Privacy Policy

OfferLoop Privacy Policy Last updated: 9 October 2026. This is a free pilot.

Who we are. OfferLoop is operated by its founder from Germany, as a free pilot. The operator's registered name and postal address are published on the Impressum as soon as they are confirmed, before the first public account; until then legal@offerloop.app reaches the operator directly. Questions or requests: privacy@offerloop.app. We are the controller of your data under the GDPR.

What we hold, and why.

• Your account: e-mail address, and if you sign in with Google, your Google account identifier and name. We use it to log you in and to contact you about the service.
• What you give us: your CV and other documents, LinkedIn export, the answers you give in the onboarding interview, any interview recordings you choose to upload, and a photo you choose to add to your designed CV. We use them to build your profile and to write your application documents.
• What we create: your profile, vacancy scores and the reasons behind them, generated CVs, cover letters, tailoring notes, interview prep material and audio, transcripts, and your application statuses.
• When you order a submission: the answers you give in the application questionnaire (for example your legal name, phone, address, citizenship, work permits, notice period and salary expectation), and the login and password of an application-portal account we create for you. We keep them with the order and use them only to submit the applications you ordered.
• Technical records: IP address, browser type, request logs. We use them to keep the service secure and working.

Why we are allowed to. Most of it because you asked us to provide the service (a contract between you and us). Security logging because we have a legitimate interest in keeping the service safe. Your CV and interview recordings may contain sensitive information such as health, religion or ethnic origin; we process that only with your explicit consent, which you give at upload and can withdraw at any time.

Who else sees it.

• Hetzner Online GmbH (Germany) hosts the servers and backups.
• Z.ai (Zhipu AI) (China) runs the free model (GLM-4.5-Flash) that our software asks first. Retention: not stated by the vendor. Transfer basis for data sent to China: not stated by the vendor.
• Groq, Inc. (United States) runs a free Qwen model that is asked next, when the first model does not answer. Retention: not stated by the vendor. Transfer basis for data sent to the US: not stated by the vendor.
• OVHcloud (France) runs a second Qwen model on its AI Endpoints service, asked after that. The processing stays in France (EU). Retention: not stated by the vendor.
• Anthropic PBC (United States) runs the AI models that read a job description and your profile and write your documents. It is asked last, when none of the free models above can answer. Under Anthropic's commercial terms, your content is not used to train their models, and it is deleted from their systems within 30 days. If their automated safety systems flag a request, they may keep it for up to two years. Transfers to the US are covered by Standard Contractual Clauses in Anthropic's data processing agreement.
• Resend sends the login and notification e-mails.

That is the complete list of the services that process your data for us. We do not use analytics, advertising, tracking pixels or third-party fonts.

What goes to an employer. Only what you order. When you order us to submit an application, the employer and the application portal it uses (for example Greenhouse, Lever or Workday) receive the documents you confirmed for that vacancy and the questionnaire answers its form asks for, in your name and with your e-mail address. Where the portal needs an account, we create one in your name and give you its password. From then on the employer is a separate controller of that data: what it keeps and for how long is set by its own privacy policy, and deleting your OfferLoop account does not delete it there. If the employer is outside the EU, the data goes there because you asked us to apply for that job. Nothing goes to an employer without your order.

What we send to the AI, and what we do not. We send your job description and a limited slice of your profile - the experience, skills and framing needed to write the document. We do not send your e-mail address, your salary expectation, your photo, your other applications, your interview recordings or your interview transcripts. Interview audio is transcribed on our own servers and never leaves them. The models are asked in this order: Z.ai, Groq, OVHcloud, then Anthropic. A model that fails passes the same text on to the next one, so more than one of these vendors can have received a given request.

We do not train anything on your data. Not our own models. Anthropic does not train on it either (its commercial terms). Whether Z.ai, Groq or OVHcloud use requests for training: not stated by the vendor. Your documents are yours.

How long we keep it. Your account and everything in it: until you delete it. Interview audio recordings: 30 days, then automatically deleted (the transcript stays). Vacancy listings: 90 days. Security logs: 90 days. Backups: 35 days. When you delete your account we erase your data within 7 days and it disappears from backups within 35 days.

Your rights. You can get a copy of everything we hold (Settings -> Export, produces a zip), correct it (Settings -> Profile), delete it (Settings -> Delete account, with an e-mail confirmation), withdraw a consent, restrict or object to processing, and complain to a supervisory authority. We answer within 30 days and usually within minutes.

Cookies. We set three cookies and they are all necessary: one keeps you logged in, one protects against cross-site request forgery, one holds your sign-in in progress. We set nothing for analytics or advertising, so there is no cookie banner to click.

Security. Traffic is encrypted with TLS. Your profile and interview transcripts are additionally encrypted in the database. Uploads are stored outside the web server's reach and are scanned before use. Access is limited to one operator.

Children. The service is for people aged 18 and over.

Changes. If we change this policy we will e-mail you before the change takes effect.

Where to exercise those rights. Both live on one page: /app/settings/data.

• Export: /app/settings/data produces a zip of everything we hold about you. The download link is single-use and expires after 24 hours.
• Delete: /app/settings/data also deletes your account. You confirm by typing DELETE and then by clicking a link we e-mail you. It cannot be undone. We erase your data within 7 days and it is gone from backups within 35 days.
• Correct: /app/profile, where every fact shows where it came from and can be changed or removed.

One thing worth repeating in plain words. Your CV, your uploaded documents and your interview recordings are read by large language models run by Z.ai (China), Groq (United States), OVHcloud (France) or Anthropic PBC (United States), asked in that order, and what we extract from them is stored in our database until you delete your account. Interview audio is transcribed on our own servers and is not sent to any of them. If you do not want that, do not upload it: everything else in the product still works.