Last updated: 2026-09-21

Privacy Notice

How KarriereVault handles personal data.

Overview

KarriereVault helps you manage career information, documents, and application drafts. This notice explains the personal data we process, why we process it, who may receive it, and the choices available to you.

Controller and contact

Controller: Dennis Zink
Privacy contact: legal@karriere-vault.com
Postal address: Im Bannhölzle 10, 72160 Horb am Neckar, Germany
Supervisory complaint authority: The data protection supervisory authority of the German federal state in which the controller is established. An overview of authorities is published by the Federal Commissioner for Data Protection and Freedom of Information.

Data, purposes, and legal bases

Account and authentication data are processed to provide and secure your account.
Career Profile, Library, Application, and generated-content data are processed to provide the workspace and requested features.
Support, security, usage-accounting, and billing data are processed to operate the service, prevent abuse, and meet applicable obligations.
Where consent is required, you can withdraw it with effect for the future.

AI processing

AI provider: OpenRouter
Purpose: AI routing for user-requested analysis and drafting.
Retention: Content is processed to fulfill the user-initiated request and is not retained by KarriereVault beyond operational needs.
Training-use position: KarriereVault does not authorize use of customer content for provider model training.
Automated decision-making: KarriereVault does not make decisions based solely on automated processing that produce legal or similarly significant effects.

When you request analysis or drafting, selected content may be sent to the configured AI provider and its applicable downstream providers. You are responsible for reviewing generated output before using it.

Processors, recipients, and transfers

Vercel: Hosting and delivery of the KarriereVault web application. Retention: According to Vercel's data processing terms and the project's configured log retention. Transfer position: Vercel may process data in the United States and other countries under appropriate safeguards, including Standard Contractual Clauses where applicable.
Supabase: Authentication, database, and file storage. Retention: According to Supabase project settings and KarriereVault's data lifecycle workflow after account deletion. Transfer position: Supabase may process data in the EU and United States under its data processing agreement and applicable transfer mechanisms.
OpenRouter: AI routing for user-requested analysis and drafting. Retention: Content is processed to fulfill the user-initiated request and is not retained by KarriereVault beyond operational needs. Transfer position: OpenRouter may route requests to model providers in the United States and other countries. Training-use position: KarriereVault does not authorize use of customer content for provider model training.
PostHog Cloud EU via Cloudflare managed reverse proxy; Reddit Ads Pixel and Conversions API v3; and Vercel Web Analytics and Speed Insights (public landing page): Consent-approved product analytics from the PostHog Cloud EU project using the allowlisted event contract and pseudonymous server-derived identity. The separate Reddit Ads Pixel and Conversions API v3 provider is used only after the same explicit consent for consented conversion measurement and campaign optimization. The CAPI adapter sends the allowlisted event fields, event source URL, optional rdt_cid, and conversion_id. It does not send email addresses, phone numbers, automatic advanced matching, External ID, Reddit UUID, or IP/User-Agent match keys. The Reddit Pixel is a provider-controlled browser integration and may process technical match keys, event metadata, and referrer data according to Reddit's current Pixel settings and terms. After consent, if a person creates or signs into an account, consented browser events may be associated with that account's pseudonymous analytics identity to measure the complete journey. Consented browser ingestion is routed through Cloudflare's managed reverse proxy before reaching PostHog. Events before consent are not collected or backfilled. The public landing page also has a separate aggregate Vercel Web Analytics and Speed Insights path for landing reach and real-user performance. Retention: The PostHog project reports a 12-month event-retention setting, but project-level retention enforcement is currently disabled, so KarriereVault does not promise a fixed event deletion period. Session recording is disabled for this project. No fixed Reddit retention period is promised; Reddit Pixel client storage and provider retention follow Reddit's current implementation, settings, terms, and policy. Vercel retention follows the applicable Web Analytics and Speed Insights documentation. Transfer position: PostHog product analytics is ingested into PostHog Cloud EU. Consented browser ingestion is first processed by Cloudflare as PostHog's managed-proxy subprocessor. Cloudflare may terminate connections at dynamically assigned geographic locations; EU-only edge termination is not contractually guaranteed. Reddit may process consented Pixel and Conversions API data under its applicable provider terms and safeguards; this notice does not claim a fixed Reddit storage location or transfer route. Server/Edge analytics and account-deletion requests remain direct to PostHog Cloud EU. Vercel may process landing-page analytics and performance data in the United States and other countries under its privacy policy and applicable safeguards. Consent position: PostHog product analytics and the separate Reddit Ads Pixel and Conversions API v3 flow start only after explicit consent under § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR. The Reddit measurement flow covers PageVisit, Sign Up, ApplicationGenerated, and DocumentDownloaded events. The CAPI adapter may include rdt_cid when present; it does not send email addresses, phone numbers, automatic advanced matching, External ID, Reddit UUID, or IP/User-Agent match keys. The provider-controlled Reddit Pixel may process technical match keys, event metadata, and referrer data according to its current settings and terms. Consented browser ingestion may pass through Cloudflare's managed reverse proxy before reaching PostHog. The consent explanation and Privacy Notice disclose that consented browser activity may be associated with the account after sign-up or sign-in to measure the complete journey. PostHog uses IP anonymization, the allowlisted event contract, and a pseudonymous HMAC identity. Events before consent are not collected or backfilled. Withdrawal stops future PostHog and Reddit capture and resets the active browser identity; account deletion submits an asynchronous provider deletion request, so completion is not represented as immediate. Vercel Web Analytics and Speed Insights remain separate public-landing-page paths whose live legal classification requires owner verification.

Retention, export, and deletion

Account and workspace data: Account and workspace data are kept while your account is active and deleted or anonymized after account deletion, subject to retention required for security, billing, or legal obligations.
Security and audit data: Security and audit logs are retained for a limited period necessary for incident investigation and service integrity, then deleted or anonymized.
Backup position: Encrypted backups may retain deleted data for a limited rolling period before automatic purging.

You can use the privacy settings to request an export or start account deletion. Retention may continue where required for security, legal obligations, or dispute handling.

Your rights

You may have rights of access, correction, deletion, restriction, portability, and objection under applicable law.
You may withdraw consent where processing is based on consent.
Send privacy requests to legal@karriere-vault.com.
You may lodge a complaint with the supervisory authority shown above.

Changes to this notice

We may update this notice when the service, providers, or legal requirements change. The date above shows the latest update.