This page is a translation. Only the German version is legally binding.
Last updated: 25. Juli 2026
The controller within the meaning of the DSGVO (General Data Protection Regulation) is:
Agentiva
Owner: Mohsen Ghulami
Kastanienweg 7
50389 Wesseling
Deutschland
Email: hello@jobtiva.ai
No data protection officer has been appointed, as the legal requirements for a mandatory appointment are not met. You can reach us for all data protection enquiries at the email address given above.
Jobtiva (https://jobtiva.ai) is an AI-powered job search and application platform. We essentially process personal data in the following areas:
Details on purposes, legal bases, recipients and retention periods can be found in the following sections.
Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When pages are called up, Vercel processes technically necessary access data (IP address, timestamp, page called up, browser information) in order to deliver the website and to ensure secure and stable operation. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in secure and performant operation). Transfer to the USA takes place on the basis of the EU-US Data Privacy Framework (Vercel is certified) and, in addition, the EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO). A data processing agreement pursuant to Art. 28 DSGVO is in place with Vercel. Privacy information: vercel.com/legal/privacy-policy
We operate our database, authentication and file storage on a self-hosted Supabase instance on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is exclusively Germany. A data processing agreement (AVV) pursuant to Art. 28 DSGVO is in place with Hetzner; this data is not transferred to third countries. Supabase here is merely the open source software we use — Supabase Inc. (USA) receives no data whatsoever from us or our users. Legal basis: Art. 6 Abs. 1 lit. b DSGVO (provision of the platform owed under the contract) and Art. 6 Abs. 1 lit. f DSGVO (secure operation). Hetzner's privacy information: hetzner.com/de/rechtliches/datenschutz
When you call up our website, your browser automatically transmits information to our servers, which is stored in server log files: IP address, date and time of the request, URL called up, referrer URL, browser type and version and operating system. We use this data solely to ensure trouble-free operation, to analyse errors and to fend off attacks; it is not merged with other data sources. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in security and stability). The log files are deleted automatically after 30 days.
A user account is required in order to use the platform. When you register we collect your name, your email address and a password. The password is stored exclusively as a cryptographic hash — at no point do we know your plaintext password. To confirm your email address we send you a verification code by email. Using the platform requires a minimum age of 18. The legal basis for the processing is Art. 6 Abs. 1 lit. b DSGVO (establishment and performance of the user agreement).
When you use our application features, we process the content you enter or upload: CV data (e.g. work experience, education, skills), generated and edited cover letters, uploaded documents (e.g. PDF CVs), your application photo, saved job postings and the status of your applications in the application tracking (dashboard). The purpose is to provide the features you have booked: creating and managing application documents, saving jobs and tracking your applications. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (performance of the contract). This data is stored exclusively on our infrastructure in Germany (see section 3.2) and is only passed on to third parties as described in sections 7 to 12.
To create cover letters, extract CV data from PDF files, run the ATS analysis of your documents, prepare you for interviews and read out job postings, we use text AI services from the following providers: OpenAI (USA), Google (Gemini) and Anthropic (Claude). The content required for the respective feature (e.g. your CV and the job description) is transmitted to the provider concerned and processed there solely to deliver the requested service. Under our API contracts with these providers, your data is not used to train the AI models. Where a transfer to the USA takes place, it is based on the EU-US Data Privacy Framework or the EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO). Legal basis: Art. 6 Abs. 1 lit. b DSGVO (provision of the feature you requested). Use of the AI features is optional; each time you use them, you decide yourself which content you send to the AI services.
With the premium feature „KI-Bewerbungsfoto" (AI application photo) you can have a professional application photo generated from a photo you upload. Your photo is transmitted to the image model of Google Gemini. The uploaded photo is processed exclusively to generate the application photo. No biometric identification takes place, and the AI provider does not store it beyond the processing itself. The legal basis is your explicit consent (Art. 6 Abs. 1 lit. a DSGVO), which you give before using the feature and can withdraw at any time with effect for the future (see section 17). Transfers to the USA are covered by the EU-US Data Privacy Framework or the EU standard contractual clauses.
At your express request you can import your own public LinkedIn or XING profile in order to fill in your CV faster. For this we use the service Apify (Apify Technologies s.r.o.), which reads the public profile URL you provide and returns the profile data to us in structured form. The import only happens when you actively trigger it, and only for your own profile. Where Apify processes the data on infrastructure outside the EU (including in the USA), this is based on the EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO). Legal basis: Art. 6 Abs. 1 lit. b DSGVO (provision of the feature you requested).
For the job search we obtain job postings from external sources: JSearch via RapidAPI (USA) and the job board API of the Bundesagentur für Arbeit (Germany). To read individual job posting URLs we use the Jina AI Reader (Jina AI GmbH, Germany); if a posting cannot be retrieved that way, we additionally try the publicly available services 12ft.io and the Google cache. These requests run server-side through our servers: the third-party providers only see our server’s IP address and your search parameters (e.g. search term and location) or the job posting URL requested, not your IP address or identity; no direct link to you as a user is created at the third-party provider. Legal basis: Art. 6 Abs. 1 lit. b DSGVO (carrying out the job search you requested).
For the salary comparison we query salary data from external sources: the Entgeltatlas of the Bundesagentur fĂĽr Arbeit, Gehalt.de, Glassdoor and kununu. These requests are also made server-side and without any personal reference: only the job title, the region and, where applicable, the company name are transmitted, none of your personal data. Legal basis: Art. 6 Abs. 1 lit. b DSGVO (provision of the salary comparison feature).
For company research on a job posting (employer reviews, company profile, logo) we query publicly available sources: kununu, North Data and the Clearbit company search; company logos are additionally resolved via the favicon services of Google and DuckDuckGo. Only the company name or domain is transmitted — none of your personal data. Loading the logos in your browser also runs through our servers, so your IP address never reaches these providers. Legal basis: Art. 6 Abs. 1 lit. b DSGVO (provision of the company research feature).
Paid subscriptions and add-on kit packages are handled by Stripe Payments Europe Ltd. (Ireland) or Stripe Inc. (USA), including strong customer authentication (3D Secure). You enter your payment details (e.g. credit card number) directly with Stripe; we do not store any credit card or bank details. From Stripe we only receive information about the payment status and invoice-relevant data. Legal bases: Art. 6 Abs. 1 lit. b DSGVO (payment processing) and Art. 6 Abs. 1 lit. c DSGVO for retaining invoice-relevant data, which we must keep for 8 years due to commercial and tax law obligations (§ 147 AO, § 257 HGB). Transfers to the USA are covered by the EU-US Data Privacy Framework or the EU standard contractual clauses. Stripe's privacy information: stripe.com/de/privacy
We use Resend Inc. to send transactional emails (e.g. verification code, password reset, application reminders). They are sent from the EU region (Dublin, Ireland). A data processing agreement and the EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO) are in place with Resend. Legal basis: Art. 6 Abs. 1 lit. b DSGVO for emails necessary for the contract and Art. 6 Abs. 1 lit. f DSGVO for other service notices. You can unsubscribe from non-essential notifications at any time in your profile settings. Privacy information: resend.com/legal/privacy-policy
At present we only use technically necessary cookies:
| Cookie | Purpose | Category | Storage period |
|---|---|---|---|
| sb-* | Supabase auth session (login status) | Essential | Session |
| jobtiva-lang | Stores your language selection | Essential | 12 months |
| jobtiva-consent | Stores your cookie settings | Essential | 12 months |
Technically necessary cookies are stored on the basis of § 25 Abs. 2 TDDDG; the associated data processing is based on Art. 6 Abs. 1 lit. b and f DSGVO. Our cookie banner additionally provides the categories Analytics and Marketing — these categories are currently not in use, so no analytics or marketing tools are loaded. Should we use such services in future, this will only happen after your consent via the cookie banner (§ 25 Abs. 1 TDDDG, Art. 6 Abs. 1 lit. a DSGVO). You can change or withdraw your selection at any time under Cookie settings.
Some features store data exclusively in your browser (localStorage): your notes in the application dashboard and uploaded proof screenshots (e.g. proof of an application you have sent). This data never leaves your device and is not transferred to our servers. You can delete it yourself at any time by removing the website data in your browser. The storage is necessary for the feature you are using (§ 25 Abs. 2 TDDDG).
The free trial is available only once per email address. To prevent the trial from being used several times through repeated registration with the same email address, we store email addresses for which a trial has already been used in a separate table (trial_consumed_emails). This entry remains stored even after an account has been deleted. The legal basis is Art. 6 Abs. 1 lit. f DSGVO — our legitimate interest in preventing the abuse of free services. Only the email address is stored; it is not linked with any other account or application data after the account has been deleted.
You can delete your account yourself at any time in the profile settings. On deletion your personal data (profile, CVs, cover letters, uploaded documents, saved jobs, application tracking) is removed immediately and irrevocably; an active subscription is cancelled in the process. Exceptions:
As a data subject you have the following rights:
Withdrawal of consent (Art. 7 Abs. 3 DSGVO): you can withdraw consent you have given (e.g. for AI features or the AI application photo) at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
To exercise your rights, an informal email to hello@jobtiva.ai is sufficient.
Right to lodge a complaint (Art. 77 DSGVO): you also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Landesbeauftragte fĂĽr Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 DĂĽsseldorf
www.ldi.nrw.de
We take technical and organisational measures pursuant to Art. 32 DSGVO to protect your data: all connections are TLS-encrypted, stored data is kept encrypted and passwords are stored only as hashes. Access to your data in the database is strictly limited to your own account by Row Level Security — technically, no other user can read your data either. Administrative access is subject to strict access control and limited to the necessary minimum.
We use carefully selected service providers that process personal data exclusively on our behalf and on our instructions (Art. 28 GDPR). The following overview lists all recipients, the respective purpose and the place of processing.
| Provider | Purpose | Place of processing |
|---|---|---|
| Vercel Vercel Inc. | Application hosting, delivery of the website, server logs | United States third country |
| Hetzner Hetzner Online GmbH | Operation of the database and user authentication | Germany |
| OpenAI OpenAI, L.L.C. | AI-assisted text generation and document analysis | United States third country |
| Google Gemini Google Ireland Limited | AI-assisted text generation, document analysis and image generation | global third country |
| Anthropic Anthropic PBC | AI-assisted text generation and document analysis | United States third country |
| Stripe Stripe Payments Europe, Ltd. | Payment processing, subscription and invoice management | Ireland |
| Resend Resend, Inc. | Sending of transactional emails | United States third country |
| Apify Apify Technologies s.r.o. | Import of public profile data from LinkedIn and Xing at your request | Czechia |
| Jina AI Jina AI GmbH | Reading job advertisements from publicly accessible websites | Germany |
| RapidAPI Rakuten RapidAPI | Retrieval of job listings | United States third country |
| Photon Komoot GmbH | Address autocompletion during input | Germany |
| Bundesagentur fĂĽr Arbeit Bundesagentur fĂĽr Arbeit | Retrieval of job listings from the German Federal Employment Agency job board | Germany |
We update this overview whenever the set of service providers changes. The version published on this page is authoritative.
Some of the service providers listed above process data outside the European Union or the European Economic Area. These recipients are marked third country in the table.
For these transfers we rely on the European Commission Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified accordingly, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).
Please note that a level of data protection comparable to that of the European Union cannot be guaranteed in third countries. In particular, government authorities may under certain conditions access data without data subjects having effective legal remedies available. You may withdraw your consent to the use of the AI features at any time with effect for the future.
We adapt this privacy policy when our processing activities, the services we use or the legal situation change. The current version published on this page always applies. In the event of material changes we will inform you in an appropriate way, e.g. by email or via a notice in the app.