Privacy Policy

Your privacy matters. This policy explains what data ApplyMaster collects, why, who can access it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for processing is ApplyMaster (see the Imprint for full contact details).

2. What data we process

• Account data: e-mail address and (optionally) phone number.
• Profile data you upload: your CV/résumé, photo, signature, and personal details (name, contact, education, work experience, skills, etc.).
• Job ads you submit, and the application documents we generate for you.
• Billing data: token purchases and transaction records.
• Your application history: for every application we keep a short text record: company, position, the ad's reference number, the contact person, phone number, e-mail address and location printed in the ad, the ad text you pasted, the e-mail subject and the date.

Application history. The generated PDF documents are deleted from our server 24 hours after they are created. The text record above is kept for as long as your profile exists, so that we can warn you before you apply twice for the same position (and spend a token on it) and so that you can look up which ad a caller's phone number belongs to. It contains no CV, photo, signature or document. Legal basis: performance of our service contract (Art. 6(1)(b) GDPR) and our legitimate interest in these two functions (Art. 6(1)(f) GDPR). It is deleted together with your profile (section 7).

3. Why we process it (legal basis)

We process your profile data solely to generate your tailored application documents (Lebenslauf, Anschreiben and e-mail). Legal basis: your consent (Art. 6(1)(a) GDPR), given at registration, and the performance of our service contract (Art. 6(1)(b) GDPR).

4. AI processing & sub-processors

To generate and (for voice input) transcribe your documents, the relevant content is processed by trusted AI providers acting as our processors. The application itself runs on our own server in the EU.

5. Access by our team

ApplyMaster staff can access and view your data for the purposes of operating the service — i.e. to process your request and to check for problems (for example a wrongly uploaded photo or signature, or an incorrect document). By agreeing, you explicitly consent to this access. We never sell your data or use it for unrelated purposes.

6. Security

Your data is stored securely with access controls and encryption in transit (HTTPS). We apply appropriate technical and organisational measures to protect it.

7. Deletion when you close your profile

You can close your profile at any time. When you do, all of your personal data and documents are permanently deleted — your CV, generated résumés and cover letters, photo, signature, personal details and your application history. Nothing personal remains accessible.

8. Retention of billing records

For legal accounting reasons (e.g. §147 AO, §257 HGB), billing and transaction records are retained for the statutory period even after you close your profile. These records contain no application content (no CV, photo or documents) — only what is legally required for bookkeeping.

9. Returning users

If you return after closing your profile, we will ask for your consent again before you start. We do not silently re-identify you from old data.

10. Your rights

You have the right to access, rectify, erase, restrict or port your data, to object to processing, and to withdraw your consent at any time. You may also lodge a complaint with a data protection supervisory authority.

11. Cookies & analytics

We set one strictly necessary cookie: the session cookie that keeps you logged in. It is not used to track you and needs no consent.

Abuse protection for the free welcome tokens. When you open the sign-up page we store a random device id (cookie «am_dev» and the same value in your browser's local storage), and the sign-up form sends a one-way hash of plain browser characteristics (screen size, time zone, language, platform). Together with the registration IP address and your e-mail address they are used for one thing only: making sure the free welcome tokens go to each person once. They are not used for analytics or advertising and are not shared. Legal basis: our legitimate interest in preventing abuse of a free offer, Art. 6(1)(f) GDPR, and § 25(2) No. 2 TDDDG. They are stored with your account record and kept as long as that record exists, also after an account is closed, so that the free tokens cannot be claimed again.

We also use Google Analytics 4 (Google Ireland Ltd.) to understand how the site is used — how many people visit, which pages they read, roughly where they come from. Analytics runs only if you agree to it: nothing is loaded and no identifier is stored until you press «Accept» on the banner. If you decline, no Google script is loaded at all.

• What it processes: a randomly generated identifier stored on your device, your shortened IP address, pages viewed, approximate location (country/city level), device and browser type, and the site that referred you.
• Legal basis: your consent — Art. 6(1)(a) GDPR and § 25(1) DDG.
• Transfer: data may be processed by Google LLC in the USA under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Retention: analytics data is deleted after 14 months.
• Withdrawing: you can change your mind at any time — use cookie settings. Withdrawal takes effect immediately and does not affect what was collected before.

Where the banner appears: visitors in the EU/EEA are always asked first, because that is what the law there requires. Visitors from outside that area are not shown the banner and analytics runs on the terms described above; it can still be turned off from the cookie settings link.

We also use the Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) to see which of our ads on Facebook and Instagram bring visitors and sign-ups, and to show our ads to people who are likely to find them useful. Like analytics, it runs only if you press «Accept»; if you decline, no Meta script is loaded. The banner rules described above apply to it in the same way, including for visitors from outside the EU/EEA.

• What it processes: an identifier stored on your device (cookie «_fbp»), your IP address, browser and device information, the pages you view on this site and whether you created an account. If you are logged in to Facebook or Instagram, Meta can link this to your account.
• Legal basis: your consent: Art. 6(1)(a) GDPR and § 25(1) DDG.
• Joint controllership: for collecting the data and passing it to Meta we and Meta are joint controllers (Art. 26 GDPR, Meta Controller Addendum); Meta is responsible for everything it does with the data afterwards.
• Transfer: data may be processed by Meta Platforms Inc. in the USA under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
• Withdrawing: through the same cookie settings.

12. Contact

For any data request, contact us via the details in the Imprint.