV when the box "Put my photo on my CV downloads" is ticked. It is never sent to Anthropic or anyone else.

Legal basis: your consent, Art. 6(1)(a) GDPR, which you give by adding the photo. You can withdraw it at any time with "Delete my photo" on your CV page. Unticking the box keeps the photo off your CVs but keeps it saved.

3b. The free CV check, paid for with your email address

The deal: the check is free. In return, you agree that we email you when Career Sentinel launches and now and then after that. We say this in the box right above the "Agree" buttons, before you send anything. If you don't want that, don't use the check; nothing else on this site depends on it. You can unsubscribe at any time with one click. Unsubscribing also deletes your saved findings and your waitlist entry.

Your CV file: we read its text in memory, run it against fixed rules and throw the file away. We never store it. No AI is involved, so nothing goes to Anthropic or any other AI service.

Your email address and the findings: we send the findings to the address you enter, through Brevo (see section 6), behind a link. We keep the findings (the list of points, not your CV, though a point can quote a line from it, such as your phone number) for 7 days so that link can show them, then delete them. Pressing the button behind the link confirms the address is yours. Only then do we add you to the waitlist, together with a record of what you agreed to and when you confirmed it. Without that click you are on no list, and your address goes with the findings after 7 days.

Or sign in with Google or LinkedIn: if you press "Agree and continue with Google" or "with LinkedIn", you sign in there. Google (Google Ireland Limited) or LinkedIn (LinkedIn Ireland Unlimited Company) then tells us your email address and that they have verified it. We keep only the address, never your name, photo or anything else they send. Because they verified the address, it counts as confirmed. So we add you to the waitlist at that moment, with the same record of what you agreed to, and you see your findings straight away, without an email. Two cookies are involved. cs_check keeps you signed in to the check for one day and holds your address. cs_oauth lasts ten minutes, while you sign in at Google or LinkedIn, and holds the provider, your page language and random values for the sign-in. Both are signed so they cannot be changed, and both are strictly necessary for the check to work (§ 25(2) TDDDG). What Google or LinkedIn themselves record about your sign-in is under their own privacy policies.

What else we keep: a count that a check happened, with the score, how many findings it had, the file type and the page language. To stop the page being flooded, a one-way hash of your IP address and of your email address, made with a secret key. Without that key neither can be turned back. The hashes are deleted after about a week, and drop out of our backups within two weeks after that. Like on every page, the server log briefly holds your IP address (see section 7).

Legal basis: for the emails about Career Sentinel, your consent, Art. 6(1)(a) GDPR, given in exchange for the free check and withdrawable at any time (Art. 7(3)). For running the check and sending you its findings, Art. 6(1)(b) GDPR. For the hashed addresses, Art. 6(1)(f) GDPR, our legitimate interest in protecting the service from abuse.

4. AI processing, and the transfer to the USA

This is the part worth reading properly.

Career Sentinel uses Anthropic PBC (USA) to read your CV, to score job postings against your profile, and to write your tailored CV and cover letters. Doing that means your CV content and your answers are sent to Anthropic's servers in the United States.

This is a third-country transfer under Art. 44 ff. GDPR. The safeguard is the Standard Contractual Clauses (Module Two, controller to processor), which form part of Anthropic's Data Processing Addendum. The USA does not have an adequacy decision that covers this on its own, so the SCCs are what the transfer rests on.

Anthropic does not use data sent through its API to train models. That is different from the consumer Claude product.

Legal basis: Art. 6(1)(b) GDPR, with Art. 46(2)(c) for the transfer.

If you are not comfortable with your CV leaving the EU, Career Sentinel is not usable without it. There is no version of this service that does not send your CV to an AI model.

5. Scores and why they are not decisions about you

Every morning we score job postings against your profile and keep the score and the one-line reason for it. We also record which jobs you opened and what you marked as applied, interviewing or rejected, so your tracker works.

These scores are about job postings, not about you. No score decides anything. Nothing is sent to an employer, no application is submitted, and nobody but you sees the result. You decide what to apply for and you press send yourself.

Because of that, this is not automated decision-making with legal or similarly significant effect under Art. 22 GDPR. If you think a score is wrong, tell us, and you can hide any match.

Legal basis: Art. 6(1)(b) GDPR.

6. Where your morning report goes

Email (the default). Sent via Brevo (Sendinblue GmbH / Brevo SAS, EU), which processes your email address and the message. Brevo rewrites links in the message for click tracking, which means Brevo can see which jobs you clicked. We cannot switch that off on our plan. Links we send you by email carry a sign-in token that expires after 48 hours, deliberately short for this reason. (The CV check link works for 7 days. It only shows your findings and does not log you in.)

Telegram (optional). If you connect it, we store your Telegram chat ID and send the report there instead. That means Telegram (Telegram FZ-LLC) processes the message. You can disconnect at any time in Settings or by sending /stop to the bot.

Legal basis: Art. 6(1)(b) for email; Art. 6(1)(a) consent for Telegram, withdrawable at any time.

7. Hosting

Career Sentinel runs on Railway (Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA). The machines it runs on, and the database holding your profile, your matches and your documents, are in Railway's EU West region in Amsterdam, Netherlands. Your data sits in the EU.

Railway is a US company, so its staff can in principle reach that infrastructure from outside the EU for support and maintenance. Where that happens it is a third-country transfer under Art. 44 ff. GDPR, and the safeguard is the Standard Contractual Clauses (Module Two, controller to processor) in Railway's data processing terms. Railway is certified to SOC 2 Type II.

Legal basis: Art. 6(1)(b) GDPR for the hosting, with Art. 46(2)(c) for any such access.

Backups. Every night a copy of the database is sent to a Hetzner Storage Box in Falkenstein, Germany (Hetzner Online GmbH), so that a failure at Railway cannot take your data with it. Hetzner processes it in the EU only, under a data processing agreement, and never leaves the EU for this.

That copy is encrypted before it leaves our server, with a key only we hold. Hetzner cannot read it, and neither can anyone who reaches the storage. Copies older than 14 days are deleted automatically.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in being able to restore the service, which is also your interest in not losing your job search.

Server logs (IP address, time, requested page) are kept to keep the service running and secure, on the basis of Art. 6(1)(f) GDPR, our legitimate interest in operating a working and reasonably secure service. We can see them for 7 days. Our host Railway may keep them longer under its own rules.

8. Counting how the product performs

We record things like "a scan ran", "a document was generated", "a score threshold was changed". These records are deliberately content-free. They contain no CV text, no job titles, no company names, no email addresses.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in knowing whether the product works. You can object under Art. 21.

9. The research consent, which is genuinely optional

During the beta we ask whether we may look at your matches and the documents written for you, so we can judge whether the scoring is any good, and email you once or twice to ask what was wrong with it.

This is optional and the product is identical either way. Saying no costs you nothing and unlocks nothing. You can change it in Settings at any time and it stops immediately.

Legal basis: Art. 6(1)(a) GDPR. Withdrawal does not affect processing that already happened (Art. 7(3)).

9b. The launch notification

If you reach the app before you are invited, we offer to tell you once when it opens to everyone. Only if you press that button do we store your email address and the time. Nothing else, no questions.

Against abuse, here and on the waitlist form: we count sign-ups per visitor using a one-way hash of your IP address, made with a secret key. Without that key it cannot be turned back into your address. The hash is deleted after about a week, and drops out of our backups within two weeks after that.

One email, at launch. Not a newsletter, never passed to anyone. Every email has a one-click link to remove yourself, with no account and no questions asked.

Legal basis: Art. 6(1)(a) GDPR, consent, withdrawable at any time (Art. 7(3)). For the hashed address, Art. 6(1)(f) GDPR, our legitimate interest in protecting the service from abuse.

9c. If you tell us what to fix

There is a box on your matches page for saying what is wrong with the product. Only what you type goes anywhere, together with your account, so we know who to answer. Nothing is collected unless you press the button.

Maher reads them. They are not shown to other users, never published, and never passed to anyone. They are deleted with your account.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in fixing a product you are testing. You can object at any time (Art. 21) and the simplest way is not to use the box.

10. How long we keep things

Your uploaded file: not kept at all.
Your account and profile: until you delete them.
Your photo, if you added one: until you delete it, or your account. Our encrypted backups (section 7) drop it within 14 days after that.
Scores, application history, generated documents: until you delete your account.
Anything you send through the feedback box: until you delete your account.
Dormant accounts: if you do not use Career Sentinel for 12 months, we delete the account and everything in it.
CV check findings: 7 days after the check, together with the email address if you never pressed the button behind the link.
Waitlist signups: 12 months after you sign up, we delete your waitlist entry. A beta invitation you have not used 12 months after we sent it goes too. If you joined, your account follows the rules above.
Email correspondence: deleted when no longer needed; anything about a data-protection request is kept for 3 years so we can show we handled it.

Deleting: Settings, "Delete my account and all data". It removes your account, profile, photo, every score and reason, your application history, anything you sent through the feedback box and every document we generated. It is immediate and cannot be undone.

11. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where we rely on consent, you can withdraw it at any time (Art. 7(3)).

Email hallo@careersentinel.de and we will answer within a month. For erasure you do not need to ask, the button does it.

You can also complain to a supervisory authority (Art. 77). Ours is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

12. Changes

Career Sentinel is in beta and changes often. If we change how we handle your data in a way that matters, we will tell you by email rather than quietly editing this page.

Last updated: 4 November 2026.