1. Controller (Verantwortlicher)

The Controller within the meaning of the GDPR (DSGVO) is:

Loistava Holding UG (haftungsbeschränkt)

Asternring 9

15732 Schulzendorf

Germany

Email: [email protected]

2. Types of Data Processed

Inventory Data: Names, email addresses (for account creation).

Content Data: Resumes, job descriptions, voice/text inputs (processed for the interview simulation).

Usage Data: Access times, device information, IP addresses.

3. Purpose and Legal Basis (Art. 6 GDPR)

We process your data for the following purposes and based on the following legal bases:

Providing the Service: To run the interview simulation. Legal Basis: Art. 6(1)(b) GDPR (Performance of Contract).

Security & Improvement: To ensure server stability and improve AI performance. Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest).

Payment Processing: If you subscribe to a paid plan. Legal Basis: Art. 6(1)(b) GDPR.

4. Data Transfer to Third Parties & Third Countries (Crucial for AI)

4.1. AI Providers: We use external AI models (e.g., OpenAI, Anthropic) to generate interview questions. These providers serve as Processors (Auftragsverarbeiter).

4.2. Transfers to the USA: Some service providers are located in the USA. Data transfer to the USA is based on:

The EU-US Data Privacy Framework (if the provider is certified), OR
Standard Contractual Clauses (SCCs) approved by the EU Commission, ensuring an adequate level of data protection.

4.3. By using the service, you acknowledge that your input data (answers/resumes) will be sent to these third-party AI providers for processing.

5. Storage Duration

We store your personal data only as long as necessary for the provision of the service or as legally required (e.g., tax retention periods). You may delete your account and associated data at any time via the user settings.

6. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

Right of Access (Art. 15 GDPR): You can request information about your stored data.
Right to Rectification (Art. 16 GDPR): You can correct wrong data.
Right to Erasure (Art. 17 GDPR): "Right to be forgotten."
Right to Restriction of Processing (Art. 18 GDPR).
Right to Data Portability (Art. 20 GDPR).
Right to Object (Art. 21 GDPR): You can object to processing based on legitimate interest.

7. Hosting

This service is hosted on servers provided by Firebase (Google Cloud Platform). A Data Processing Agreement (AV-Vertrag) has been concluded with the hosting provider.

8. Cookies and Tracking

We use strictly necessary cookies to enable the login functionality and session management. Legal Basis: Art. 6(1)(f) GDPR. Your cookie choice itself is stored in your browser under cookie-consent (a necessary entry that remembers your decision).

Product analytics & reach measurement — PostHog (EU-hosted, Frankfurt; eu.i.posthog.com). Two-tier:

(1) Basic reach measurement: an anonymous, cookie-free measurement (page views, visitor counts) runs without consent — nothing is stored on or read from your device, so §25 TTDSG does not apply; legal basis Art. 6(1)(f) GDPR (legitimate interest in privacy-minimising reach measurement).
(2) Extended analysis: persistent cookies for cross-session insights and session replay run only after your explicit consent via the banner (“Accept”); legal basis Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG. These PostHog analytics cookies are set only after you accept. “Decline” disables all analytics.

A data-processing agreement and EU hosting are in place; inputs to password fields are masked in session replay. If you accept the marketing category, we additionally load Google Tag Manager (marketing/advertising tags); it is not loaded otherwise.

Privacy Policy