Legal
Privacy policy
This is a convenience translation. The German version is legally binding.
1. Controller
Hirezard, Inhaber Timur Aktas Gonzalez
Dollersweg 19, 44319 Dortmund, Deutschland
Email: datenschutz@hirezard.com
For any questions about data protection and to exercise your rights, contact us at datenschutz@hirezard.com.
2. The key points
- Database and servers are located in Frankfurt am Main, files are stored in EU storage.
- The website sets no cookies, has no tracking and loads no content from third-party servers.
- We only use your documents to create your application. They are not used to train AI models.
- We delete documents uploaded without an account after 24 hours and selfies after 30 days.
- Logs and error reports contain no CV texts, photos, file names or employers.
3. Visiting the website
When you open the website, our hosting provider Cloudflare processes technically necessary data (IP address, time, page requested, browser identifier) to deliver the page and fend off attacks. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR). We use no analytics or marketing tools and therefore need no cookie banner.
When you use “Try it”, we store the identifier of your preview in your browser’s local storage (key hz:trial) so you can find it again after reloading. This is necessary for the function you requested (section 25 (2) no. 2 TDDDG). The identifier expires with the preview.
4. Try it and PDF check without an account
If you upload a file, enter text or provide a job link without an account, we process this content to show you a preview. The file is kept in non-public storage in the EU and deleted after 24 hours at the latest unless you adopt it into your account by signing up. The legal basis is taking steps prior to entering into a contract at your request (Art. 6 (1) (b) GDPR). The analysis is done by an AI service (see section 8).
5. Account and login
For your account we process email address, name, language setting and login data. Login with email and password or with Google is handled by Firebase Authentication of Google Ireland Limited. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework, and EU standard contractual clauses also apply. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).
6. Documents, profile and created documents
In your account we process the documents you upload (for example CV, references, project lists), the details recognised from them, your answers to the AI coach, job ads and the CVs and cover letters created. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). References may contain health information; only upload such documents if you want to. We use them exclusively for your application.
7. Business photos
For the photo studio we process your selfies and the photos created from them. We delete the selfies no later than 30 days after upload. The photos are not used to identify a person; we do not create biometric profiles. The photos created are labelled as AI-generated. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).
8. AI processing
For the AI coach, reading documents and creating photos we use the API of OpenAI (OpenAI Ireland Ltd.). We use processing in the EU where it is available for the models used. Data may still be transferred to the USA; EU standard contractual clauses and a data processing agreement apply. According to OpenAI, data sent via the API is not used for training and is stored for up to 30 days to detect abuse. Before the first AI processing in your account we ask for your consent (Art. 6 (1) (a) GDPR). You can withdraw it in your account; manual editing remains possible. There is no automated decision-making within the meaning of Art. 22 GDPR.
9. Payments
Payments are processed by Stripe Payments Europe Ltd. (Ireland). Stripe processes payment data under its own responsibility; we only receive status, amount and a reference. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR) and our legal retention obligation (Art. 6 (1) (c) GDPR).
10. Emails
We send system emails (sign-up confirmation, purchase confirmation, reminder before a charge, cancellation and withdrawal receipts) via Resend, Inc. (USA) on the basis of EU standard contractual clauses. We only send marketing emails with your explicit consent.
11. Cancellation, withdrawal, Jobcenter and contact
If you cancel or withdraw from a contract via our public page, we store the content and time of your statement as proof (Art. 6 (1) (c) GDPR). The details for a Jobcenter cost estimate are only processed to create the PDF and are not stored.
12. Services we use
| Service | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Delivery of website and web app, protection against attacks, R2 file storage | Files in the EU; network worldwide, standard contractual clauses and Data Privacy Framework |
| Render Services, Inc. | Application servers | Frankfurt am Main |
| MongoDB, Inc. (Atlas) | Database | Frankfurt am Main |
| Google Ireland Ltd. (Firebase Authentication) | Login | EU/USA, Data Privacy Framework and standard contractual clauses |
| OpenAI Ireland Ltd. | AI coach, reading documents, photos | EU processing where available; otherwise USA with standard contractual clauses |
| Stripe Payments Europe Ltd. | Payments | Ireland |
| Resend, Inc. | System emails | USA, standard contractual clauses |
| Functional Software, Inc. (Sentry) | Error reports without content | EU (Frankfurt am Main) |
We have concluded contracts under Art. 28 GDPR with all providers who process data on our behalf.
13. Retention
| Data | Deletion |
|---|---|
| Uploads without an account (Try it, PDF check) | after 24 hours |
| Uploaded documents you do not confirm | after 7 days |
| Processed original files | after 30 days unless you choose longer storage |
| Selfies for the photo studio | after 30 days |
| Profile, documents, chosen photos | until you delete them or your account |
| Invoices and accounting records | 8 years after the end of the year of issue (section 14b UStG, section 147 AO) |
| Proof of cancellation and withdrawal | until the statutory limitation periods expire |
Backups expire after a fixed period. Deleted data is deleted again when a backup is restored.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. You find a data export and account deletion in your account; alternatively write to datenschutz@hirezard.com.
You can lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.
15. Security
Connections are encrypted (TLS). Files are kept in non-public storage and can only be reached via short-lived signed links. Staff with administrative access do not see the content of your documents by default.
Last updated: 10/10/2026 · Version 0.1