Privacy Policy

Last updated: June 29, 2026

1. Data Controller

Q-Bridges GmbH
Berlin, Germany
Email: contact@q-bridges.com
Responsible under Art. 4(7) GDPR.

2. Data We Collect

• Account data: name, email, phone (optional), password (hashed with Argon2id)
• Profile data: CV, work experience, skills, languages, salary expectations, work preferences
• Usage data: job searches, saved jobs, applications, login timestamps, alert preferences
• Technical data: IP address, browser/user agent, session tokens

3. Purpose of Processing

• Job matching: match your profile against available positions (Art. 6(1)(b): contract)
• Email alerts: notify you of new matching jobs (Art. 6(1)(a): consent)
• Security: protect against fraud, abuse, and unauthorized access (Art. 6(1)(f): legitimate interest)
• Payment: process subscription payments via Stripe (Art. 6(1)(b): contract)
• Analytics: understand how users interact with the platform, if consent given (Art. 6(1)(a))

4. Data Retention

Account data is kept while your account is active. After account deletion, all personal data is permanently removed within 30 days. Anonymized audit logs may be retained for 12 months for security purposes.

5. Your Rights (Art. 15-22 GDPR)

• Access (Art. 15): download all your data via Account Settings → "Download My Data"
• Rectification (Art. 16): correct your data in Profile Settings at any time
• Erasure (Art. 17): delete your account via Account Settings → "Delete Account"
• Data portability (Art. 20): export your data as ZIP (HTML + CSV + JSON)
• Objection (Art. 21): object to processing based on legitimate interest
• Withdraw consent: manage email alerts at any time in your account settings

To exercise these rights: use the self-service features in your account, or contact contact@q-bridges.com.

6. Third-Party Services

• Stripe (stripe.com): payment processing, PCI DSS Level 1 compliant. Data: payment card details (we never see your full card number)
• Brevo (brevo.com): email delivery for alerts and notifications. Data: email address, name
• Anthropic PBC - AI language model (Claude API) for generating application emails and CV coaching. Data processed: profile excerpts for each prompt. Data is not used for training AI models. Transfers to the US are governed by Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Hetzner Online GmbH (hetzner.com) - designated hosting provider for server infrastructure in Germany (EU), once the production environment is migrated. No third-country transfer.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

7. Security Measures

We protect your data with: Argon2id password hashing, AES-256-GCM encryption for sensitive data, TLS/HTTPS for all connections, 30-minute session timeouts, rate limiting on authentication endpoints, HttpOnly + SameSite cookies, and comprehensive audit logging.

8. Cookies

We set exactly two first-party cookies. Both are technically necessary; there is no analytics, advertising or tracking cookie, and no third party sets a cookie on our pages.

• session_token - keeps you signed in. Set only after you log in or register. Lifetime: 30 days if you tick “Stay signed in”, otherwise 7 days. HttpOnly, SameSite=Lax, Secure in production.
• mjf_session - signed application session: interface language, plan display, the intermediate state of a Google/LinkedIn sign-in (CSRF protection) and one-off notices. Can be created before you log in, for example when you pick a language. Lifetime: 30 days. HttpOnly, SameSite=Lax, Secure in production.

Because we only use technically necessary cookies, there is no consent banner. You can delete both cookies at any time in your browser settings; you will then simply be signed out.

Our pages load no fonts, scripts, icons or images from third-party servers. Everything is served from our own servers, so your IP address is not passed to any third party when a page loads.

9. Use of AI

We use AI in three places. This section describes what happens technically.

• Job matching: your profile is compared with job postings and each posting receives a match score. This runs on our own servers; no profile data leaves them for this purpose.
• Coaching features (CV, cover letter, interview preparation, salary negotiation): when you use one of these, excerpts of your profile and your input are sent to Anthropic PBC (Claude API) and a text is generated. The data is not used to train AI models. See section 6.
• Employer dossiers: the dossier texts on company pages were generated by AI and are not editorially reviewed. They are labelled as such.

All photorealistic images of people on our public pages are AI-generated and labelled accordingly; the product screenshots are genuine screenshots of the running application. The community chat is not an AI system: the messages there are written by users.

10. International Transfers

Your data is stored on servers in Germany (EU). Third-party services (Stripe, Brevo, Anthropic) may process data in the EU and US under Standard Contractual Clauses (Art. 46(2)(c) GDPR).

11. Supervisory Authority

You have the right to lodge a complaint with the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Friedrichstr. 219, 10969 Berlin.

12. Changes

We may update this policy. The "last updated" date will reflect any changes. Continued use of the service after changes constitutes acceptance.

Third-party logos and trademarks (LinkedIn, Indeed, StepStone, XING, Glassdoor, Monster, Michael Page, Korn Ferry, Robert Walters, Mercuri Urval, Heidrick & Struggles, Egon Zehnder) are the property of their respective owners and are used for identification purposes only. MyJobFinder AI / Q-Bridges GmbH is not affiliated with these companies.