Privacy Policy

This privacy policy informs you about how your personal data is processed when using Joatra and the rights you have under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

Controller within the meaning of the GDPR is:

Email: christian@cmlux.dev

2. What data we process

We process only the data you actively provide or that is technically required to operate the service:

• Account data: Email address and password (stored hashed) for sign-in via Firebase Authentication.
• Profile data: Personal details you add to your CV profile (name, address, date of birth, education, work experience, skills, languages, certificates, etc.).
• Application data: Jobs, recruiter contacts, and generated CVs/cover letters that you create in the app.
• Log data: Technically necessary data with every request (IP address, browser type, user agent, timestamps). Stored briefly via Firebase App Hosting for secure operation.

3. Purposes and legal bases

Processing is carried out to provide the features you actively request. The legal basis is Art. 6 (1)(b) GDPR (performance of a contract or pre-contractual measures) for:

• Account creation and sign-in for user identification.
• Management of profile, jobs, and recruiters as the core functionality.
• AI-assisted document generation (CVs, cover letters) based on the data you provide.
• External job search via the Adzuna API, when you actively use it.
• Technical operation, security and logging — legal basis Art. 6 (1)(f) GDPR (legitimate interest in secure operation).

4. Recipients and processors

The following service providers process data on our behalf within the meaning of Art. 28 GDPR:

• Google Ireland Ltd. / Google LLC — Firebase Authentication, Cloud Firestore, Cloud Storage (for uploaded application photos), Cloud Functions, and App Hosting. Servers are located in the EU (regions europe-west1 and europe-west4). The data stored there is processed solely to provide the service and is not used for advertising or model-training purposes. Any transfer of data to the USA is carried out on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses of the EU Commission.
• Google LLC — Google Gemini API (model gemini-3.1-flash-lite) for AI-assisted text generation. We use the paid tier (Tier 1). According to Google's Gemini API terms, inputs and outputs from the paid API are not used to train the models.
• Adzuna Ltd. (United Kingdom) — provider of the public job search API. When you use Smart Job Search, only your search keyword and (optionally) location are transmitted; no personal profile data is sent. The European Commission has issued an adequacy decision for the United Kingdom.

Paddle.com Market Ltd / Paddle Payments Limited (together “Paddle”) — payment processor for the paid Joatra Pro subscription. Unlike the processors listed above, Paddle processes your payment and billing data (name, email address, billing address, payment method, IP address) as an independent controllerwithin the meaning of the GDPR, because Paddle, as Merchant of Record, is itself the contracting party for the subscription purchase — not a processor acting on our behalf. Paddle’s privacy policy applies: paddle.com/legal/privacy. Joatra itself never stores payment instrument data (e.g. card numbers) — we only store your subscription status and a customer ID in the customers/{uid} collection.

5. Retention

Your account and profile data are stored for as long as your account exists. You can delete your account and all associated data yourself at any time — via the “Delete account & data” function under “Account” in your signed-in area. Deletion is immediate and irreversible. Alternatively, an informal email to christian@cmlux.dev is sufficient; in that case we will delete your account within 30 days. Log data is regularly deleted after at most 30 days, unless security reasons require longer retention.

6. Your rights

Under the GDPR you have the right to:

• Access the data stored about you (Art. 15 GDPR).
• Have inaccurate data corrected (Art. 16 GDPR).
• Have your data erased, unless legal retention obligations apply (Art. 17 GDPR).
• Restrict processing (Art. 18 GDPR).
• Data portability in a structured, common format (Art. 20 GDPR).
• Object to processing based on legitimate interests (Art. 21 GDPR).
• Withdraw consent with effect for the future (Art. 7 (3) GDPR).

To exercise these rights, an informal email to christian@cmlux.dev is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is:

7. Cookies and local storage

Joatra does not use tracking cookies, web analytics, or advertising trackers. To maintain your sign-in session, Firebase Authentication uses local browser storage (IndexedDB). This storage is strictly necessary to provide the service you requested and falls under the exception in §25 (2) no. 2 TDDDG — no consent is required.

8. No automated individual decision-making

AI-assisted generation of CVs and cover letters is performed only at your active request and has no legal effect on you within the meaning of Art. 22 GDPR. The generated texts are suggestions that you can review and edit before any use.

9. Changes to this policy

This privacy policy may be updated when the application or the legal situation changes. The current version is always available on this page. Should material changes affect your rights, we will inform you separately.