Privacy policy

This is a convenience translation. Only the German version is legally binding.

We take the protection of your data seriously. Application documents contain a lot of personal information. That is why we only collect what the service needs, use no tracking or advertising cookies, and share data only with the service providers named below.

1. Controller

TLBM UG (haftungsbeschränkt), Marienhöhe 157, 25451 Quickborn, Germany. E-mail: info@tlbm.de, phone: +49 4106 1282398.

2. Hosting and server logs

cveasy.ai runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Nuremberg (Germany). We have a data processing agreement with Hetzner (Art. 28 GDPR).

When you visit the website, the web server processes technically necessary data (IP address, time, page requested, browser identifier). This serves secure operation and the prevention of abuse (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days at the latest.

3. Cookies

We only set one technically necessary cookie (cv_sid) when you open the editor. It links your documents to your browser or account. The service does not work without this cookie, so no consent is required (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). We use no analytics, tracking or advertising cookies and no third-party services for audience measurement.

Fonts are loaded from our own server, not from Google or other providers.

4. Account and documents

You can use cveasy.ai without signing in. In that case we create a guest account that is linked to your browser only through the cookie. If you sign in with your e-mail address, we store it in order to send you sign-in codes and purchase confirmations.

We store the content you enter in CVs and cover letters, including a photo if you upload one. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). If you voluntarily upload special categories of data (e.g. information on health or religion), we process them on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting the data.

Retention period: We automatically delete guest accounts that have not been used for 90 days, together with all their documents. Signed-in accounts remain until you delete them. In the "Account" section you can export all your data and permanently delete your account.

To send e-mails (sign-in codes, purchase confirmations), we use an e-mail service provider with whom we have a data processing agreement.

Instead of using an e-mail code, you can optionally sign in with your Google or Apple account. For this, we redirect you to a sign-in page of the respective provider. After you sign in, the provider sends us only your e-mail address and a user ID (OpenID Connect, scope email). We do not receive your name, profile picture, contacts or any other data from your account.

The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR), as you sign in at your own request. The privacy policies of Google and Apple apply on their sign-in pages: policies.google.com/privacy and apple.com/legal/privacy.

6. AI features

When you use an AI feature (import, writing help, job check, cover letter), we send the content required for it – such as your CV, an uploaded file or the job ad – to Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA, the provider of the AI model Claude. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR), as the AI feature is run at your request.

Anthropic processes the data as a processor and does not use data from API usage to train its models. Anthropic stores inputs and outputs only for a limited time to detect abuse and deletes them afterwards. The transfer to the USA is based on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses (Art. 45, 46 GDPR). Photos are not sent to the AI unless you upload an image of your CV for import.

7. LinkedIn import

You can bring your CV over from LinkedIn by uploading your LinkedIn profile as a PDF or your LinkedIn data export as a ZIP file. You download both files from LinkedIn yourself; we have no access to your LinkedIn account.

We process the ZIP file on our own server, without AI. We do not store the file, only the CV data taken from it. As with any other import, we send the PDF to our AI provider (see section 6). The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

8. Payment

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. When you make a purchase, you are redirected to a Stripe payment page. There, Stripe processes your payment data under its own responsibility; we only receive the payment confirmation, your e-mail address and the amount. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). We keep purchase records for up to 10 years due to obligations under commercial and tax law (Art. 6(1)(c) GDPR). Stripe's privacy notice: stripe.com/privacy.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can exercise many of these directly in the "Account" section. Otherwise, contact info@tlbm.de.

You can also lodge a complaint with a data protection supervisory authority, for example the Independent Centre for Privacy Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein).

10. Security

All connections are TLS-encrypted. We store sign-in codes and session keys only as hashes.

Last updated: October 2026