1. Data Controller

Responsible for data processing in accordance with the Swiss Federal Act on Data Protection (nFADP, in force since September 1, 2023) on bewerbungsapp.ch is:

Serge Bühler (sole proprietorship)
Amlehnstrasse 54
6010 Kriens
Schweiz
E-Mail: [E-Mail wird geladen...]
WhatsApp: +41 78 480 66 24

This privacy policy applies equally to the platforms bewerbungsapp.ch and jobhani.ch, which are operated by the same operator and share a common technical infrastructure.

As this is a sole proprietorship with no appointed data protection officer, please direct data protection inquiries directly to the data controller.

2. Collection and Storage of Personal Data

2.1 When Visiting the Website

When accessing bewerbungsapp.ch on the web, we use Umami, a privacy-friendly, cookieless analytics tool. Umami collects only anonymized, aggregated statistics (e.g. page views) without cookies, without storing IP addresses and without cross-device tracking; no profiles are built and no advertising cookies are set. In the native app (iOS & Android) this analytics tool is disabled.

Functional cookies: Supabase (our authentication service) sets a technically necessary session cookie upon login to maintain your session. This cookie is strictly required for using the service and contains no tracking information. It is automatically deleted upon logout or session expiry.

2.2 Upon Registration

When registering via Google or Microsoft OAuth or email/password, we collect:

• Email address (to identify your account)
• Name (optional, from your Google/Microsoft profile)
• Profile picture URL (optional)

Legal basis: Contract performance (Art. 31 para. 2 lit. a nFADP), registration is a prerequisite for using the paid services.

2.3 When Using the App

During use, we store:

• CV data (data you enter or AI-extracted data such as name, address, work experience, education, languages, skills)
• Cover letters (AI-generated or edited by you)
• Job listings (inserted by you, imported, or saved via job search)
• Documents (work references, diplomas, certificates, stored locally in browser or in the cloud)
• Signature (uploaded or photographed by you as an image)
• Photos (application photo, photographed documents, temporarily transmitted for processing)
• Usage statistics (AI generations, downloads, subscription status)
• Fit analyses (AI evaluation of the match between your profile and a position)
• CV analyses (AI-supported quality check of your CV)

Legal basis: Contract performance, this data is required to provide the agreed services.

2.4 Local Storage

A significant portion of your data is stored locally in your browser (localStorage / IndexedDB). This data only leaves your device when you explicitly use a function that requires server transmission (e.g., AI generation, PDF download, email sending, cloud storage).

2.5 Data Upon Account Deletion

When your account is deleted, we retain your email address and usage statistics (counters for AI generations and downloads) in a separate table for abuse prevention. This prevents users from resetting the free quota by repeatedly creating and deleting accounts.

Legal basis: Legitimate interest (Art. 31 para. 1 nFADP), protection against systematic abuse of our service offering.

3. Purpose of Data Processing and Legal Bases

We process your data for the following purposes:

4. Automated Individual Decisions and Profiling

BewerbungsApp does not use automated individual decisions that have legal effects on you or similarly significantly affect you (Art. 21 nFADP).

The fit analysis (AI evaluation of the match between your profile and a job posting) constitutes profiling. This profiling serves exclusively to provide you with suggestions for designing your cover letter. It does not result in any automated decision, all content is reviewed by you before sending and can be adjusted or discarded.

The same applies to the CV analysis: improvement suggestions are non-binding recommendations that you are free to adopt or ignore.

5. Disclosure of Data to Third Parties (Data Processors)

We do not sell your data to third parties and do not share it for advertising purposes. Data is only transmitted to the following services (data processors) insofar as this is technically necessary for providing our functions.

6. Data Transfer Abroad

All AI processing (cover letters, analysis, extraction, text recognition) takes place exclusively in the EU, on servers in Germany (amazee.ai EU gateway, our own OCR container at Hetzner) or, as a fallback, in France (Mistral OCR). Your application content is NO LONGER transferred to the USA. Some technical services are operated by companies based in the USA (Supabase, Google, Microsoft, Resend); however, their data processing is handled as follows:

• EU data location: The database (Supabase) stores all data in Frankfurt (Germany), and Microsoft processes data in EU data centers. This data does not leave the EU/EEA.
• Only at your request / minimal: Google (Gmail) and Microsoft (Outlook) are used exclusively when you yourself enable email sending via OAuth. Only your email address is transmitted to Resend for system notifications.
• EU Standard Contractual Clauses (SCC) & minimal data transmission: SCCs are in place for the companies based in the USA; only the data strictly necessary for the respective function is transmitted.

Services with server locations in the EU/EEA (amazee.ai gateway Germany, own OCR container Germany, Supabase Frankfurt, Hetzner Germany, Stripe Ireland, Mistral AI France, Apify Czech Republic) do not require special safeguards, as Switzerland recognizes EU/EEA data protection as adequate.

7. Native Apps (iOS & Android)

BewerbungsApp is also available as a native app for iOS and Android (via Capacitor). The app uses the same server infrastructure as the web version. Additionally:

• Camera & microphone access: Only upon your explicit request (scanning documents, taking photos, photographing signatures, and voice input in text fields). Speech recognition runs on-device, no audio recordings are sent to our servers. Permission can be revoked at any time in device settings.
• No background activity: The app does not send data without your active interaction
• No push notifications: Currently no push notifications are sent
• No location data: The app does not collect location data

8. Data Retention Period

• Account data: Until you delete your account
• Application documents (cloud): Until manually deleted by you or 30 days after subscription cancellation
• Cloud data after subscription cancellation: 30-day grace period, then automatically and irrevocably deleted
• Abuse prevention (after account deletion): Email address and usage counters are stored indefinitely
• Payment data at Stripe: According to statutory retention periods (10 years, Art. 958f CO)
• Local browser data: Until you manually clear browser storage or change devices
• Server logs: Maximum 30 days (automatically rotated)

9. Your Rights

Under the Swiss Data Protection Act (nFADP), you have the following rights:

• Right of access (Art. 25 nFADP): You can request information about the data stored about you at any time.
• Right to rectification (Art. 32 para. 1 nFADP): You can request the correction of inaccurate personal data.
• Right to deletion: You can request the deletion of your data. Delete your account in the Settings, all cloud data will be immediately and irrevocably deleted. The retention of the email address for abuse prevention remains unaffected (legitimate interest).
• Right to data portability (Art. 28 nFADP): You can request the release of your data in a common electronic format. The app offers the export of your documents as PDF or DOCX at any time.
• Right to object: You can object to the processing of your data, provided there is no overriding legitimate interest on our part.
• Withdrawal of consent: OAuth authorizations (Gmail, Microsoft) and email connections can be revoked at any time in the Settings.

To exercise your rights, contact us at:
E-Mail: [E-Mail wird geladen...]
WhatsApp: +41 78 480 66 24

10. Right to Complain

If you believe that the processing of your personal data violates the Data Protection Act, you can file a complaint with the Federal Data Protection and Information Commissioner (FDPIC):

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
Switzerland
www.edoeb.admin.ch

11. Security Measures

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse (Art. 8 nFADP):

• TLS/SSL encryption (HTTPS) for all connections
• Encrypted password storage (bcrypt)
• OAuth tokens are stored encrypted on the server side
• Row Level Security (RLS) at database level, each user can only see their own data
• CSRF protection and rate limiting against automated attacks
• Content Security Policy (CSP) to prevent XSS attacks
• Regular security updates and audits
• Server location in Germany (Hetzner Cloud), physical access protection

12. Compliance with the Google API Services User Data Policy

The use and transfer of information received from Google APIs to other apps is carried out in compliance with the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for:

• Targeted advertising
• Sale to data brokers
• Sharing with information resellers
• Creditworthiness determination or lending
• Training AI models

13. Changes to this Privacy Policy

We reserve the right to update this privacy policy at any time to adapt it to changed legal requirements or changes to our services. The current version is always available on this page. Registered users will be notified by email of significant changes.

14. Contact

For questions about data protection, please contact:
Serge Bühler
E-Mail: [E-Mail wird geladen...]
WhatsApp: +41 78 480 66 24