We are pleased about your visit to our website www.talentaid.com and your interest in our company and our services. Despite careful control of content, we assume no liability for external links to third-party content, as we did not initiate the transmission of this information, select the recipient of the transmitted information, or select or modify the transmitted information itself. The protection of your personal data during its collection, processing, and use in connection with your visit to our website is very important to us and is carried out in accordance with the applicable statutory provisions, which you can review, for example, at www.bfdi.bund.de. Below, we explain which information we collect during your visit to our website and how it is used:

Collection and Storage of Personal Data as well as the Nature and Purpose of Their Use

a) When Visiting the WebsiteEach time a customer (or other visitor) accesses our website, information is automatically transmitted by the internet browser used on your device (computer, laptop, tablet, smartphone, etc.) to the server of our website. This information is temporarily stored in a so- called log file. The following data are collected automatically without any action on your part and stored until they are automatically deleted:- Pseudonymized) IP address of the requesting device, as well as device ID or individual device identifier and device type,- Name of the retrieved file and the amount of data transferred, as well as the date and time of access,- Notification of successful retrieval,- Requesting domain,- Description of the type of internet browser used and, where applicable, the operating system of your device as well as the name of your access provider,- Your browser history data as well as your standard weblog information,- Location data, including location data from your mobile device. Please note that on most mobile devices you can control or disable the use of location services in the settings menu of the device.Our legitimate interest pursuant to Art. 6(1) sentence 1 lit. f GDPR in collecting this data is based on the following purposes:- Ensuring a smooth connection setup and comfortable use of the website,- Evaluating system security and stability, and- Further administrative purposes.Under no circumstances do we use the collected data to draw conclusions about your identity. The above-mentioned data are deleted after you leave the website.b) When Using Our Contact FormIf you have questions of any kind, we offer you the opportunity to contact us via a form provided on the website. At a minimum, providing a valid email address and a message is required so that we can respond to your inquiry. Additional information may be provided voluntarily.Data processing for the purpose of contacting us is carried out pursuant to Art. 6(1) sentence 1 lit. a GDPR on the basis of your voluntarily given consent. The personal data collected by us for the use of the contact form are automatically deleted after your inquiry has been processed.To protect inquiries submitted via the internet form, we use the reCAPTCHA service provided by Google Inc. The query serves to distinguish whether the input is made by a human or abusively by automated, machine-based processing. The query includes the transmission of the IP address and, if applicable, other data required by Google for the reCAPTCHA service to Google. For this purpose, your input is transmitted to Google and further used there. However, your IP address is truncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases and with your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR is the full IP address transmitted to a Google server in the USA and truncated there. On our behalf, Google will use this information to evaluate your use of this service. The IP address transmitted by your browser as part of reCAPTCHA will not be merged with other data held by Google. Google’s differing data protection provisions apply to this data. Further information on Google’s privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/ The recipient of the collected data is Google. To the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. Google has certified itself in accordance with the requirements of the EU–US Data Privacy Framework: https://www.dataprivacyframework.gov/listc) User RegistrationIf you register as a user, this is done by providing the following data:- Data that personally identify you, such as your email address,- Your curriculum vitae (CV),- Information about your previous professional experience.Data processing for the purpose of registration is carried out pursuant to Art. 6(1) sentence 1 lit. a GDPR on the basis of your voluntarily given consent by means of the double opt-in procedure. The data will be deleted if you do not confirm your registration within XY days by clicking the corresponding button in the email sent to you. If confirmation is provided, your data will be deleted 60 days after termination of the contract, unless we are obliged to store them for a longer period pursuant to Art. 6(1) sentence 1 lit. c GDPR due to statutory retention and documentation obligations under commercial and tax law (in particular under the German Commercial Code (HGB), the German Criminal Code (StGB), or the German Fiscal Code (AO)), or unless you have consented to storage beyond this period pursuant to Art. 6(1) sentence 1 lit. a GDPR.d) Upon Conclusion of a Contractual RelationshipWhen concluding a contractual relationship via our website, we request the following personal data from you:- data that personally identifies you, such as name and email address, address and billing address,- your curriculum vitae (CV),- information about your previous professional experience,- if applicable, certificates and other documents,- information about your payment method,- the chat history if you use our chatbot to simulate a job interview,Further personal data that we are legally obliged or entitled to collect and process and that we require for your authentication, identification, or verification of the data collected by us. The aforementioned data are processed for the purpose of performing the contractual relationship. If an application is handled via our platform, your CV as well as other documents and information you have released for the application will be transmitted to the company advertising the position. Data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b GDPR. The storage period is limited to the purpose of the contract and, where applicable, statutory and contractual retention obligations. The personal data collected by us will be blocked for further use after termination of the contract. Your data will be deleted at the latest 60 days after termination of the contract, unless we are obliged to store them for a longer period pursuant to Art. 6(1) sentence 1 lit. c GDPR due to statutory retention and documentation obligations under tax and commercial law (in particular HGB, StGB, or AO), or unless you have consented to storage beyond this period pursuant to Art. 6(1) sentence 1 lit. a GDPR.e) Registration via a Single Sign-On ProcedureYou may register with us using your social media account by way of a single sign-on procedure instead of manually entering your data for registration or ordering. We have integrated the following plugins for registration:aa) GoogleIf you register using “Google” provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, we will receive—depending on the privacy settings you have configured with Google—the general and publicly accessible information stored in your profile. This includes your user ID, your name, and your email address. The processing of this data is based on your consent pursuant to Art. 6(1) Sentence 1, lit. a GDPR. The recipient of the collected data is Google. To the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. Google has certified itself in accordance with the requirements of the EU–US Data Privacy Framework: https://www.dataprivacyframework.gov/list Google’s privacy policy can be found here: https://policies.google.com/privacybb) LinkedInIf you register using “LinkedIn” provided by LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085, USA, we will receive—depending on the privacy settings you have configured with LinkedIn—the general and publicly accessible information stored in your profile. This includes your user ID, your name, and, where applicable, your profile picture, age, professional position, and gender. The processing of this data is based on your consent pursuant to Art. 6(1) Sentence 1, lit. a GDPR. The recipient of the collected data is LinkedIn. To the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. LinkedIn has certified itself in accordance with the requirements of the EU–US Data Privacy Framework: https://www.dataprivacyframework.gov/list LinkedIn’s privacy policy can be found here: https://de.linkedin.com/legal/privacy-policyf) Use of Payment Service ProvidersTo process your order, we also cooperate with the payment service provider(s) listed below. In the course of payment processing, we transmit your order data—strictly limited to what is necessary for payment processing—to the payment service provider selected by you, insofar as this is required to process the payment. The legal basis for the transfer of data in each case is Art. 6(1) sentence 1 lit. b GDPR.aa) Google PayIf you choose the payment method “Google Pay” provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment processing is carried out via the “Google Pay” application by charging a payment card stored in Google Pay or another verified payment system stored there (e.g. PayPal). For the purpose of payment processing, the information you provide during the ordering process, together with information about your order, is transmitted to Google. Google then transmits the payment information stored in Google Pay to the originating website in the form of a one-time transaction number, which is used to verify that a payment has been made. This transaction number does not contain any information about the actual payment data of the payment method stored in Google Pay; instead, it is generated and transmitted as a one- time valid numerical token. For all transactions via Google Pay, Google acts solely as an intermediary for processing the payment transaction. The execution of the transaction itself takes place exclusively in the relationship between the user and the originating website by charging the payment method stored in Google Pay. Information on the processing of your personal data by Google and on your rights can be found in Google’s privacy policy at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=debb) Apple PayIf you choose the payment method “Apple Pay” provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is carried out via the “Apple Pay” function of your device operated with iOS, watchOS, or macOS by charging a payment card stored in “Apple Pay”. For the purpose of payment processing, the information you provide during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then encrypts this data again using a developer-specific key before the data are transmitted to the payment service provider of the payment card stored in Apple Pay for the execution of the payment. Apple stores anonymized transaction data, in particular the purchase amount, the approximate date and time, and whether the transaction was completed successfully. Due to anonymization, any personal reference is completely excluded. Apple uses the anonymized data to improve “Apple Pay” and other Apple products and services. Further information on data protection with Apple Pay can be found at the following website:https://support.apple.com/de-de/HT203027cc) Amazon PayIf you select the payment method “Amazon Pay”, payment processing is carried out via the payment service provider Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg (hereinafter: “Amazon Payments”), to whom we transmit the information you provide during the ordering process together with information about your order. Your data are transmitted exclusively for the purpose of payment processing with the payment service provider Amazon Payments and only to the extent necessary for this purpose. Further information on the data protection provisions of Amazon Payments can be found here: https://pay.amazon.com/de/help/201751600.dd) STRIPEWe also use the services of Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, and Stripe, Inc., 354 Oyster Point Blvd. South, San Francisco, CA 94080, USA, for payment processing. By completing and submitting the registration form, various personal data are automatically transmitted to Stripe. The data transfer is carried out for the purpose of processing the payment. The recipient of the collected data is Stripe. To the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. Stripe has certified itself in accordance with the requirements of the EU–US Data PrivacyFramework: https://www.dataprivacyframework.gov/listThe provisions of Stripe apply to the acquisition and accompanying processing of data:https://stripe.com/de/privacyee) PayPalIf you select payment via “PayPal” (by credit card, direct debit, or invoice via PayPal), you will be redirected directly to the payment service provider PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) via an interface after confirmation of the conclusion of the contract. There you can enter your payment details, select the desired payment method offered by PayPal, and then complete the payment. Please note that PayPal’s privacy policy applies in this context. Information on the processing of your personal data by PayPal and on your rights can be found in PayPal’s Privacy Statement:https://www.paypal.com/de/webapps/mpp/ua/privacy-fullAs a precaution, we point out that if PayPal is to make advance payments, PayPal reserves the right, based on its legitimate interest in determining your creditworthiness (in each case Art. 6(1) sentence 1 lit. b GDPR), to carry out a credit check. For this purpose, PayPal may transmit your payment data to credit agencies. The result of the credit check with regard to the statistical probability of default may include probability values (so-called score values), which are calculated on the basis of scientifically recognized mathematical-statistical procedures and which, among other things, include address data. According to PayPal, your legitimate interests are taken into account in accordance with the statutory provisions. Further information, in particular regarding your rights, can be found in PayPal’s applicable privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-fullff) KlarnaTo process your order, we also cooperate with the online payment service provider Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden, postal address Germany: P.O. Box 900162, 90492 Nuremberg (hereinafter: “Klarna”). If you select the payment method “Invoice” and grant the required consent, various personal data are automatically transmitted to Klarna. The data transfer is carried out for the purpose of processing the payment as well as for identity and creditworthiness checks by Klarna. The legal basis is your consent (Art. 6(1) sentence 1 lit. a GDPR). The personal data transmitted to Klarna generally include first name, last name, address, date of birth, gender, email address, IP address, telephone number, mobile phone number, as well as other data required to process an invoice or installment purchase, in particular the transmission of payment information such as bank details, card number, expiration date, and CVC code. Klarna also discloses your data to affiliated companies (Klarna Group) and service providers or subcontractors insofar as this is necessary to fulfill contractual obligations or if the data are to be processed on behalf of Klarna. For the purpose of deciding on the establishment, performance, or termination of a contractual relationship, Klarna collects and uses data and information on your previous payment behavior as well as probability values for your future behavior (so-called scoring). The calculation of the scoring is carried out on the basis of scientifically recognized mathematical-statistical procedures. You have the option to revoke your consent to the handling of personal data at any time vis-à-vis Klarna. Details on data collection by Klarna can be found in Klarna’s privacy policy at:http://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacyg) Subscription to Our NewsletterIf you have expressly consented pursuant to Art. 6(1) sentence 1 lit. a GDPR by means of the double opt-in procedure, we will use your email address to send you our newsletter on a regular basis. You may unsubscribe at any time, for example via a link at the end of each newsletter.Alternatively, you may send your request to unsubscribe at any time by email to privacy@talentaid.com (preferably with the subject line: “Unsubscribe newsletter”). For sending the newsletter, we cooperate with the provider “MailChimp” (Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA). MailChimp is a service that can be used, among other things, to organize and analyze the distribution of newsletters. With the help of MailChimp, we can analyze our newsletter campaigns. When you open an email sent via MailChimp, a file contained in the email (a so-called web beacon) connects to MailChimp’s servers in the USA. This allows us to determine whether a newsletter message has been opened and which links, if any, were clicked. In addition, technical information is collected (e.g. time of access, IP address, browser type, and operating system). This information cannot be attributed by us to the respective newsletter recipient and is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better tailor future newsletters to the interests of recipients. If you do not wish your data to be analyzed by MailChimp, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in each newsletter message. Data processing is carried out on the basis of your consent (Art. 6(1) sentence 1 lit. a GDPR), which you may revoke at any time. The lawfulness of data processing operations already carried out remains unaffected by the revocation. The data you have provided to us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and the servers of MailChimp after you unsubscribe. Data that are stored by us for other purposes (e.g. email addresses for the members’ area) remain unaffected. Further details can be found in MailChimp’s privacy policy at: https://mailchimp.com/legal/terms/We have concluded a data processing agreement with MailChimp, under which we oblige MailChimp to protect our customers’ data and not to disclose them to third parties. The recipient of the collected data is MailChimp. To the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. MailChimp has certified itself in accordance with the requirements of the EU–US Data Privacy Framework: https://www.dataprivacyframework.gov/list

h) Job Match Email Notifications

If you have chosen to receive email notifications about new job matches, we use your email address to send you a summary of the job advertisements that match your profile. You choose how often you receive these notifications, and you can change that at any time in your account settings, including switching them off entirely.

We send these notifications on the basis of your consent (Art. 6(1) sentence 1 lit. a GDPR). You may withdraw your consent at any time, either in your account settings or by using the unsubscribe link included in every notification. Withdrawal does not affect the lawfulness of processing carried out before it.

We record which option you selected, the date and time of your choice, and the version of this privacy policy in force at that time, so that we can demonstrate the basis on which we send you these notifications.

For sending these notifications we work with the provider "Resend" (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), with whom we have concluded a data processing agreement.

Your selection is stored until you switch the notifications off or delete your account.

Buying credits and subscriptions

When you buy credits or a subscription on the Platform, the payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). When processing the payment, Stripe acts as our processor (Art. 28 GDPR); where Stripe processes payment data for its own purposes, such as fraud prevention and complying with its own legal obligations, Stripe is an independent controller. You enter your card details with Stripe; we never see your full card details. Stripe’s privacy information: https://stripe.com/privacy

We ourselves store:

the purchase: pack or plan, amount, currency, time and the identifiers Stripe assigns to it (Stripe IDs);
your credit account and the transactions on it;
your consent to the credits being provided immediately: the version and language of the text you agreed to, your shortened IP address, your browser identifier and the time.

Legal bases: Art. 6(1) lit. b GDPR (performance of the contract); Art. 6(1) lit. c GDPR in conjunction with § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB) (statutory retention obligations); for proof of your consent, Art. 6(1) lit. f GDPR (our legitimate interest in being able to prove it); to that extent, Art. 17(3) lit. e GDPR excludes a request for erasure.

Storage period: we keep the transactions on your credit account and the related purchase data for 10 years from the end of the calendar year in which they arose (§ 147(3) AO, § 257(4) HGB); after a request for erasure, Art. 17(3) lit. b GDPR is the basis for keeping them. After you delete your account, we keep them only without your name and email address (pseudonymised). We keep the IP address and browser identifier recorded with your consent until 31 December of the third year after the year of purchase; we then delete them.

Processing of Application Data for Training Purposes of an AI System

If you have given us your explicit consent, we process the personal data you provide for the purposes of training and improving our AI-based tool for simulating job interviews as well as our AI-based tool for creating and adapting application documents.This includes in particular:- Data from CVs uploaded by you,- Information about your previous professional activities, qualifications, and experience,- Content from other application documents submitted by you, and- All data and text entries that you enter when using the chatbot to simulate job interviews.Processing is carried out exclusively for the purpose of training, optimizing, and further developing the functionality, quality, and performance of the AI tool. Processing for other purposes does not take place. The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1, lit. a GDPR. You may revoke your consent at any time with effect for the future. The lawfulness of the processing carried out up to the time of revocation remains unaffected. After termination of the contractual relationship, the aforementioned data will initially be blocked for further processing. From that point onwards, no use for training or other purposes will take place. The data will be completely deleted no later than 60 days after termination of the contract, provided that no statutory retention obligations prevent deletion.

Google Meet

We use Google Meet (hereinafter “Google Meet”) to conduct video and audio conferences, webinars, and other types of video and audio meetings. Google Meet is a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter “Google”). When using Google Meet, data of the communication participants are processed and stored on Google’s servers insofar as they form part of communication processes with us. Such data may include, in particular, login and contact data, visual and audio contributions, as well as chat entries and shared screen content. If references are made to Google Meet in the course of communication, business, or other relationships with us, Google Meet may process usage data and metadata for security purposes, service optimization, or marketing purposes. The corresponding data processing is carried out on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. Further information on the processing of personal data by Google can be found here: https://policies.google.com/privacy?hl=de

Support assistant

On talentaid.com and in the TalentAid app you can ask our support assistant questions about TalentAid, for example about features, plans and prices, or your account. The assistant is an automated AI system, and the chat window says so. You can ask to write to a person at any time. Using the chat is voluntary: you can also email us at support@talentaid.com.

How the assistant answers

A classification model (Jev, from TypeSafe AI) reads each message you type and chooses one of the answers our team has written and approved. If no approved answer fits, a large language model (Claude Opus, from Anthropic) writes an answer using only a list of approved facts about TalentAid. We check that answer automatically before you see it and replace it with an offer to write to our team if it fails the check. For questions about your own career, the assistant gives a general reply and points you to TalentAid’s features; it does not give individual career advice. If a message suggests that you are in a personal crisis, the assistant replies with emergency contact numbers and offers to put you in touch with our team. The assistant only answers questions: it cannot change your account, your plan or your payments.

What we process

The messages you type. Before a message is stored or sent to any service provider, we replace email addresses, phone numbers, bank account numbers (IBAN), card numbers and pasted passwords or access keys with placeholders.
The assistant’s replies: for an approved answer, a reference to it; for an answer written by Claude Opus, its text.
A technical record of how each answer was chosen, without any message text (for example topic categories, probabilities and response times).
Whether you are signed in, whether you use the website or the app, your language and the page on which you use the chat; if you are signed in, your user ID.
If you started the chat from one of the assistant’s suggestions, which suggestion you chose; and your rating of an answer, if you give one.
If you are not signed in, a random code kept in your browser that shows that the conversation is yours when you rate an answer or write to our team. We store only a one-way coded (hashed) form of it.
To enforce usage limits and protect the chat against misuse, a coded form of your shortened IP address, kept only in short-lived counters.

A message that we refuse as meaningless (most often a pasted password or a random string of characters) and a message that suggests a personal crisis are never stored as text: we keep only the reason for the refusal and the technical record.

When you use the chat without being signed in, each message, each rating and each request to write to our team is checked with Google reCAPTCHA to tell people from automated programs. How reCAPTCHA works is described above in section “b) When Using Our Contact Form”.

Our logs, our error monitoring (Sentry) and our product analytics (PostHog) receive no message text. PostHog receives only events about the use of the chat, such as that a message was answered, its topic category and response times. The chat window is excluded from PostHog session recordings.

Service providers and transfers outside the EU

The assistant sends your message, with the placeholders described above, and up to four earlier turns of the conversation to two AI models. Both are reached through OpenRouter, Inc. (USA), which processes the data on our behalf. We send every request with OpenRouter’s setting that excludes providers which use the data for their own purposes (“data collection: deny”).

TypeSafe AI (USA) runs Jev, which reads every message you type. Jev is used only with zero data retention: neither your message nor the answer is kept after it has been processed. TypeSafe AI does not use them to train its model.
Anthropic PBC (USA) provides Claude Opus, which is used only when no approved answer fits. Unless we have switched on zero data retention for these requests, the provider that runs Claude Opus may keep the request and the answer under its own retention terms.

When you write to our team, Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) delivers the email. Our support mailbox and the internal chat space described below are part of Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google may process this data in the USA. Our hosting provider stores the conversations.

Transfers to OpenRouter, TypeSafe AI and Anthropic in the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR): those in OpenRouter’s data processing agreement, which also cover Anthropic as OpenRouter’s sub-processor, and those in TypeSafe AI’s data processing addendum. Transfers to Resend are based on the EU–US Data Privacy Framework (Art. 45 GDPR) and the Standard Contractual Clauses; transfers to Google are based on the EU–US Data Privacy Framework (Art. 45 GDPR).

Review of answers written by Claude Opus

Each time Claude Opus writes an answer, we keep a further-redacted copy of the question, the earlier turns and the answer, and post the question and the answer to an internal Google Chat space. There our team checks the answer and corrects or extends our approved answers. Before storing and posting, we remove further details: names, cities, phone numbers, the signed-in member’s own details, other sequences of numbers, web addresses, IP addresses and payment references. The copy contains no user ID. If you ask to write to our team, the space receives only a reference number, the topic and whether your message was sent, never your email address or your message.

The copy in our database is deleted with the conversation (see “How long we keep it” below). The posts in the Google Chat space are not removed by that deletion; they remain there until we delete them.

Writing to a person

If the assistant cannot help, or you ask to talk to a person, you can send our support team a message from the chat window. We email your message, the email address you give us for our reply and the conversation so far to support@talentaid.com through Resend, and our team replies to you by email. Before sending, we also remove card numbers, card security codes, bank account numbers, ID numbers, passwords, PINs and one-time codes from your message and from the conversation. Names, email addresses and phone numbers in your message are kept so that we can reply. The email contains no IP address, browser details, analytics identifiers or CV content, and its subject line contains no text you wrote. A message that suggested a personal crisis is not included.

How long we keep it

Conversations, the technical records, the review copies in our database and your requests to write to our team are deleted 90 days after the conversation’s last message, and at once when you delete your account. If you are signed in, your conversations and your requests to our team are included in your data export.
While a conversation is in progress, its last four turns are also held in a temporary store for up to two hours.
The email you send to our team is kept in our support mailbox for three years after our last exchange with you. Resend keeps a log of the email, including its content, for the period set by its own retention terms.
Posts in the internal Google Chat space: see “Review of answers written by Claude Opus” above.

A conversation you have without signing in is not linked to an account, and we cannot find it by your name or email address. We therefore cannot delete it on request before the 90 days have passed.

Legal bases

Answering your questions in the chat, enforcing usage limits and passing your message to our team: if you are signed in, Art. 6(1) sentence 1 lit. b GDPR (support for the service we provide under your contract); otherwise Art. 6(1) sentence 1 lit. f GDPR, our legitimate interest in answering enquiries that you start.
Reviewing answers written by Claude Opus: Art. 6(1) sentence 1 lit. f GDPR, our legitimate interest in the accuracy and safety of the answers we give.
Help when you come back (below): your consent, Section 25(1) TDDDG for storing and reading the information in your browser and Art. 6(1) sentence 1 lit. a GDPR for using it.

Help when you come back (only with your consent)

If you allow the “Support assistant” category in our cookie settings, your browser keeps a list for 30 days of the types of our pages you visited (for example “pricing” or “CV check”, never the full web address), the day of each visit without the time, a few steps you took (the result of a free CV check, whether you opened or completed checkout, and whether you finished or skipped setting up your account), and which help messages the assistant has already shown you. The assistant uses this list to offer help when you come back, at most once a day. The list stays in your browser (ta_sc_visits, ta_sc_prompts) and is never sent to us: if you start a chat from one of these offers, we learn only which offer and which suggestion you chose. talentaid.com and app.talentaid.com each keep their own list; in the app it is linked to a coded form of the account signed in on that browser. The category is off until you turn it on; choosing “Accept all” in the cookie banner also turns it on. Details are in our Cookie Policy.

Withdrawing consent and objecting

You can withdraw your consent to help when you come back at any time: on talentaid.com with “Cookie settings” at the bottom of the page or on our Cookie Policy page, and in the app under Settings → Privacy & Cookies. The list is then deleted from your browser straight away on the site where you made the change, and on our other site the next time you open it. Withdrawal does not affect processing that took place before it.
Where we rely on our legitimate interest (Art. 6(1) sentence 1 lit. f GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR) by email to privacy@talentaid.com.
If you are signed in, deleting your account deletes your conversations and your requests to our team at once. Emails already in our support mailbox are kept as described above.
You do not have to use the chat. You can contact us by email at support@talentaid.com instead.

Recording of Communication

If the user has given corresponding consent, we record communication with the user. In addition to the storage of audio and/or visual communication, the following data are stored:- User details such as name and email address,- Chat history,- Audio and video data,- Meeting metadata such as IP address and device information.The storage and processing of the data serve training purposes and are carried out on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. We use these data for internal training purposes of our employees. After the end of the communication, the aforementioned data will be stored for 90 days. Thereafter, they will be automatically deleted.

Disclosure of Personal Data

Your data will not be transferred to third parties for purposes other than those listed below. We will only disclose your data to third parties if:- You have given your explicit consent thereto (Art. 6(1) sentence 1 lit. a GDPR),- The disclosure is necessary for the performance of contractual relationships with you (Art. 6(1) sentence 1 lit. b GDPR),- There is a legal obligation to disclose the data (Art. 6(1) sentence 1 lit. c GDPR), or- The disclosure is necessary for the assertion, exercise, or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non- disclosure of your data (Art. 6(1) sentence 1 lit. f GDPR).In these cases, however, the scope of the data transferred is limited to the minimum necessary. Unsere Datenschutzbestimmungen stehen im Einklang mit den geltenden datenschutzrechtlichen Bestimmungen und die Daten werden nur in der Bundesrepublik Deutschland verarbeitet. Wir arbeiten aber auch mit Drittanbietern zusammen, die die Daten außerhalb der EU verarbeiten können. Alle Drittanbieter, mit denen wir zusammenarbeiten, sind in unserer Datenschutzerklärung aufgeführt.

To process payments when you buy credits or subscriptions, we transfer data to Stripe Payments Europe, Ltd. (Art. 6(1) sentence 1 lit. b GDPR); details are set out in the section “Buying credits and subscriptions”.

Location estimation during onboarding

If you complete onboarding without providing a work location and your CV does not contain one, we estimate your country from a shortened form of your IP address (the last part is removed first) so that your first job search shows roles from your region. The shortened address cannot be traced back to you, is used once for this purpose, and is not stored. You can change your job-search location at any time in your profile, after which no IP-based estimation takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a usable initial job search).

Data Subject Rights

Upon request, we will be happy to inform you whether and which personal data relating to you are stored by us (Art. 15 GDPR), in particular regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint, the origin of your data if they were not collected from you, as well as the existence of automated decision-making, including profiling. You also have the right to have inaccurate personal data corrected or incomplete data completed (Art. 16 GDPR). Furthermore, you have the right to request the restriction of the processing of your data, provided that the statutory requirements are met (Art. 18 GDPR). You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format or to request their transmission to another controller (Art. 20 GDPR). In addition, you have the so-called “right to be forgotten,” i.e., you may request the erasure of your personal data, provided that the statutory requirements are met (Art. 17 GDPR). Irrespective of this, your booking and billing data will be automatically deleted by us if the purpose of data collection has ceased to apply or if the data processing was unlawful. Pursuant to Art. 7(3) GDPR, you have the right to revoke any consent you have given to us at any time. This means that we may no longer continue the data processing that was based on this consent in the future. You also have the right to object at any time to the processing of your personal data, provided that a right of objection is provided for by law. In the event of a justified objection, your personal data will also be automatically deleted by us (Art. 21 GDPR).If you wish to exercise your right of revocation or objection, simply send an email to:privacy@talentaid.com.In the event of violations of data protection regulations, you have the right pursuant to Art. 77 GDPR to lodge a complaint with the competent supervisory authority. The competent supervisory authority is both the State Commissioner for Data Protection of Hesse (https://datenschutz.hessen.de/) and any other supervisory authority.

Duration of Data Storage

The collected data are stored by us for as long as this is necessary for the performance of the contracts concluded with us or until you have exercised your right to erasure or your right to data portability to another company.

Cookies

We use cookies on our website. These are small text files that your browser automatically creates and that are stored on your device when you visit our website. The cookie stores information that arises in connection with the specific device used. However, this does not mean that we obtain direct knowledge of your identity. These cookies are set either as so-called first-party cookies (“own cookies”) or third-party cookies. First-party cookies are set by the website you are currently visiting and are not accessible across domains by browsers. A third-party cookie, by contrast, is set by a third party, i.e., not by the actual website you are currently visiting. Cookies are also divided into technically necessary and technically non-necessary cookies. On our website, both technically necessary and technically non-necessary cookies are set in accordance with the following provisions.a) Technically Necessary CookiesTechnically necessary cookies are essential for the operation of our website and, for example, ensure that certain functions are available to you at all. These technically necessary cookies, which are required and set only for the individual necessary online session, are automatically deleted after you leave our website. The legal basis for the use of these technically necessary cookies is Art. 6(1) sentence 1 lit. f GDPR and Section 25(2) TDDDG.b) Technically Non-Necessary CookiesProvided that you have given the corresponding consent, we use so-called technically non-necessary cookies on our website. Technically non-necessary cookies primarily serve to analyze website usage and user behavior, to compile reports on visitor activities on the website, and to provide further services related to the use of the website. The technically non-necessary cookies used by us are explained in our cookie banner with regard to their functionality, duration, and possible third-party recipients of the data. If certain third-party providers used by us set cookies in the course of the services they provide to us, this is additionally specifically indicated in our privacy policy. The legal basis for the use of technically non-necessary cookies is Art. 6(1) sentence 1 lit. a GDPR, provided that you have given your consent. You may revoke your consent at any time. You also have the option at any time to configure the setting of cookies. For example, you can set your browser to inform you in advance about the setting of cookies or to completely refuse cookies. When providing our online services, Java applets and JavaScript are used. If, for security reasons, you do not wish to make use of these auxiliary programs or active content, you should deactivate the corresponding settings in your browser.

. Online-Marketing/ Analysis Measures

By means of statistical recording through online marketing measures, we aim to design our website in line with demand and to continuously adapt it to you as our user and optimize its use. Unless otherwise stated below, the online marketing and tracking measures used by us areimplemented on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR.a) Google ToolsWe use various tools from Google on our website. To the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. Google has certified itself in accordance with the requirements of the EU–USData Privacy Framework: https://www.dataprivacyframework.gov/listaa) Google AnalyticsProvided that you have given your consent, Google Analytics, a web analytics service of Google Ireland Limited (“Google”), is used on this website. The use includes the operating mode “Universal Analytics”; this makes it possible to assign data, sessions, and interactions across multiple devices to a pseudonymous user ID and thus analyze a user’s activities across devices. Google Analytics uses so-called “cookies,” text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie aboutyour use of this website is usually transmitted to a Google server in the USA and stored there. If IP anonymization is activated on this website, however, your IP address will betruncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area beforehand. We would like to point out that Google Analytics has been extended on this website to include IP anonymization in order to ensure the anonymized collection of IP addresses (so-called IP masking). The IP address transmitted by your browser within the scope of Google Analytics will not be mergedwith other data held by Google. Further information on terms of use and data protection can be found at:https://www.google.com/analytics/terms/de.html and https://policies.google.com/?hl=deGoogle will use this information on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity, and to provide further services related to website and internet usage to the website operator.The data sent by us and linked to cookies, user identifiers (e.g., user ID), or advertising IDs are automatically deleted after 14 months. Data whose retention period has been reached are deleted automatically once a month.You may revoke your consent at any time with effect for the future by preventing the storage of cookies via the corresponding settings in your browser software; however, we point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of the data generated by the cookie relating to your use of the website (including your IP address) and the processing of this data by Google bydownloading and installing the browser add-on. Opt-out cookies prevent the future collection of your data when visiting this website. In order to prevent tracking by Universal Analytics across different devices, you must carry out the opt-out on all systems you use. If you clickhere (https://tools.google.com/dlpage/gaoptout?hl=de), the opt-out cookie will be set to deactivate Google Analytics.bb) Google Tag ManagerThis website uses Google Tag Manager. Google Tag Manager makes it possible to manage website tags via an interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool triggers other tags, which may in turn collect data. Google Tag Manager does not access these data. If deactivation has been performed at the domain or cookie level, this will remain in effect for all tracking tags implemented via Google Tag Manager. Further information on Google Tag Manager can be found at: https://www.google.com/intl/de/tagmanager/use-policy.html

cc) Google Ads (conversion tracking and remarketing)

Provided that you have given your consent (cookie banner category "Marketing"), we use Google Ads, an online advertising service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), on talentaid.com and app.talentaid.com. The Google tag, loaded through Google Tag Manager, stores and reads cookies and similar identifiers on your device (for example _gcl_au on talentaid.com and advertising cookies on Google domains such as doubleclick.net) for two purposes:

Conversion tracking: when you reach our website through one of our ads and then sign up, start a free trial or buy a plan, Google tells us that an ad led to that action. When you sign up we may send Google a hashed (SHA-256) version of your email address so that the action can be matched (enhanced conversions). When you confirm your account, start a free trial or pay for a subscription, our server sends Google the ad click identifier (gclid) saved when you arrived through the ad, together with the type of action, an internal reference and, for subscriptions, its value.
Remarketing: Google adds your browser to a list of people who visited our websites, so that we can show you TalentAid ads on other websites and apps in the Google Display Network. We exclude people who have used the signed-in areas of our app from these ads.

The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR and Section 25(1) TDDDG. Without your consent, Google Consent Mode keeps these signals set to denied, no advertising cookies are set and our server sends Google nothing. Your browser stays on a remarketing list for at most 540 days after your last visit; Google's conversion cookies expire after at most 90 days. Data may be transferred to the USA on the basis of the adequacy decision described above (EU-US Data Privacy Framework). You can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer of our website or in the settings of the app. Further information: https://policies.google.com/privacy and https://business.safety.google/privacy/

dd) Google WorkspaceWe use Google Workspace for email communication on our website, provided by Google LLC (formerly known as Google Inc.), 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. In this context, your email address is processed in particular. Further information on Google Workspace can be found here: https://workspace.google.com/intl/de/

b) LinkedIn Insight Tag

Provided that you have given your consent (cookie banner category "Marketing"), we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland ("LinkedIn"). The tag sets cookies (for example li_gc, bcookie and lidc on linkedin.com) and tells LinkedIn which of our pages you visit, so that we can measure our ads on LinkedIn (conversion tracking) and show our ads on LinkedIn to people who have visited our website (retargeting). The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR and Section 25(1) TDDDG. Data may be transferred to LinkedIn Corporation in the USA, which is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via "Cookie settings". Further information: https://www.linkedin.com/legal/privacy-policy

c) CloudflareTo protect our website, we use the Cloudflare service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare operates a Content Delivery Network (CDN) and provides protection functions for the website (Web Application Firewall). For this purpose, the data transfer between the requesting browser and our servers is decrypted by Cloudflare in order to prevent attacks on our software such as so-calledDistributed Denial-of-Service (DDoS) attacks. The legal basis is the safeguarding of legitimate interests, namely the prevention of attacks on our website pursuant to Art. 6(1) sentence 1 lit. f GDPR. Further information on Cloudflare’s privacy policy can be found here:https://www.cloudflare.com/privacypolicyTo the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. Cloudflare has certified itself in accordance with the requirements of the EU–US Data Privacy Framework:https://www.dataprivacyframework.gov/list

11. Sentry

We use the Sentry service on this website. Sentry is a service provided by Sentry, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States. Sentry is used to monitor the stability and technical security of our website, in particular to detect, analyze, and remedy errors (error and performance monitoring). For this purpose, technical information about the device used, the browser, the operating system, the time of access, and, if applicable, your IP address are processed. Processing is carried out to ensure the functionality and security of our website. The legal basis for the processing is your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR. Further information on the processing of your data by Sentry can be found in the provider’s privacy policy at: https://sentry.io/privacy/To the extent that your data are transferred to the USA, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR. This adequacy decision was adopted on the basis of the EU–US Data Privacy Framework. Sentry has certified itself in accordance with the requirements of the EU–US Data Privacy Framework: https://www.dataprivacyframework.gov/list

12. Use of YouTube

Videos are embedded on our website via YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The videos are stored on www.youtube.com and can be played directly from our website. Our website thus enables you to connect to YouTube. Normally, when accessing a website with embedded videos, your IP address is already transmitted to YouTube and cookies are installed on your computer. However, we have embedded the YouTube videos on our website using “enhanced privacy mode.” This enhanced privacy mode is provided by YouTube itself and ensures that initially no cookies are stored on your device. When accessing the relevant website, however, even in “enhanced privacy mode,” a connection is established to the “DoubleClick” network of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and your IP address is transmitted. In particular, this communicates that you have visited our website. However, this data cannot be specifically attributed to you unless you are logged into YouTube or another Google service before accessing the website or are still logged in. As soon as you start playing an embedded video by clicking on it, YouTube—via enhanced privacy mode—stores only cookies on your device that do not contain personally identifiable data, unless you are currently logged into a Google service. These cookies can be prevented by appropriate browser settings and extensions. We have neither knowledge of nor influence on the possible collection and use of your data by YouTube. Further information can be found in YouTube’s privacy policy at: https://policies.google.com/privacy?hl=de&gl=de The recipient of the collected data is YouTube. To the extent that your data are transferred to the USA, this is done on the basis of your consent pursuant to Art. 49(1) sentence 1 lit. a GDPR. Furthermore, the parent company of YouTube LLC, Google LLC, has obtained certification under the EU–U.S. Data Privacy Framework: https://www.dataprivacyframework.gov/list.

13. Social Media

We do not use social media plugins of social networks on our website, because such social media plugins normally result in every visitor to the website being immediately recorded by these services with their IP address. This means that all further activities on the internet are logged—even if you do not click any of the buttons. We have therefore only included links to our presence on the social networks listed below. Please note that data of visitors to our website may also be processed outside the European Union. This may pose risks for users, for example because the enforcement of users’ rights may be made more difficult.Furthermore, it is possible that user data may be processed by third-party providers for market research and advertising purposes. For example, user profiles may be created from user behavior and the resulting interests. The user profiles may in turn be used, for example, to display advertisements within and outside social networks that presumably correspond to the users’ interests. For these purposes, cookies are generally stored on users’ computers in which user behavior and users’ interests are stored. Furthermore, data may also be stored in the user profiles independently of the devices used by users (in particular if users are members of the respective social network and are logged in).For a detailed description of the respective processing operations, we refer you to the information provided by the respective providers via the links below. In the case of requests for information or the assertion of your rights as a data subject, we also point out that these can be asserted most effectively with the social networks. Only they have access to their users’ data and can take appropriate measures and provide information directly. If you nevertheless require assistance, you may contact us. We use links on our website to the social networks listed below:Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), privacy policy: https://www.facebook.com/about/privacy/Opt-out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com X (X Corp., 865 FM 1209 Building 2, Bastrop, TX 78602, USA), privacy policy: https://x.com/de/privacyOpt-out: https://twitter.com/personalization Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), data policy / opt-out: http://instagram.com/about/legal/privacy/LinkedIn (LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA), privacy policy: https://www.linkedin.com/legal/privacy-policy

14. Data Security

We make every effort to implement all necessary technical and organizational security measures in order to store your personal data in such a way that they are neither accessible to third parties nor to the public. If you wish to contact us by email, we would like to point out that the confidentiality of the information transmitted cannot be fully guaranteed via this communication channel. We therefore recommend that you send confidential information to us exclusively by post.

15. Currency and Amendments to This Privacy Policy

This privacy policy is currently valid and is dated 27 October 2026. Due to the further development of our website and the offers provided via it, or due to amended statutory or regulatory requirements, it may become necessary to amend this privacy policy.

16. Name and Contact Details of the Controller

This privacy information applies to data processing by:TalentAid AG,Kölner Straße 1,65760 Eschborn(“Controller”).