Privacy policy

Last updated Oct 6, 2026

This notice explains what personal data OfferCompass processes, why, on what legal basis, who else sees it, how long it is kept and what you can require of us. It is written to be read rather than to be survived, but nothing has been left out to achieve that.

Who is responsible

The controller within the meaning of Art. 4(7) GDPR is Sven Güttner, Walter-Hohmann-Straße 19, 45128 Essen, Germany.

Data protection enquiries: [email protected]. We have not appointed a data protection officer, as we do not meet the thresholds in Art. 37 GDPR or §38 BDSG. Your enquiry is answered by the controller personally.

What we process, why, and on what legal basis

Each category below is processed for the stated purpose only. Where the basis is Art. 6(1)(b) GDPR, providing the data is necessary to perform the contract and the service cannot be delivered without it.

Account data (email address, name where given, profile image URL, authentication identifiers) — to create and operate your account. Art. 6(1)(b) GDPR. We never receive or store your password.
Document content (resumes, cover letters, resignation letters, their settings and version history) and files you upload for import — to store, render, score, export and version the documents you create. Art. 6(1)(b) GDPR.
Profile photographs, where you choose to upload one, including the automated image checks and the AI review — to provide the photo feedback feature you invoked. Art. 6(1)(b) GDPR. A photograph is not processed for any purpose other than returning that feedback to you, and never for identification, biometric analysis or profiling.
AI generation inputs and outputs (the text you submit and what is returned) — to produce the output you asked for. Art. 6(1)(b) GDPR.
Billing data (plan, subscription status, payment and customer identifiers, invoice records) — to bill you and to meet accounting and tax obligations. Art. 6(1)(b) and Art. 6(1)(c) GDPR.
Usage records (credits consumed in the current period, feature use needed to enforce plan limits) — to operate the plan you are on. Art. 6(1)(b) GDPR.
Curated job listing data (role, employer, location, posting date, a short excerpt and the employer's apply URL) — retrieved from selected public applicant-tracking feeds to provide job search. Listings are refreshed on a bounded schedule and are not used to score job seekers. When you open, save or tailor a listing whose feed omits the full posting text, our server fetches that one posting from the employer's applicant-tracking system; the text is kept with the job you saved and the resume you tailor, and deleted with them. Company logos are fetched by our server from the employer's own website or careers page and served from our own domain, so displaying them sends no request from your browser to the employer or any third party. Art. 6(1)(f) GDPR; our legitimate interest is providing a searchable index of public vacancies with limited fields and a clear route to the publisher.
Server and security logs (IP address, request metadata, timestamps) — to keep the service available, diagnose faults and defend against abuse. Art. 6(1)(f) GDPR; our legitimate interest is the security and integrity of the service.
Google Analytics measurement data, and only if you consented to it (pages viewed, the referring page, approximate region, browser and device type) — to see which pages and guides are useful. Art. 6(1)(a) GDPR for the processing and §25(1) TDDDG for the storage on your device. Withdrawable at any time from "Cookie settings" in the footer.
Server-side Zählwerk measurement — our own service counts completed public HTML page responses and selected product events (account and document lifecycle; document export; AI action category; photo review; checkout and subscription state; contact and cancellation form receipt). Page reports contain the public path, response status, allow-listed campaign tags, referrer origin, browser identifier, first language and an IP shortened to /24 for IPv4 or /48 for IPv6 before it leaves the app server. Full IP addresses are sent only for Google, Bing and OpenAI crawlers whose published ranges Zählwerk verifies, then discarded in memory. Product events contain only fixed event names and limited categories such as format, action, plan or interval — never account or document IDs, resume/letter content, names, email addresses or free text. Zählwerk stores hourly aggregate counters, not visit histories, for 760 days by default. Art. 6(1)(f) GDPR; our legitimate interest is understanding the reach and use of our own service. Browser requests with Global Privacy Control are not counted. You can opt out of page views and browser-originated events below; signed Clerk/Stripe lifecycle webhooks are counted separately as aggregate system events and cannot be linked to your browser preference. You can object to that processing by contacting us.
Correspondence you send us, including support requests and anything filed through the cancellation form — to answer you and, for cancellations, to comply with §312k BGB. Art. 6(1)(b), Art. 6(1)(c) and Art. 6(1)(f) GDPR.

Cookies and similar technologies

Strictly necessary cookies keep you signed in, protect form submissions, and remember the choice you made in the consent banner. A separate first-party cookie, oc_no_track, is created only after you ask us not to count your visits; it stores only that preference for two years so the server can honour it on later requests. We use it only to carry out your opt-out.

Google Analytics is optional and off until you switch it on. If you accept it, Google Analytics 4 sets the cookies listed below and reports page views to Google Ireland Limited. The legal basis is your consent: Art. 6(1)(a) GDPR for the processing, §25(1) TDDDG for the storage on your device. Until you give it, the Google tag is not requested from Google at all — no script, no identifier, not even a cookieless ping. If you withdraw consent, the identifiers already written are deleted from your browser. The consent setting controls Google Analytics only.

Separately, our own Zählwerk service counts completed public HTML responses and the fixed-name product events listed above. No Zählwerk script, pixel or tracking cookie runs in your browser; only the request facts our server already receives are used. Page views in the signed-in application and resume/letter editor are excluded. Selected actions such as a successful export or AI generation are counted as hourly totals without account IDs, document IDs or user-entered content. Zählwerk honours Global Privacy Control and the opt-out below for browser requests. Account and subscription lifecycle events arrive separately from signed Clerk/Stripe webhooks and contain no account identifier. The consent-banner choice for Google Analytics does not change this server-side counter.

We run no advertising, no retargeting, no session recording, no A/B testing tools, no heatmaps and no third-party marketing tags. Google's advertising signals are denied permanently, no ad profile is built, and nothing is shared with Google's advertising products. Web fonts are served from our own infrastructure and are not requested from a third party. Search Console verification is a static meta tag: it stores nothing, reads nothing and transmits nothing.

__session, __client_uat, __clerk_* — Clerk. Strictly necessary. Keeps you signed in and protects the session. Session to one year.
oc_consent — us. Strictly necessary. Stores the choice you made in the banner and when you made it, which is both how we stop asking and how we can show what you agreed to. Twelve months, after which you are asked again.
oc_no_track — us. Stores only your request not to be counted by Zählwerk. Set only when you choose that option; expires after two years or is removed when you turn counting back on.
_ga, _ga_* — Google. Analytics, and only with your consent. Distinguishes browsers so that a repeat visit is not counted as a new one. Two years, or until you switch analytics off, at which point they are deleted.

Turn off Zählwerk Turn Zählwerk back on

Who else processes it

We use the following processors under Art. 28 GDPR data processing agreements, each with access limited to what its function requires. Our own Zählwerk collector is hosted by Railway in the EU region. We do not sell personal data, disclose it to data brokers, or share it with recruiters or employers.

Railway Corporation — hosting of the application, its database, uploaded files and our own Zählwerk statistics service.
Replicate, Inc. — runs the AI features. The text (and, for the photo review, the portrait) you submit to an AI feature is sent through Replicate to the model's provider, Anthropic PBC, to generate the reply.
Resend, Inc. — delivery of transactional email, such as cancellation confirmations.
Clerk, Inc. — authentication, session management and account administration.
Stripe Payments Europe, Ltd. — payment processing and subscription billing. Card details are entered on their systems and are never transmitted to or stored by us.
Google Ireland Limited — website analytics (Google Analytics 4), and only for visitors who consented to it. Nothing reaches Google from a visitor who declined, or who has not answered yet.

Transfers outside the EEA

Railway, Replicate, Anthropic, Resend and Clerk are established in the United States, Stripe processes through its Irish and United States entities, and Google Ireland Limited transfers onward to Google LLC in the United States, so processing may take place there or in other third countries. Those transfers are safeguarded by the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, supplemented where applicable by the provider's certification under the EU–US Data Privacy Framework (Art. 45 GDPR).

You may request a copy of the safeguards relied on for any specific transfer by writing to [email protected].

How long it is kept

Documents, uploads and account data are kept until you delete them or delete your account, at which point they are removed immediately rather than queued. Deletion is irreversible and we cannot recover a deleted document for you.

Invoices and the accounting records attached to them are retained for ten years under §147 AO and §257 HGB, and cannot be deleted on request before that period expires; they are restricted from all other processing in the meantime under Art. 18 GDPR.

Cancellation filings and their confirmations are retained for three years, the regular limitation period under §195 BGB, because they are evidence of when a contract ended.

Server and security logs are retained for no longer than 30 days and are then deleted or irreversibly aggregated.

Google Analytics records are configured for Google's shortest retention period, two months. Zählwerk hourly aggregate counters are retained for 760 days by default; raw request facts are discarded after in-memory classification.

Automated decision-making

The ATS score is a deterministic rule-based calculation performed on your own document at your request. It produces advice for you and is not used to make any decision about you, so it is not automated decision-making within the meaning of Art. 22 GDPR. We do not profile you, score you as a candidate, or share any assessment of you with a third party.

Your rights

Under the GDPR you have the following rights, which we honour without charge and without asking why:

Access to the personal data we hold about you and the information in this notice (Art. 15).
Rectification of inaccurate data and completion of incomplete data (Art. 16).
Erasure, subject only to the retention obligations set out above (Art. 17).
Restriction of processing (Art. 18).
Portability — a machine-readable export of everything you created, available immediately from your settings without asking us (Art. 20).
Objection at any time to processing based on our legitimate interests, including profiling based on them (Art. 21).
Withdrawal of any consent you have given, at any time, without affecting the lawfulness of processing carried out before you withdrew it (Art. 7(3)).

Complaining to a supervisory authority

You have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in the member state of your residence, place of work, or the place of the alleged infringement.

The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (ldi.nrw.de).

You do not need to contact us first, though we would rather you did: [email protected].

Security

Data is encrypted in transit and at rest. Access to production systems is limited to the people who operate them. We are a small operation and will not claim certifications we do not hold; if you need a formal security review for an employer or an institution, ask and you will get an honest description of what exists.

Changes to this notice

Where a change materially affects how we process your data, we will tell you before it takes effect rather than relying on you noticing the date at the top of this page.