What Career Sentinel does with your data, in plain language first and legal detail after. Auf Deutsch →
The short version
1. Who is responsible
Maher Chehab
Schönestraße 23
70372 Stuttgart-Bad Cannstatt, Germany
Email: careersentinel.app@gmail.com
No data protection officer is appointed. Career Sentinel is run by one person and does not meet the thresholds in Art. 37 GDPR / § 38 BDSG.
2. Your account
What: your email address, the time you signed up, and a session cookie.
Why: to give you an account and keep you logged in. There is no password. You get a one-time link by email that works for 15 minutes, and the session then lasts 30 days.
Legal basis: Art. 6(1)(b) GDPR, performance of a contract (providing the service you asked for).
The cookie is strictly necessary under § 25(2) TTDSG, so it needs no consent banner. It holds a signed reference to your account and nothing else. We set no other cookies.
3. Your CV and the answers you give
The file itself is never stored. You upload a PDF, we read the text out of it, and the file is gone. We keep only the structured details: your professional headline, years of experience, roles, skills, languages, education and work history, and the contact email found in the CV.
We also keep the answers you give us: your German level, your city, whether you are looking for a career role or income work, a short description of your situation, and anything you write in the "in your own words" box.
About the situation field: what you write there may touch on your residence or visa status. You decide what to put in it. Write as little as you like. It is used to judge whether a job is realistically open to you and to write a truthful line about your work authorisation, nothing else.
Why: to restructure your CV for the German market, to score job postings against your actual situation, and to write application documents for specific jobs.
Legal basis: Art. 6(1)(b) GDPR. This is the service.
4. AI processing, and the transfer to the USA
This is the part worth reading properly.
Career Sentinel uses Anthropic PBC (USA) to read your CV, to score job postings against your profile, and to write your tailored CV and cover letters. Doing that means your CV content and your answers are sent to Anthropic's servers in the United States.
This is a third-country transfer under Art. 44 ff. GDPR. The safeguard is the Standard Contractual Clauses (Module Two, controller to processor), which form part of Anthropic's Data Processing Addendum. The USA does not have an adequacy decision that covers this on its own, so the SCCs are what the transfer rests on.
Anthropic does not use data sent through its API to train models. That is different from the consumer Claude product.
Legal basis: Art. 6(1)(b) GDPR, with Art. 46(2)(c) for the transfer.
If you are not comfortable with your CV leaving the EU, Career Sentinel is not usable without it. There is no version of this service that does not send your CV to an AI model.
5. Scores and why they are not decisions about you
Every morning we score job postings against your profile and keep the score and the one-line reason for it. We also record which jobs you opened and what you marked as applied, interviewing or rejected, so your tracker works.
These scores are about job postings, not about you. No score decides anything. Nothing is sent to an employer, no application is submitted, and nobody but you sees the result. You decide what to apply for and you press send yourself.
Because of that, this is not automated decision-making with legal or similarly significant effect under Art. 22 GDPR. If you think a score is wrong, tell us, and you can hide any match.
Legal basis: Art. 6(1)(b) GDPR.
6. Where your morning report goes
Email (the default). Sent via Brevo (Sendinblue GmbH / Brevo SAS, EU), which processes your email address and the message. Brevo rewrites links in the message for click tracking, which means Brevo can see which jobs you clicked. We cannot switch that off on our plan. Links we send you by email carry a sign-in token that expires after 48 hours, deliberately short for this reason.
Telegram (optional). If you connect it, we store your Telegram chat ID and send the report there instead. That means Telegram (Telegram FZ-LLC) processes the message. You can disconnect at any time in Settings or by sending /stop to the bot.
Legal basis: Art. 6(1)(b) for email; Art. 6(1)(a) consent for Telegram, withdrawable at any time.
7. Hosting
Career Sentinel runs on Railway (Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA). The machines it runs on, and the database holding your profile, your matches and your documents, are in Railway's EU West region in Amsterdam, Netherlands. Your data sits in the EU.
Railway is a US company, so its staff can in principle reach that infrastructure from outside the EU for support and maintenance. Where that happens it is a third-country transfer under Art. 44 ff. GDPR, and the safeguard is the Standard Contractual Clauses (Module Two, controller to processor) in Railway's data processing terms. Railway is certified to SOC 2 Type II.
Legal basis: Art. 6(1)(b) GDPR for the hosting, with Art. 46(2)(c) for any such access.
Server logs (IP address, time, requested page) are kept for a short period to keep the service running and secure, on the basis of Art. 6(1)(f) GDPR, our legitimate interest in operating a working and reasonably secure service.
8. Counting how the product performs
We record things like "a scan ran", "a document was generated", "a score threshold was changed". These records are deliberately content-free. They contain no CV text, no job titles, no company names, no email addresses.
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in knowing whether the product works. You can object under Art. 21.
9. The research consent, which is genuinely optional
During the beta we ask whether we may look at your matches and the documents written for you, so we can judge whether the scoring is any good, and email you once or twice to ask what was wrong with it.
This is optional and the product is identical either way. Saying no costs you nothing and unlocks nothing. You can change it in Settings at any time and it stops immediately.
Legal basis: Art. 6(1)(a) GDPR. Withdrawal does not affect processing that already happened (Art. 7(3)).
9b. The launch notification
If you reach the app before you are invited, we offer to tell you once when it opens to everyone. Only if you press that button do we store your email address and the time. Nothing else, no IP address, no questions.
One email, at launch. Not a newsletter, never passed to anyone. Every email has a one-click link to remove yourself, with no account and no questions asked.
Legal basis: Art. 6(1)(a) GDPR, consent, withdrawable at any time (Art. 7(3)).
10. How long we keep things
Deleting: Settings, "Delete my account and all data". It removes your account, profile, every score and reason, your application history and every document we generated. It is immediate and cannot be undone.
11. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where we rely on consent, you can withdraw it at any time (Art. 7(3)).
Email careersentinel.app@gmail.com and we will answer within a month. For erasure you do not need to ask, the button does it.
You can also complain to a supervisory authority (Art. 77). Ours is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.
12. Changes
Career Sentinel is in beta and changes often. If we change how we handle your data in a way that matters, we will tell you by email rather than quietly editing this page.
Last updated: 23 October 2026.