Privacy Policy

1. Controller

Uejs Kaso
Chicago Lane 5a
30539 Hannover, Germany
Email: [email protected]

No data protection officer has been appointed; the conditions of § 38 BDSG (German law) are not met.

2. Just looking at the website

Loading a page processes technically necessary connection data (IP address, time, page requested, browser and OS identifier). Without it, no page can be delivered. Legal basis: our legitimate interest in secure operation, Art. 6(1)(f) GDPR.

Fonts are served from our own server. There is no connection to Google Fonts; your IP address is not sent there.

3. What is stored in your browser

Supace sets no cookies. What is stored lives in your browser's local storage, and only what you triggered yourself:

• Sign-in — your session token, so you stay logged in.
• Chosen plan — if you click something on the pricing page.
• Sidebar, hidden questions, dismissed notices — display preferences.
• Device identifier — only after signing in, to detect multiple use of one account.
• Your privacy choice — so we don't ask again.

None of this needs consent: it is strictly necessary to provide the service you explicitly asked for (§ 25(2) no. 2 TDDDG, German law).

4. Analytics — only with your consent

If you choose "Accept all" in the notice window, we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — only then, not before. Choose "Reject all" and nothing loads, nothing is measured.

We measure pages visited, approximate location, device type and the path through the site. Your IP address is truncated (anonymize_ip). Transfer to the US to Google LLC is not excluded; Google is certified under the EU-US Data Privacy Framework. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Withdraw anytime: your choice lives in your browser. You can withdraw it by reopening the notice window and choosing "Reject all". The withdrawal takes effect going forward.

5. Account, documents and interviews

For an account we process your email address and name. If you sign in with Google, we receive the same fields from there. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

The CV, job posting and notes you upload are stored so an interview can draw answer suggestions from them. Whether an interview is recorded is a switch in the app; when it is off, nothing is stored.

6. Processors and recipients

We use the following service providers. Data processing agreements under Art. 28 GDPR are in place with all of them.

• Cloudflare (Cloudflare Germany GmbH / Cloudflare, Inc.) — delivering and protecting the website.
• Supabase (Supabase, Inc., USA) — accounts, database and document storage. Server location is Frankfurt, Germany (region eu-central-1); your account data, documents and interview history stay in the EU. The company itself is US-based, so Standard Contractual Clauses apply to any support access.
• Google Analytics (Google Ireland Limited) — only with your consent, see section 4.
• Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing, once paid plans go live. Payment details are entered directly with Stripe; we never see card numbers.
• Deepgram (Deepgram, Inc., USA) — turning speech into text during an interview, desktop app only.
• OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA) — generating answer suggestions. What is sent is the question asked and context from your own documents; your account identifier is not included.
• GitHub (GitHub, Inc., USA) — delivering app files and updates.

Where a recipient is based in the US, the transfer relies on Standard Contractual Clauses under Art. 46(2)(c) GDPR or on certification under the EU-US Data Privacy Framework.

7. Retention

• Account data — until you delete the account.
• Documents — until you remove them or delete the account.
• Interview history — until you remove it. Older sessions are removed automatically once the count allowed by your plan is exceeded.
• Saved questions — until you remove them; they are tied to the account and survive deleting a single interview.
• Invoices — ten years, statutory retention (§ 147 AO, § 257 HGB, German law).

Deleted means deleted: deleting your account first removes your documents from storage, then the account itself; everything else falls away automatically as a result. No copy is retained.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Any consent given can be withdrawn at any time, effective going forward.

For access or deletion, an email to [email protected] is enough. You can also delete your account yourself, any time, in settings.

You may lodge a complaint with a supervisory authority, in particular the one responsible for our location: the Data Protection Commissioner of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

9. Changes

We update this notice when processing changes — for example when a new service provider is added. If a purpose requiring consent is added, we ask again; a previously given consent does not cover it.