Privacy policy

In accordance with Art. 13 and 14 DSGVO we inform you here about the processing of your personal data.

1. Controller

FS Labs - Digital Solutions & Consulting
Owner: Florian Stadler
Dr.-Otto-Bössner-Weg 1, 85521 Ottobrunn
E-mail: kontakt@jobvance.me

2. Data collected and purposes of processing

2.1 Account data

Data: First and last name, e-mail address, postal code (optional), city (optional), phone number (optional), profile picture (optional, e.g. taken over from Google/LinkedIn). If you sign in via Google or LinkedIn, we additionally receive the provider identifier you authorised us to see and the e-mail address confirmed by that provider.
Purpose: Account creation, sign-in via magic link or via Google/LinkedIn login, communication regarding your account.
Legal basis: Art. 6 para. 1 lit. b DSGVO (performance of contract).
Retention period: Until deletion of your account. Upon account deletion, your name, contact details, and profile picture are immediately anonymised (see section 4 for details).

Magic-link sign-in: When you request a login, a single-use, short-lived sign-in link (token) is generated, sent by e-mail, and automatically invalidated after use or after a few minutes. Legal basis: Art. 6 para. 1 lit. b DSGVO. For session management after successful sign-in, see section 6 (Cookies).

2.2 Payment data

Data: Payment status, purchased package, amount, currency, Stripe session ID, Stripe payment intent ID, the e-mail address you provide at checkout. Your consent to the loss of the right of withdrawal (§ 356 para. 4 BGB, see our terms) is recorded as a note in the metadata of the Stripe checkout session. Credit card or bank details are processed exclusively by Stripe and never pass through our own servers.
Purpose: Processing the purchase and managing your application quota.
Legal basis: Art. 6 para. 1 lit. b DSGVO.
Retention period: Purchase records are retained pursuant to § 257 HGB / § 147 AO for the statutory retention period (generally 10 years) — even after account deletion, see section 4.

2.3 CV and application data

Data:

• Base CV (your CV's core data: work experience, education, skills, etc.) stored as a structured record in our database.
• Uploaded/pasted CV raw text (e.g. from a file or a LinkedIn export) used to automatically pre-fill your CV.
• Job postings you save for an application.
• Company research results about your target employer.
• Tailored CVs, cover letters, and interview-preparation content (questions, STAR answers, your saved story collection) generated within an application project.

Purpose: Providing the AI-assisted application support. To generate and analyse text (e.g. CV tailoring, cover-letter generation, interview questions, research summaries), the relevant text content is transmitted to our AI gateway provider, EUrouter (see section 3 for details and the legal basis for this transfer).
Legal basis: Art. 6 para. 1 lit. b DSGVO.
Retention period:

• Base CV: for as long as your account exists; deletable on request by e-mailing kontakt@jobvance.me.
• Application projects (job posting, research, tailored CV, cover letter, interview preparation): for as long as the project is not deleted; you can archive a project at any time. Upon account deletion, all application projects are automatically and irrevocably removed (section 4).

2.4 Media (photo, signature, attachments)

Data: An optional application photo, an optional digital signature, and attachments you upload (e.g. references/certificates) for your application documents. These files are stored in a private object store (Vercel Blob, Frankfurt/fra1 region); we only persist internal storage keys, never publicly accessible URLs. When a document is generated, the file is fetched server-side and embedded directly into the document — your browser never fetches it from an external address.
Purpose: Inclusion in generated application documents (CV, cover letter).
Legal basis: Art. 6 para. 1 lit. b DSGVO.
Retention period: For as long as your account exists; upon account deletion, your photo, signature, and all attachments are irrevocably deleted (section 4).

2.5 Exported documents (PDF/DOCX)

Data: Exports you request (CV, cover letter, full package) as PDF or DOCX.
Purpose: Providing your application documents for download.
Legal basis: Art. 6 para. 1 lit. b DSGVO.
Retention period: The documents themselves are not stored — they are regenerated from your current data on every request and streamed directly to you for download. We only keep a history entry (file name, generation timestamp, page count, technical check notes) in your export history; this is deleted together with the associated application project.

2.6 Usage data / logs

Data: On every sign-in, your IP address and browser identifier (user agent) are recorded in the session record (abuse detection, session security). In addition, our hosting provider Vercel produces server-side access and error logs (e.g. IP address, timestamps, endpoints accessed) as part of standard hosting-platform logging.
Purpose: Operation, security, and fault diagnosis.
Legal basis: Art. 6 para. 1 lit. f DSGVO (legitimate interest in secure operation).
Retention period: Session data until the session expires or is revoked; hosting logs follow our hosting provider's default settings.

Rate limiting (abuse prevention): To limit automated bulk requests against public forms (e.g. the waitlist signup), your IP address is processed server-side into a hash value (HMAC-SHA256) using a secret key; the IP address itself is not stored. This hash is kept together with a request counter and the start of the current time window in our database.
Purpose: Abuse prevention (e.g. mass automated form submissions).
Legal basis: Art. 6 para. 1 lit. f DSGVO (legitimate interest in preventing abuse).
Retention period: The counter is overwritten on the next request from the same source once its time window (currently one minute) has elapsed; no history of individual requests is built up.

2.7 Waitlist data

Data: E-mail address.
Purpose: Notification upon platform launch.
Legal basis: Art. 6 para. 1 lit. a DSGVO (consent by signing up to the waitlist).
Retention period: Until launch or deletable at any time upon request. Data is stored exclusively in our own database; no external form-processing provider is used.

3. Disclosure to third parties / processors

We use the following service providers as processors pursuant to Art. 28 DSGVO:

Data processing agreements are in place with the providers listed above; where processing takes place outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) pursuant to Art. 46 para. 2 lit. c DSGVO and/or the EU-US Data Privacy Framework.

4. Your rights

You have the following rights under DSGVO, which you may assert by e-mail to kontakt@jobvance.me:

• Access (Art. 15 DSGVO) – which data we process about you
• Rectification (Art. 16 DSGVO) – correction of inaccurate data
• Erasure (Art. 17 DSGVO) – deletion of your data, provided no statutory retention obligation applies
• Restriction (Art. 18 DSGVO) – restriction of processing
• Data portability (Art. 20 DSGVO) – receipt of your data in a common format
• Objection (Art. 21 DSGVO) – objection to processing based on legitimate interests

Note on account deletion: When you delete your account in the profile section, your user account is anonymised, not entirely removed: your name, contact details (e-mail, phone, postal code, city), and profile picture are deleted or replaced with non-personal placeholders. The following are irrevocably deleted: your baseline CV (the stored CV dataset), all of your application projects (including saved job postings, company research, tailored CVs, cover letters, and interview preparation), your uploaded attachments as well as your photo and signature in private file storage, your saved interview story collection, any in-progress CV-intake jobs, unused sign-in links, and all active sessions and linked Google/LinkedIn account connections.

Your purchase/receipt data (Stripe transactions) is not affected by this and is retained in anonymised association with your (anonymised) account, because we are obliged under § 257 HGB to store accounting records and business correspondence for the statutory retention period (generally 10 years). This retention is the legal basis for restricting your right to erasure pursuant to Art. 17 para. 3 lit. b DSGVO.

If you would additionally like your base CV data deleted, you can contact us at any time at kontakt@jobvance.me.

5. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority depends on your place of residence. A list of German authorities can be found at: bfdi.bund.de.

6. Cookies and session management

Without your consent we set strictly necessary cookies only. On your first visit a banner asks for your decision; the statistics and marketing categories are pre-selected as switched off. We store your decision in a separate jv_consent cookie (one-year lifetime), and you can change or withdraw it at any time via "Cookie settings" — a withdrawal removes the affected scripts and cookies immediately, without requiring a page reload.

Statistics: If you consent, we load Google Analytics 4 (see section 3), which sets cookies to recognise your browser (including _ga, lifetime up to two years). Legal basis: Art. 6 para. 1 lit. a DSGVO in conjunction with § 25 para. 1 TDDDG.

Marketing: This category currently has no effect — no advertising or remarketing services are integrated. Should that change, we will state it here in advance.

For authentication, jobvance uses a server-managed session cookie (Better Auth) that is set exclusively as an httpOnly cookie: it cannot be read by JavaScript in the browser, is only transmitted to our own domain, and is never stored in localStorage or any other client-side storage — there is no access token that your browser manages itself or that is sent to an external address via a bearer header. The associated session is managed server-side in our database (including the IP address and user agent recorded at sign-in, see section 2.6) and ends automatically upon expiry or sign-out; upon account deletion, all sessions are revoked immediately.

7. Changes to this policy

We reserve the right to update this privacy policy when our services or legal requirements change. The current version is available at jobvance.me/privacy. Last updated: September 30, 2026.