Privacy Policy

Last updated: October 1, 2026

CareerSide is operated by Iotonic GbR. This policy explains which personal data we process when you visit cside.work or use the CareerSide dashboard, why we do it, on which legal basis, who receives it and how long we keep it, in line with the EU General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG) and the transparency rules of the EU AI Act.

We do not sell your personal data. Analytics and advertising measurement only run after you have actively allowed them in the cookie settings; until then no request is made to Google Analytics. Your browser makes no request to OpenAI at all; ChatGPT Ads are measured by our server (see section 5.4).

1. Data Controller

Iotonic GbR

Kaufmannshof 15, 55120 Mainz, Germany

Email: info@iotonic.dev

Phone: +49 176 55755595

We have not appointed a data protection officer, as we are not required to. Please send any privacy question to the address above.

2. Visiting Our Website

When you open a page, your browser sends us technical data that is needed to deliver it: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Our web servers use it to deliver the page and briefly keep it in server logs to detect and fix errors and to defend against attacks.

  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering a working, secure website.
  • Retention: Server logs are kept only as long as needed for these purposes and are then deleted.

3. Your Account and the CareerSide Service

3.1 Data we process

  • Account data: your email address, your password (stored only as a hash) or, if you sign in with Google, your Google account email and name. For a Google sign-in, Google Ireland Limited confirms your identity and passes these details to us
  • CVs and documents: the CVs you upload and the documents we create from them, including every personal detail they contain
  • Job search data: your search bots and their criteria, the vacancies we find for you, their relevance scores and your application tracking
  • Billing data: your plan, credits and payment history; card details are entered directly with our payment provider and never reach us
  • Communication: support messages, feedback and the emails we send you
  • Consent records: which consents you gave or refused and when

3.2 Purposes and legal bases

  • Providing the service (account, job search, matching, CV analysis, document generation, notifications, support): Art. 6(1)(b) GDPR, performance of our contract with you.
  • Payments and invoicing: Art. 6(1)(b) GDPR and, for keeping invoices, Art. 6(1)(c) GDPR together with German commercial and tax law.
  • Error monitoring and security: Art. 6(1)(f) GDPR. Our legitimate interest is a stable and secure service.

You do not have to give us your data, but without account data and a CV we cannot provide the service.

4. Artificial Intelligence in CareerSide

CareerSide is an AI system. We use large language models and text embeddings for the following features:

  • CV analysis: extracting your skills, experience and preferences from your CV.
  • Vacancy matching: comparing your CV with job vacancies and giving each vacancy a relevance score from 1 to 9.
  • Document generation: writing tailored CVs and cover letters, and adjusting or translating your documents.

4.1 Which data is sent to AI providers

For CV analysis, vacancy matching and document generation we send the full text of your CV, including the personal details it contains, together with the vacancy text to the AI provider. For adjusting and translating a document we remove your personal details before sending it. To find matching vacancies we also turn your CV text into embeddings (numerical representations) using OpenAI's embedding service.

  • Providers: Anthropic (Claude models) and OpenAI (GPT models, the models behind ChatGPT), which we use through their business APIs as processors bound by data processing agreements (Art. 28 GDPR). Under these terms the content we send is not used to train their models.
  • Legal basis: Art. 6(1)(b) GDPR, as these features are the service you use.
  • Transfers outside the EU: see section 7.

4.2 Relevance scores and profiling

The relevance score is profiling within the meaning of Art. 4(4) GDPR: it assesses how well a vacancy fits your profile. It decides which vacancies we show you first and which ones appear in your job digest. We rank and select vacancies on the basis of our legitimate interest in showing you the most relevant ones first (Art. 6(1)(f) GDPR). It is not a decision that has legal effects on you or similarly significantly affects you (Art. 22 GDPR): we do not decide about job applications, nothing is sent to employers on the basis of the score, and you can always see and open every vacancy we found. You can object to this processing at any time (Art. 21 GDPR, see section 9).

4.3 AI-generated content

CVs, cover letters, summaries and recommendations that CareerSide produces are generated by AI. They can contain mistakes. Please check every document before you send it to an employer; you remain responsible for what you submit.

6. Recipients

Besides the providers described above, these service providers process personal data for us as processors (Art. 28 GDPR), only on our instructions:

  • Hosting and infrastructure: Hetzner Online GmbH (Germany) and Webdock.io ApS (Denmark), whose servers run cside.work, the dashboard and our databases.
  • Email delivery: Resend, Inc. (USA) and our own mail server, for account, notification and digest emails.
  • Payments: Stripe Payments Europe, Ltd. (Ireland), which processes card and payment data. For fraud prevention and its own legal obligations Stripe also acts as an independent controller.
  • Sign-in with Google: Google Ireland Limited, if you choose to sign in with your Google account.
  • Error monitoring: Sentry (Functional Software, Inc., USA), which receives error reports with your account ID and username when something fails.
  • AI providers: see section 4.
  • Authorities: only where we are legally required to disclose data.

To find vacancies we crawl public job boards. No data about you is sent to them.

7. Transfers Outside the EU

Some of the providers above (Google, OpenAI, Anthropic, Resend, Stripe and Sentry) are based in the USA or use sub-processors there. Where a US recipient is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Otherwise, and in addition, it relies on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the relevant safeguards.

8. How Long We Keep Your Data

  • Account, CVs, documents and job search data: as long as your account exists. After you delete your account, most data is deleted within 30 days.
  • Invoices and payment records: as long as German commercial and tax law requires, generally up to 10 years.
  • Google Analytics 4: at most 14 months; cookies expire after 2 years.
  • Google Ads Click ID: Cookie expires after 90 days; a click ID stored with your account is deleted 100 days after it was captured
  • ChatGPT Ads click reference: Cookie expires after 90 days; a click reference stored with your account is deleted 100 days after it was captured; what OpenAI keeps of the sign-up event is governed by its privacy policy.
  • Your cookie choice: 365 days, after which we ask again.

9. Your Rights

  • Access to your personal data (Art. 15 GDPR)
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability: receiving your data in a machine-readable format (Art. 20 GDPR)
  • Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR), in the cookie settings or by contacting us
  • Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one listed in section 11

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), including the profiling described in section 4.2, you can object at any time on grounds relating to your particular situation. We then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves legal claims.

To exercise these rights, contact us via our support page or email info@iotonic.dev.

10. Changes to This Policy

We update this policy when our processing changes. The date at the top shows the current version.

11. Contact and Supervisory Authority

  • Email: info@iotonic.dev
  • Mail: Iotonic GbR, Kaufmannshof 15, 55120 Mainz, Germany

Supervisory Authority:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
Website: www.datenschutz.rlp.de

Back to Home