Privacy Policy

1. Data Controller

The controller responsible for the processing of your personal data in accordance with the General Data Protection Regulation (GDPR) is:

Kariyan (kariyan.de) is a product of Gajera IT Solutions.

2. Personal Data Kariyan Collects

Kariyan collects the following categories of personal data:

• Account data: email address, password hash for password accounts, and a LinkedIn or Google OAuth identity if you use social sign-in
• Profile & CV data: name, work history, education, skills, languages, desired salary and location
• Voice onboarding: during a voice session your audio is streamed to Google Gemini Live (a Google subprocessor) for transcription and is not stored by us. Only the transcript and the information we extract are kept.
• Profile photo: optional photo uploaded for CV documents, stored securely in AWS S3 (Frankfurt). You can delete your photo at any time from Settings.
• Job application data: prepared CVs, cover letters, application emails and their delivery status
• Form submission data: when using automated form submission, browser automation fills application forms on your behalf. Screenshots of submitted forms are captured for your records. No data is stored on external company application pages beyond what you authorize.
• Usage data: pages visited, feature interactions, search queries, error logs
• Payment data: subscription plan, billing address, last 4 digits of card (full card data held by Stripe)
• Referral data: if you use our referral program, your unique referral code and referral link; and, for each person you refer, their account status, activation milestones (e.g. signup date, email verification, first application), and signup IP address, used to determine and safeguard referral rewards

3. Legal Bases for Processing

• Art. 6(1)(b) GDPR, Contract: Processing necessary to provide the Kariyan service you signed up for (account creation, job search, application sending).
• Art. 6(1)(a) GDPR, Consent: Voice recording processing; marketing communications. You may withdraw consent at any time.
• Art. 6(1)(f) GDPR, Legitimate interest: Security monitoring, fraud prevention, system reliability.
• Art. 6(1)(c) GDPR, Legal obligation: Tax and accounting records as required by German law.

4. Third-Party Processors

Provider use depends on the feature and your consent choices. For details about applicable processing agreements and transfer safeguards, contact privacy@kariyan.de.

5. Data Retention

• Account data: Retained for the lifetime of your account, then deleted within 30 days of account deletion.
• Voice onboarding: Audio is streamed to Google Gemini Live for transcription and is not stored by us. The transcript and extracted preference data are retained with your profile and deleted when you delete your account.
• Application documents: CVs and cover letters retained for 2 years from creation.
• Payment records: Retained for 10 years as required by German commercial law (HGB §257).
• Usage logs: Retained for 90 days for security purposes.

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Art. 15, Right of access: You may request a copy of all personal data we hold about you.
• Art. 16, Right to rectification: You may request correction of inaccurate or incomplete data.
• Art. 17, Right to erasure ("right to be forgotten"): You may request deletion of your data (subject to legal retention obligations).
• Art. 18, Right to restriction: You may request that processing be restricted in certain circumstances.
• Art. 20, Right to data portability: You may request your data in a structured, machine-readable format.
• Art. 21, Right to object: You may object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@kariyan.de. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, in particular the data protection authority of the German federal state where you reside.

You may also lodge a complaint with your local data protection supervisory authority. For residents of Saxony, this is the Sächsische Datenschutz- und Transparenzbeauftragte: www.saechsdsb.de. A federal list of all supervisory authorities is available at www.bfdi.bund.de.

7. Cookies

Essential cookies are used for session management and authentication. See our Cookie Policy for full details.

8. Data Protection Officer

As a small business with fewer than 20 employees regularly processing personal data, Kariyan is not required under Art. 37 GDPR to appoint a Data Protection Officer. For all privacy-related inquiries, contact us directly at privacy@kariyan.de.

9. International Data Transfers

Core application infrastructure is hosted in the EU. Optional analytics and advertising services are operated by international providers; EU hosting of application data does not mean every provider processes data exclusively in the EU.

Processing locations and any international-transfer arrangements depend on the provider and service configuration. Contact privacy@kariyan.de for information about the safeguards applicable to your data. You can manage optional analytics and advertising through Manage cookies.

10. Automated Decision-Making (Art. 22 GDPR)

Kariyan uses automated systems and language models to:

• Match your profile against job listings
• Generate tailored CVs, cover letters, and application emails
• Score job relevance based on your stated preferences

These processes assist in preparing application documents but do not produce legally binding or similarly significant decisions without your review. You always retain the ability to review, edit, and approve or reject any generated output before it is sent. No application is submitted without your explicit consent (in approval mode) or within rules you have explicitly defined (in autopilot mode).

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority within 72 hours of becoming aware of the breach (Art. 33 GDPR)
• Notify you directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Art. 34 GDPR)
• Document all breaches, including their effects and remedial actions taken

12. Children's Data

Kariyan is designed for professional job seekers and is not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at privacy@kariyan.de and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email and update the "Last updated" date above. Where processing requires your consent, updating this policy does not replace that consent.

14. Contact

For privacy-related inquiries: privacy@kariyan.de

15. Google User Data and Gmail Access

Google sign-in and connecting a Gmail mailbox are separate choices. If you connect Gmail, Kariyan requests the Gmail modify permission. This permission can read and change mailbox messages. Kariyan uses it to create drafts or send application emails you approve and to retrieve new inbox messages to identify replies linked to your applications. Kariyan does not add labels or reorganize your inbox.

We store your connected address and Gmail access and refresh tokens. The primary database token values are encrypted; older service components may also hold local token files. Application send records include the recipient, subject and outgoing message text. For a reply linked to an application, we store up to 2,000 characters of reply text in that application and a shorter event preview. If processing fails, a restricted retry record can include the retrieved message body or snippet. If no application is linked to a reply, no application is updated. Review and retry records remain for audit under the retention and deletion terms in Sections 5 and 6. We do not store every new inbox message as an application reply.

For this feature, Kariyan's backend, hosted on Railway, retrieves the permitted Gmail data from Google's API. Supabase stores the connected address, encrypted OAuth credentials and the application, reply and restricted review records described above. These service providers process the data to operate Kariyan's Gmail connection. When AI-based reply classification is enabled in the service configuration, the email subject and relevant reply text may also be processed by Google Vertex AI through approved EU endpoints to classify an application response. The processor and international-transfer information in Sections 4 and 9 also applies to this processing.

Disconnecting Gmail does not erase emails already sent or the application, reply and restricted review records already stored in Kariyan. Those records remain with your account until account deletion or an applicable deletion request is completed; Kariyan does not currently apply a separate automatic expiry to Gmail-derived application and review records. The account-deletion process and your rights are described in Sections 5 and 6.

Connecting Gmail is optional. Disconnecting it in Settings removes the active connector and token records from Kariyan's database and stops new sends and reply monitoring through that connector. Historical local token files may remain on older service hosts pending cleanup; revoke Kariyan's Google-side grant in your Google Account permissions to invalidate that access as well. Previously sent emails and existing application or reply records are handled under the retention and deletion terms in Sections 5 and 6.

Kariyan's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide and improve the application-sending and reply-tracking features described above.
• We do not use Google user data for advertising.
• We do not sell Google user data or transfer it to third parties, except as needed to provide these features, to comply with applicable law, or as part of a merger or acquisition with appropriate notice.
• We do not allow humans to read your Gmail data, unless you give specific consent, it is necessary for security purposes such as investigating abuse, or we are required to do so by law.
• We do not use your Gmail data to develop, improve, or train generalized or non-personalized AI or machine learning models.

16. Mobile Apps and Device Controls

Android and iOS provide device-level controls for permissions. For a feature that uses an optional device permission, you can manage that permission in your device settings. A device permission is separate from permission for Kariyan to process your data or access a connected mailbox. Turning off a device permission does not delete information already saved in your Kariyan account.

Uninstalling the mobile app does not delete your Kariyan account or its server-side data. You can request account deletion using the account-deletion page or by contacting privacy@kariyan.de. The retention rules and rights in Sections 5 and 6 apply to web and mobile use alike.

Apple and Google process information about app-store downloads and, if you make a purchase through their stores, the associated purchase and payment information under their own privacy policies. Store purchase processing is distinct from connecting Google sign-in or Gmail to Kariyan.