This is a convenience translation. The legally binding version is the German original at /datenschutz. In case of any discrepancy, the German version prevails.

Privacy policy

Last updated: 15 September 2026 · Version 1.0

This privacy policy applies to the websites job-steward.com and app.job-steward.com and to the "JobSteward" service offered through them.

1. Controller

The controller within the meaning of Art. 4 Nr. 7 DSGVO (GDPR) is:

Tim Straub
Mainzer Landstraße 385
60326 Frankfurt am Main
Deutschland

Email: support@job-steward.com

At present, no data protection officer is appointed. Please send all data protection enquiries to the email address above.

2. What JobSteward is, and what that means for your data

JobSteward is a tool with which you organise your own job search: you create roles, companies, contacts, tasks and notes, and you can upload documents such as CVs. On the paid plan you can additionally connect an AI assistant of your own choosing (e.g. Claude or ChatGPT) to your account, which can then read and edit your data.

This gives rise to three groups of data subjects, which we deal with separately in this policy:

1. Visitors to the website (section 4)
2. Users with an account (sections 5 to 9)
3. Third parties whose data is entered by users – in particular contacts and recruiters (section 10)

3. Principles

We process personal data only in so far as this is necessary to provide a functioning service and our content and services. We do not sell data. We do not use advertising networks, tracking pixels or cross-device recognition. There is no automated decision-making, including profiling, within the meaning of Art. 22 DSGVO.

4. Visiting the website

4.1 Server log files

When you access our pages, your browser automatically transmits information which is stored in log files:

• shortened IP address
• date and time of the request
• address requested (URL) and HTTP status code
• volume of data transferred
• referrer (the page visited before)
• browser type and operating system

Purpose and legal basis: delivery of the website, ensuring system security and stability, and investigating and averting misuse. The legal basis is Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is the secure and trouble-free operation of our service (cf. recital 49 GDPR).

Storage period: 7 days. Data is kept longer only in the event of a specific, documented security incident, and only for as long as that incident lasts.

4.2 Usage measurement with Umami

We measure the use of our pages with Umami, analytics software that we run ourselves on our own server in the European Union. No data is transmitted to third parties.

Umami sets no cookies and stores no information on your device. Nor does it read out device characteristics (e.g. screen resolution). The only things recorded are details that your browser transmits with every request anyway: the page requested, the referring page, browser and operating system type, and the country determined from the IP address. The IP address itself is not stored; it is used only transiently to form a day-specific, non-reversible hash value that makes it possible to count repeat visits and that becomes invalid after 24 hours.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is to understand which content is used and whether our service is working. Consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is not required, because neither is information stored on your device nor is information stored there read out.

Storage period: individual page views (raw data) 90 days; thereafter only aggregated statistics without any personal reference remain, and these for 12 months.

4.3 Cookies and similar technologies

We use only technically necessary cookies. We therefore do not need a consent banner (§ 25 Abs. 2 Nr. 2 TDDDG). You will find a complete list in our Cookie notice.

In overview:

The Clerk cookies are only set once you sign in or open the app – not when you merely visit our public pages.

5. Account and sign-in

5.1 Registration and sign-in

To use JobSteward you need an account. We process your email address, a password chosen by you (stored exclusively as a cryptographic hash value at our sign-in service provider) or alternatively your Google identifier, plus sign-in and security metadata (times of sign-ins, IP address at the time of sign-in, browser used).

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of the user contract, including on the free plan) and Art. 6 Abs. 1 lit. f DSGVO for the security metadata (protection against unauthorised access).

Necessity: providing an email address is necessary for the conclusion of the contract. Without it we cannot provide an account.

5.2 Signing in via Google

You can choose to sign in with a Google account. The sign-in process starts only once you click the "Sign in with Google" button – before that, no Google code is loaded and there is no connection to Google.

If you choose this route, you are redirected to Google. Google then transmits to us your email address, the verification status of that address, your name and your profile picture, in so far as one is stored. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO. For the processing within your Google account, Google is an independent controller; Google's privacy policy applies (https://policies.google.com/privacy).

5.3 Sign-in service provider Clerk (transfer to the USA)

The technical handling of registration, sign-in, password resets and session management is carried out for us as a processor by

Clerk, Inc., 660 4th St #312, San Francisco, CA 94107, USA

In the course of this, your email address, your sign-in identifiers, the password hash value and session and security metadata are transferred to and stored in the United States of America. We have a data processing agreement with Clerk under Art. 28 DSGVO.

The transfer takes place on the basis of the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795). Clerk, Inc. is certified under the EU-U.S. Data Privacy Framework; you can view the certification at https://www.dataprivacyframework.gov/list.

In addition, and for the case that this adequacy decision is repealed or declared invalid, we have agreed with Clerk, Inc. the European Commission's Standard Contractual Clauses under Art. 46 Abs. 2 lit. c DSGVO (Implementing Decision (EU) 2021/914, Module 2 – controller to processor). You can obtain a copy of these safeguards on request at support@job-steward.com and at https://clerk.com/legal/dpa.

We point out that in the USA access by state authorities to personal data for national security purposes cannot be entirely ruled out, and that you may not have the same legal remedies available there as in the European Union.

6. Content you create in JobSteward

6.1 Your profile and pipeline data

In your account you can create and store: details about you and your professional profile (name, role, career level, location, notes, preferences), roles and applications with status and history, companies, tasks with deadlines, links, and freely worded notes.

Purpose: provision of the service we owe under the contract.
Legal basis: Art. 6 Abs. 1 lit. b DSGVO.
Storage period: for the duration of your account, thereafter in accordance with section 12.

Necessity: providing this content is required neither by law nor by contract. Without it you can use the service only to a limited extent; you suffer no disadvantage beyond that. The same applies to uploaded files and to entries about contacts.

6.2 Uploaded documents

You can upload documents, typically CVs, cover letters, references and screenshots.

Purpose: provision of the service we owe under the contract.
Legal basis: Art. 6 Abs. 1 lit. b DSGVO.

Important note on special categories of personal data.
Application documents frequently contain information that is specially protected under Art. 9 DSGVO – for example a photograph, details about health or severe disability, religious affiliation, trade union membership or origin.

In so far as you upload such information, we process it exclusively on the basis of your explicit consent under Art. 9 Abs. 2 lit. a DSGVO, which you give separately the first time you upload a file. You can withdraw this consent at any time with effect for the future, by deleting the files concerned or by contacting us at support@job-steward.com. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

We do not analyse the content of your files, do not search it and do not build profiles from it.

Storage location: in the Cloudflare R2 object storage with the storage region restricted to the European Union.

6.3 Who can access your data

Your content is assigned exclusively to your account and cannot be viewed by other users. The separation is enforced technically at two levels (access restriction in the application and security rules at database level).

We ourselves access your content only where this is indispensable for fixing an error, where you ask us to, or where we are legally obliged to do so.

7. Connecting an AI assistant (optional feature)

This feature is switched off by default and is not available on the free plan.

You can optionally connect your account to an AI assistant of your choice – for example Claude by Anthropic or ChatGPT by OpenAI. You establish the connection yourself; we merely provide the interface.

7.1 What happens when you do

When you establish the connection and use your assistant, the data from your account that you have released is transmitted to the provider of that assistant. You determine which types of data these are through the permissions you grant when connecting. The permissions for contact details and for file contents are switched off by default and must be expressly activated by you in addition.

7.2 Recipients

For users in the European Economic Area, the recipients are as a rule:

• Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Irland — https://www.anthropic.com/legal/privacy
• OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Irland — https://openai.com/policies/eu-privacy-policy/

If you connect a different assistant, its provider is the recipient.

These providers are independent controllers within the meaning of Art. 4 Nr. 7 DSGVO for the further processing. We have no influence over whether and how they process the transmitted data further, in particular whether they use it to train AI models; this depends on your contract and your settings with the respective provider. Please check these settings before you release sensitive content.

7.3 Legal basis

The legal basis for the transmission of your own data is your consent under Art. 6 Abs. 1 lit. a DSGVO, which you give on a separate screen when establishing the connection and can withdraw at any time with effect for the future.

In so far as contact details of third parties are also transmitted, we rely on Art. 6 Abs. 1 lit. f DSGVO; see section 10 on this.

7.4 Disconnecting and keeping track

You can disconnect at any time under Settings → Agent. Access is then immediately invalidated on the server side. In the same view you can see which connected assistant accessed which data and when.

Data already transmitted to the provider cannot be recalled by us. For that, please contact the respective provider directly.

8. Purchase and payment via Paddle

We handle the distribution and billing of our paid subscriptions through

Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, Vereinigtes Königreich

("Paddle"). Paddle acts as our authorised reseller and merchant of record and thereby becomes your contractual partner for the purchase.

In this respect Paddle is, in data protection terms, an independent controller within the meaning of Art. 4 Nr. 7 DSGVO (GDPR) and not our processor. Paddle collects and processes the data you enter during the order process — in particular name, address, email address, payment details, tax information and purchase history — on its own responsibility and for its own purposes, among other things for payment processing, fraud prevention, invoicing and meeting tax obligations. Paddle's privacy policy applies to this processing: https://www.paddle.com/legal/privacy

Paddle then transmits to us the data necessary to perform the contract, in particular name, email address, country, customer and subscription identifiers, and the status and term of the subscription. We process this data in order to provide you with access to the paid features and to manage your subscription. We do not receive complete payment details such as card numbers.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of the user contract concluded with us) and Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in correct access and subscription management). For the retention of our own records under tax law, Art. 6 Abs. 1 lit. c DSGVO in conjunction with § 147 AO (German Fiscal Code) applies.

Transfer to the United Kingdom. Paddle is established in the United Kingdom. The transfer is based on the European Commission's adequacy decision for the United Kingdom, which was renewed on 19 December 2025 and applies until 27 December 2031 (Art. 45 DSGVO). In addition, we have concluded an agreement with Paddle on the transfer of data between independent controllers (Paddle Data Sharing Addendum). Paddle decides on its own responsibility about any onward transfers to companies outside the United Kingdom; we have no influence over this.

9. Further processing

9.1 Error monitoring (Sentry)

To detect and fix technical errors we use Sentry (Functional Software, Inc.). We use exclusively the EU region (Germany) of this service; the data does not leave the European Union. There is a data processing agreement under Art. 28 DSGVO.

What is transmitted is technical information about the error: error message and program trace, address requested, browser and device type, time, and a pseudonymous internal identifier for your account. We have switched off the transmission of personal details; the contents of your notes and files as well as sign-in and session information are filtered out and not transmitted. Sentry's AI-assisted analysis features are disabled.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is a stable, secure service that functions in accordance with the contract.
Storage period: 30 days.

9.2 Security and access logs

We log sign-in attempts, the issuing and revocation of access, and accesses by connected AI assistants separately.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO in conjunction with Art. 32 DSGVO (security of processing); at the same time these logs serve your own ability to keep track.
Storage period: 90 days.

9.3 Support communication

If you write to us at support@job-steward.com, we process your message and your contact details in order to answer your enquiry. The address is forwarded to a private mailbox via Cloudflare Email Routing.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO for contract-related enquiries, otherwise Art. 6 Abs. 1 lit. f DSGVO (answering enquiries).
Storage period: up to 12 months; correspondence relevant under commercial or tax law 6 years; in the event of a dispute, until the limitation period expires.

9.4 Newsletter and waiting list

Where we offer a newsletter or a waiting list, sign-up takes place exclusively by double opt-in: after signing up you receive an email with a confirmation link, and only once you have followed it do we add you. The time of sign-up, the time of confirmation and the IP address are logged as evidence.

Legal basis: Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 7 Abs. 2 Nr. 2 UWG (German Act against Unfair Competition); for the logging, Art. 6 Abs. 1 lit. f DSGVO (ability to evidence consent).
You can unsubscribe at any time via the link in every email.

9.5 Operational emails

Messages that form part of the performance of the contract – such as confirmations, invoices, notices about the end of your trial period, security-relevant communications and material changes to this policy – we send on the basis of Art. 6 Abs. 1 lit. b DSGVO. You cannot unsubscribe from these messages for as long as your account exists.

10. Third-party data entered by users

Users can store in their account details about people who are not themselves users – in particular names, business email addresses and telephone numbers, positions, and notes of conversations with contacts at companies they are applying to.

Controller, purpose, legal basis. We are the controller for the storage and technical processing of this data. The purpose is the provision of the service we owe under the contract. The legal basis is Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is to enable our users to organise their application processes. We safeguard the interests of the contacts concerned by the fact that only business contact details may be involved, that the data cannot be viewed by other users, and that there is no enrichment from external sources, no merging across accounts, no profiling and no passing on for advertising purposes.

Categories of data subjects: contacts at companies, recruiters.

Information under Art. 14 DSGVO. Individually notifying these people is impossible for us, or possible only with disproportionate effort (Art. 14 Abs. 5 lit. b DSGVO), since we hold no verified contact details and getting in touch solely for this purpose would itself constitute a separate, unsolicited act of processing. As a safeguard, we make the information under Art. 14 DSGVO available publicly and without a sign-in at:

https://job-steward.com/datenschutz-ansprechpartner

Users' obligations. Under our terms and conditions, our users are obliged to store only such third-party data as they are entitled to process, and to limit it to business contact details. They are themselves responsible for their own processing, in so far as it does not fall under Art. 2 Abs. 2 lit. c DSGVO.

Rights. Contacts concerned can exercise their rights under Art. 15 to 22 DSGVO as against us at support@job-steward.com. We will then search across accounts for the contact detail provided.

11. Processors and recipients

We use carefully selected service providers and have concluded contracts under Art. 28 DSGVO with all processors. You will find an always up-to-date, complete list with registered office, task and place of processing on our page:

Sub-processors

Paddle is not a processor but an independent controller (section 8); there is therefore no data processing agreement with Paddle, nor is one envisaged.

Beyond this, we pass on personal data only where you have consented, where we are legally obliged to do so, or where this is necessary to establish, exercise or defend legal claims.

12. Storage periods and deletion

On the recovery period: after an account deletion we keep your data in a blocked state for up to 30 days, so that an accidental deletion can be reversed. The legal basis is Art. 6 Abs. 1 lit. f DSGVO. You can request immediate final deletion if you wish.

On backups: deleted data may still be contained in backups for a short time. We maintain a deletion list which ensures that deleted data does not find its way back into live operation after a restore.

On billing data: we cannot delete accounting records when an account is deleted. We block them under Art. 18 DSGVO against any further use and delete them only once the statutory retention period has expired (Art. 17 Abs. 3 lit. b DSGVO). Paddle is an independent controller for the purchase and invoice data stored at Paddle; you must request deletion there directly from Paddle.

13. Your rights

You have the following rights as against us:

• Access to the data processed about you (Art. 15 DSGVO)
• Rectification of inaccurate data (Art. 16 DSGVO)
• Erasure (Art. 17 DSGVO)
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO) – in the app under Settings → Data a complete export in machine-readable JSON format, including your files, is available to you at any time
• Withdrawal of consent (Art. 7 Abs. 3 DSGVO) with effect for the future; the lawfulness of the processing carried out up to that point remains unaffected
• Complaint to a supervisory authority (Art. 77 DSGVO)

We answer requests without undue delay, and at the latest within one month (Art. 12 Abs. 3 DSGVO).

Right to object under Art. 21 DSGVO

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6 Abs. 1 lit. f DSGVO.

If you object, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

Send your objection informally to support@job-steward.com.

Competent supervisory authority

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden
https://datenschutz.hessen.de

(The competent authority is that of the federal state in which we have our registered office. You may also contact the supervisory authority of your habitual residence or place of work.)

14. Security

We take technical and organisational measures under Art. 32 DSGVO, in particular: transport encryption (TLS) for all connections, encrypted storage of passwords and access keys, strict separation of user accounts in the application and additionally at database level, rate limiting for connected assistants, encrypted backups, and access to the production systems exclusively via secured connections.

15. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 DSGVO. JobSteward does not assess you, does not produce suitability forecasts and does not transmit any data to employers.

16. Minors

JobSteward is aimed at people who have reached the age of 18. We do not knowingly collect data from minors. If we become aware that an account has been created by a minor, we delete it.

17. Changes to this privacy policy

We adapt this policy when our service or the legal situation changes. You will always find the current version on this page. In the event of material changes we will additionally inform you by email to the address stored in your account before the change takes effect.