Privacy Policy

English version. In case of doubt the German version prevails.

1. Controller

• Controller: Sebastian Dionizi (Skill-IA is being founded; no company is registered yet).
• Address: Bonner Str. 1, App. 104, 80804 Munich, Germany
• Privacy contact: datenschutz@skill-ia.de, phone +41 78 328 47 66
• Data protection officer: We have not currently appointed a DPO because the legal requirements (Art. 37 GDPR, § 38 BDSG) are not met at present. We review this regularly; privacy requests are handled directly by the contact above.

2. Key points

Skill-IA helps job seekers find suitable vacancies and apply, and, from launch, is meant to help small and medium-sized companies find suitable candidates too. The details are in the sections referred to.

• Your CV goes to AI providers in the USA. For the analysis its full text is sent to OpenAI and Anthropic (3.3, 5, 6). All uploads pass through Cloudflare, and email applications with your CV through our email services, Google Cloud and Twilio SendGrid (5).
• Your profile is scored automatically. We compute a profile strength and a match score per vacancy. This is profiling (4).
• Applications in your name are sent only if you use "Apply automatically" and explicitly authorise it (3.6, 4). Your CV goes to employers only at your request.
• Special data such as a photo or health, religious or trade-union details are not needed. Please remove them before uploading; otherwise they are processed too (3.3).
• Retention: "New candidate" deletes your CV immediately. Otherwise we delete it 24 months after your last activity (sign-in or change), or after 90 days without an account (3.4, 7).
• How we make money: Skill-IA is free for job seekers. From launch, companies pay us a fee when they hire someone. We sell no data; a company gets your name and contact details only if you accept its specific interview request (3.7).
• No advertising trackers: We use no advertising trackers. The candidate tool has no analytics trackers; on the website skill-ia.de we measure usage only if you accept "Analytics" in the cookie banner (3.13, 3.14).

3. What we process and why

3.1 Visiting the website, server logs

Technically necessary data on every request: IP address, time, address requested, status code, browser identifier — to deliver the pages and keep them secure (attack and abuse prevention, sign-in throttling). Lawful basis: Art. 6(1)(f) GDPR. Logs are deleted after 30 days, or earlier if a fixed size limit is reached. The website skill-ia.de is served by Cloudflare Pages (see 5); on a first visit it asks Cloudflare for the country of your IP address to suggest a language — the country is not stored.

3.2 User account

Name, email, a one-way hash of your password (never the password), whether the email is confirmed, the version of this notice you accepted and when, sign-in dates, role and access level; optionally phone and city. With Google, Microsoft or LinkedIn sign-in, also that provider's account id and the email it shares — no access tokens, nothing else. Lawful basis: Art. 6(1)(b) GDPR (contract of use).

3.3 CV analysis and job search

When you upload a CV (PDF), language models (AI) from OpenAI and Anthropic in the USA (5, 6) turn its text into a profile (occupation, experience, education, skills, languages, town-level location), compute a profile strength and match it against live job ads (4). Optional notes you add are included. Lawful basis: your consent (Art. 6(1)(a) GDPR), logged with time and notice version (Art. 7(1)).

Special categories (Art. 9). A CV may contain e.g. a photo or health, religious or trade-union data. We don't need them: the profile step is instructed not to copy or infer them, nor date of birth, age, gender, nationality or photo, and they are not an intended criterion for scoring or ranking. That is an instruction to a language model, not a technical guarantee. The language models read only the text of the CV; images such as a photo are not sent to them. Such data is not removed from the text beforehand: the full text of the CV goes to OpenAI and Anthropic in the USA (5, 6), and the uploaded document itself is stored (3.4), transmitted through Cloudflare (5) and attached to applications (3.6). Please remove them before uploading if you don't want them processed; where present, your consent explicitly covers them (Art. 9(2)(a)).

LinkedIn profile instead of a CV (optional). If you choose "Import from LinkedIn", you agree on LinkedIn's own page to share your profile data (LinkedIn Member Data Portability API). We keep only name, headline, summary, location (town/region), industry, experience, education, skills, languages and certifications — never date of birth, address, postcode, phone number or other account data — and store them with your account until you remove them ("My account") or delete the account. The access token is used once and not stored. The profile is used only when you choose "Use this profile" and consent; it is then processed like an uploaded CV.

3.4 Keeping your CV between visits

So you needn't upload again on each visit we keep, linked to your account: the PDF, its text, the profile, your latest matches, which employers you applied to (so none is written to twice) and the send history. "New candidate" deletes this data immediately and permanently, and so does deleting your account. What remains is the candidate record in our CRM (see below), until you delete your account or write to us, the inputs held by OpenAI and Anthropic (up to 30 days, section 7) and the proof of your consents (section 7). Otherwise the data is deleted automatically 24 months after your last activity (sign-in or change). Encrypted backups, which only we can restore, still hold deleted data for at most 14 days. Generated sample CVs are never stored. Lawful basis: your consent (3.3).

Without an account. The candidate tool also works without signing in. Your browser then gets a random identifier (cookie sk_guest, 90 days) under which we keep the data above; it is deleted at the latest 90 days after it last changed, immediately with "New candidate". Your name, email address and phone number are taken from your CV; if it has no email address we ask you for one (the automatic applications need it). Before the first application goes out we send a confirmation code to that address (through our CRM); applications are sent with it only once you have entered the code. If you later create an account or sign in, your CV is linked to the account.

Candidate record in our CRM. Once your CV or LinkedIn profile has been analysed we create (or update) you as a candidate in our own CRM, so our team can support your job search: your account's name and email address (without an account: the name, email address and phone number from your CV, or the email address you gave us), the role you want, skills, experience level, the profile summary and the result of the profile evaluation — not the PDF — plus the record of your consents (purpose, time, version of this notice). If you authorise automatic applications (3.6), that is noted there too. Deleting your account deletes this record; otherwise section 7 applies. Lawful basis: your consent (3.3).

3.5 Search conditions

Driving licence, salary expectation, availability, maximum weekly hours, shifts or travel you refuse are read from your CV where it states them (or entered by you) and used only to filter the search during your session. They are not stored as separate data; whatever the CV itself states stays stored with it (3.4).

3.6 Automatic applications (optional)

Only when you use "Apply automatically" and explicitly authorise it: a language model writes a cover letter per vacancy in your name from your CV (you can read, edit or untick each one before sending) and we send it with your CV by email to the contact address the employer published, or through the contact form on the employer's own website, which a program fills in automatically in your name (never via job boards). The sender is a Skill-IA address; the reply address and your copy are always your account's email (without an account: the address you confirmed, 3.4): you get a copy of every email application and employers reply to you directly. Your CV and address sit in our sending queue only until the email is sent and are deleted there afterwards. Once sent, the employer processes your application as an independent controller. Each send is logged without content (time, employer domain, job title, outcome). If the vacancy is advertised on the Skill-IA job board, the application (cover letter, CV, name, email) is not emailed but delivered to the ad on our job board, where the advertising company retrieves it; we delete it there after 180 days. Lawful basis: Art. 6(1)(b) GDPR (carrying out your instruction); where the attached CV contains special categories, your explicit consent (Art. 9(2)(a) GDPR).

3.7 Optional consents: visibility to companies and improving the matching

Both are separate boxes, never pre-ticked; the job search works without them. You can give them when uploading and give or withdraw them at any time on your profile page ("Your data choices"). Every consent and withdrawal is logged without content (time, version, scope).

Visibility to companies. Only if you tick this box may Skill-IA, once it opens to companies, show a version of your profile without your name (occupation, skills, experience, qualification, town — no name, no contact details, no CV) to companies using "Skill-IA for companies". A company receives your name and contact details only after you accept its specific interview request. Withdraw at any time with one click or by writing to us. When choosing whom to propose to a company, we take the profile strength into account (4). From launch, companies pay Skill-IA a fee when they hire someone. At present your profile is not shown to any company. Lawful basis: Art. 6(1)(a) GDPR.

Improving the matching. Only if you tick this box may Skill-IA use your CV and its analysis to test and improve the matching (checking the match and profile scores, calibrating the weights). Nothing is shared or published for this, and no extra copies outlive your stored CV: after "New candidate", account deletion or 24 months without activity it is deleted for this purpose too. A withdrawal applies to future evaluations. Lawful basis: Art. 6(1)(a) GDPR and, where the CV contains special categories, Art. 9(2)(a) GDPR.

3.8 Skill-IA for companies

"Skill-IA for companies" is not open yet (3.15). For company accounts: company name, town, contact person, email, phone, and their searches, questions and interview requests. Candidates in the pool are people who consented to be listed (consent logged). For demonstration, clearly labelled invented examples may be shown; they are not real people. Lawful basis: Art. 6(1)(b) (companies) / (a) (candidates).

Job board. Companies can publish job ads free of charge. We store the ad and the company's details (company name, town, contact person, email, phone, website); only what the company writes in the ad is public. An ad is online for 45 days (renewable) and then expires automatically; applications received are deleted after 180 days. Lawful basis: Art. 6(1)(b) GDPR.

3.9 Recruiter console (Skill-IA team only)

Members of the Skill-IA team may analyse a CV with your agreement and add interview notes. The console keeps them in memory for the session only. A record reaches our CRM only through a deliberate action by a team member (retention: section 7). For the candidate tool see 3.4.

3.10 Payments by companies (from launch)

Skill-IA is free for job seekers. From launch, companies pay a fee when they hire someone. They pay on Stripe's or SumUp's page; we never see card or bank details. We keep plan, amount, reference and status. Lawful basis: Art. 6(1)(b) and (c) GDPR (contract, tax record-keeping).

3.11 Employer contact details

To send applications we find an employer's application address in public sources: the job ad and the company's own website (Impressum, contact, careers, privacy pages), preferring role inboxes (bewerbung@, info@); occasionally this is a person's business address from an Impressum. Lawful basis: Art. 6(1)(f) GDPR (legitimate interest in sending applications to the right place). Found addresses are cached for up to 30 days. Data subjects may object at any time (section 9).

3.12 Companies as prospective customers (B2B)

To offer suitable candidates, from launch, to companies that are currently hiring, we record from public job ads: company name, town, open position, link to the ad and the contact address published in the ad (preferably a role inbox such as bewerbung@; occasionally a person's business address). The source is always the public job ad. Lawful basis: Art. 6(1)(f) GDPR (legitimate interest in business development). We add no data from social networks or data brokers, and we do not sell or pass on this data. From launch, we approach only companies with a currently open position, and only with candidates who have agreed to this: by phone or by email. Every email contains an unsubscribe link. We make contact only where legally permitted (in particular § 7 UWG). Retention: up to 24 months without response or cooperation, then deletion. Objection: you may object at any time (Art. 21 GDPR) – a short message to datenschutz@skill-ia.de is enough; we delete the data and block the address from future contact.

3.13 Website analytics (only with consent)

Only if you accept "Analytics" in the cookie banner do we use Google Analytics 4 on skill-ia.de (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand which pages are used and how. Before that, Google's script is not loaded and nothing is sent to Google. Processed: pages visited, referrer, interactions, device, browser, approximate location (country/region) and a random identifier in the cookies _ga and _ga_<ID> (up to 2 years). Google Analytics 4 does not store IP addresses; advertising features and Google Signals are off. Google may also process data in the USA (see 6). Lawful basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Withdraw at any time via the cookie icon at the bottom left of every page.

3.14 Website visits by known contacts (only with consent)

Links in emails we sent you may carry a random identifier (sk_vid). Only if you also accept "Analytics" in the cookie banner does the website keep this identifier in your browser's local storage and report the pages you visit (address, referrer, browser identifier, time) to our CRM, where they are linked to your existing contact record — so we can see what you are interested in. Without an identifier or without consent nothing happens; we do not identify unknown visitors. The records are deleted with your contact. Lawful basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); withdrawing it in the cookie banner stops the reports and removes the identifier from your browser.

3.15 Company waitlist

Skill-IA does not work with companies yet. Anyone who wants to be told when we open signs up on the website or the job board: email address, optionally name and company, language, the page signed up on and, as proof, the consent text, time and IP address. We send a confirmation email (double opt-in) and, once confirmed, the launch announcement once. Stored in our CRM until you leave via the unsubscribe link (deleted at once) or write to us; the limits in section 7 apply at the latest. Lawful basis: your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG).

4. Use of AI, scoring (profiling) and automated decisions

What is scored. Language models build the profile, assess how well vacancies fit and draft cover letters. This produces a profile strength and a match score per vacancy. That is profiling within the meaning of Art. 4(4) GDPR.

How it is scored. First, vacancies are pre-sorted through vector representations (embeddings) by similarity of content to your profile (occupation, experience, education, skills, languages, location); vacancies that are clearly too senior or too far away drop out. A language model then scores each remaining vacancy on skills, experience and seniority, language, distance and salary, and gives the reasons. Your search conditions (3.5) act as filters; you can also filter matches by, among other things, a minimum score. The match score, together with the profile strength, sets the order in which vacancies appear; a low score means a vacancy is placed lower. Date of birth, age, gender, nationality, photo and special categories are not intended criteria (3.3).

Profile strength. The profile strength estimates how attractive your profile is to hiring companies in general, in particular by experience level, education and skills. It feeds into the order of the vacancies you see in the tool. From launch, we also take it into account when choosing, among people who consented to visibility (3.7), whom to propose to a company; a person makes that choice.

Who decides. The result is a proposal with reasons: you decide which vacancies to look at and whether, where and with which text an application is sent. Before sending, you can inspect each automatic application individually and select or deselect it; only what you leave selected is sent. There is no solely automated decision with legal or similarly significant effect under Art. 22 GDPR.

You are interacting with AI systems; texts we draft in your name are AI-generated. AI output can be wrong — please check your profile and letters. Each evaluation and each job ranking is recorded for traceability (a checksum of the input, the models, the scores; no CV text).

5. Recipients and processors

Recipient	Data	Role / safeguard
OpenAI, L.L.C. (USA) — language models (gpt-4.1, gpt-4.1-mini, gpt-4o) and embeddings (text-embedding-3-large)	Full CV text (including any special categories it contains), notes, derived profile, job texts	Processor (Art. 28) under OpenAI's Data Processing Addendum with EU SCCs; EU-U.S. Data Privacy Framework. API data is not used for training.
Cloudflare, Inc. (USA) — network, TLS and tunnel to our server; serving the website skill-ia.de (Cloudflare Pages)	All transmitted data including uploads, since encryption terminates at Cloudflare; IP address	Processor under Cloudflare's Data Processing Addendum; SCCs and Data Privacy Framework. For its own security and billing purposes Cloudflare is partly an independent controller.
Anthropic, PBC (USA) — language models (Claude)	Full CV text (including any special categories it contains), notes, derived profile, job texts	Processor under Anthropic's Data Processing Addendum with EU SCCs.
Google Cloud (Google LLC / Google Cloud EMEA Limited) — email services (sending emails automatically)	Automatically sent emails: sender, recipient, content and attachments, for applications also the CV	Processor under the Google Cloud Data Processing Addendum.
Google Analytics 4 (Google Ireland Limited; Google LLC, USA) — only after consent (3.13)	Website usage data, random identifier, device, approximate location — no CV data	Processor under the Google Ads Data Processing Terms; SCCs and Data Privacy Framework.
Hosting: our own server in Munich, operated by ourselves; standby: Oracle Cloud Infrastructure (Oracle Corporation), region Turin (Italy)	All stored data	Own operation; Oracle as processor under the Oracle Data Processing Agreement.
Email delivery: Twilio SendGrid (Twilio Inc., USA)	Application emails with CV, confirmation and password emails	Processor under the Twilio Data Protection Addendum; SCCs and Data Privacy Framework. For its own purposes (e.g. abuse prevention, billing) Twilio is partly an independent controller.
Employers you apply to	Cover letter, CV, name and email	Independent controllers, only at your request.
Companies with an ad on the Skill-IA job board	Your application to that ad (cover letter, CV, name, email)	Independent controllers, only at your request (3.6).
Companies on "Skill-IA for companies"	Profile without your name; name and contact only after your agreement	Independent controllers.
Job sources: Federal Employment Agency (BA), Arbeitnow, Adzuna, Jooble, Brave Search	Only derived search terms and place — never the CV	No personal data intended.
Google, Microsoft, LinkedIn (only if you sign in with them, or import from LinkedIn)	Sign-in; retrieving your LinkedIn profile	Independent controllers under their own policies.
Stripe, SumUp (only when paying)	Payment data	Independent controllers.
Map tiles: the OpenStreetMap Foundation (UK)	Your browser loads the tiles directly: IP address, browser identifier, map area shown — no profile, no name	Art. 6(1)(f); UK adequacy decision.
Skill-IA CRM (own operation on our server)	Candidate record from the candidate tool (3.4) or after a team member's deliberate transfer (3.9); the applications' sending queue (3.6); website visits by known contacts (3.14); waitlist (3.15)	Own operation.
Bright Data Ltd. (Israel) — only when the proxy-based web search is enabled	Job page addresses — no candidate data	Processor under a Data Processing Addendum; adequacy decision for Israel.

6. Transfers outside the EU

OpenAI, Anthropic, Google, Cloudflare and Twilio SendGrid also process data in the USA, so your CV leaves the EU. For OpenAI, Google, Cloudflare and Twilio SendGrid the basis is the Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in addition, EU Standard Contractual Clauses (Art. 46(2)(c)). For Anthropic it is EU Standard Contractual Clauses (Art. 46(2)(c)). You can obtain a copy of the Standard Contractual Clauses on request from the privacy contact (section 1). The OpenStreetMap Foundation (United Kingdom) and Bright Data (Israel) are covered by Commission adequacy decisions (Art. 45 GDPR).

7. Retention

Data	Period
CV, profile, matches, application history in the candidate tool	Until "New candidate", account deletion or withdrawal; otherwise 24 months after your last activity (without an account: 90 days after the last change)
Inputs and outputs sent to OpenAI and Anthropic	At the provider by default up to 30 days; longer only where required by law or to protect against abuse. This period runs independently of "New candidate"
CV and your address in the sending queue	Until the application is sent or finally fails
User account	Until you delete it ("My account"); otherwise 24 months after your last sign-in, with an email notice 30 days before
Candidate record in the CRM	Until you delete your account (candidate tool) or on request; otherwise 24 months after the last activity, then deleted
Proof of your consent (accepted version and time)	With the account, as long as it exists
Proof of each consent and withdrawal in the candidate tool (time, version, scope — no content)	5 years, then deleted (proof in case of legal claims, Art. 17(3)(e) GDPR); kept after the CV itself is deleted
Record of the automated evaluation and job ranking (checksum of the input, models, scores — no CV text, no name)	12 months, then deleted (Arts. 12 and 26 AI Act)
Log records of application sends (no content)	12 months from sending; earlier if the CV is deleted
Server logs	30 days from creation; earlier if the fixed size limit is reached
Encrypted backups	14 days
Cached employer contact details	30 days
Company contacts (B2B, 3.12)	Up to 24 months without response or cooperation, then deleted; immediately on objection
Ads on the job board	Online for 45 days (renewable), then expired; deleted by the company or with its account
Applications through the job board	180 days, then deleted
Google Analytics (3.13)	Cookies up to 2 years; event data at Google at most 14 months
Website visits by known contacts (3.14)	With the contact record; none after withdrawal
Company waitlist (3.15)	Until you unsubscribe or ask us; otherwise 30 days after the launch announcement is sent, at the latest 24 months after you confirmed. Unconfirmed sign-ups: 30 days
Proof of consent for the waitlist (consent text, time, email address)	5 years, then deleted (proof in case of legal claims)
Payment records	Statutory retention (up to 10 years, § 147 AO)

8. Cookies and local storage

Without your consent we set only strictly necessary cookies (§ 25(2) no. 2 TDDDG, no consent needed): sk_session (sign-in, until you sign out or the session ends), sk_guest (using the candidate tool without an account, 90 days), sk_csrf (form protection, 1 hour), sk_oauth and sk_app (only during a Google / Microsoft / LinkedIn or app sign-in, a few minutes), sk_li_import (only during a LinkedIn import, a few minutes). Your chosen language and light/dark choice are kept in your browser's local storage, the website's language also in the cookie skillia_lang (1 year, so the sign-in pages follow it); your cookie-banner choice is kept in local storage too. The candidate tool has no advertising, analytics or tracking cookies.

Only on the website and only with your consent ("Analytics" in the cookie banner, § 25(1) TDDDG): _ga, _ga_<ID> (Google Analytics, 3.13) and, in local storage, sk_vid and sk_track_ok (visits by known contacts, 3.14). We set no advertising cookies. You can change or withdraw your choice at any time via the cookie icon at the bottom left.

9. Your rights

• Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20).
• Withdraw consent at any time, for the future (Art. 7(3)) — for your CV via "New candidate" or by writing to us, for the optional consents on your profile page (3.7), for the website via the cookie icon, for the waitlist via the unsubscribe link.
• Object to processing based on legitimate interests (Art. 21) — e.g. as a company's contact person, to the use of your address (3.11, 3.12).
• Do it yourself: "New candidate" deletes your CV and all matches; under "My account" you can download your account data (JSON) or delete the account — deleting the account deletes the stored CV too. Anything else: datenschutz@skill-ia.de.
• Complain to a data protection authority, e.g. the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

10. Obligation to provide data, minimum age

You are not obliged to provide data; without a CV we cannot suggest vacancies. An account is optional — the candidate tool also works without one (3.4). The service is for people aged 16 and over.

11. Security

• Encrypted transport (HTTPS); backups encrypted, with the key kept off the server.
• Passwords stored only as bcrypt hashes; sign-in throttling; cross-site request protection.
• Candidate data accessible only to authorised members of the Skill-IA team; each account sees only its own data.
• Services run without administrator rights; access keys are never in the source code.
• Text from CVs and web pages is marked as untrusted data in every instruction to the language models, to protect against manipulated documents.
• Automated security checks run on every change to our source code.

12. Changes

On material changes we update this notice and its version number; for new purposes we ask for your consent again.