Privacy Policy

1. Data Controller

The controller responsible for the processing of your personal data in accordance with the General Data Protection Regulation (GDPR) is:

Kariyan (kariyan.de) is a product of Gajera IT Solutions.

2. Personal Data Kariyan Collects

Kariyan collects the following categories of personal data:

• Account data: email address, password hash, LinkedIn OAuth ID
• Profile & CV data: name, work history, education, skills, languages, desired salary and location
• Voice onboarding: during a voice session your audio is streamed to Google Gemini Live (a Google subprocessor) for transcription and is not stored by us. Only the transcript and the information we extract are kept.
• Profile photo: optional photo uploaded for CV documents, stored securely in AWS S3 (Frankfurt). You can delete your photo at any time from Settings.
• Job application data: prepared CVs, cover letters, application emails and their delivery status
• Form submission data: when using automated form submission, browser automation fills application forms on your behalf. Screenshots of submitted forms are captured for your records. No data is stored on external company application pages beyond what you authorize.
• Usage data: pages visited, feature interactions, search queries, error logs
• Payment data: subscription plan, billing address, last 4 digits of card (full card data held by Stripe)
• Referral data: if you use our referral program, your unique referral code and referral link; and, for each person you refer, their account status, activation milestones (e.g. signup date, email verification, first application), and signup IP address, used to determine and safeguard referral rewards

3. Legal Bases for Processing

• Art. 6(1)(b) GDPR, Contract: Processing necessary to provide the Kariyan service you signed up for (account creation, job search, application sending).
• Art. 6(1)(a) GDPR, Consent: Voice recording processing; marketing communications. You may withdraw consent at any time.
• Art. 6(1)(f) GDPR, Legitimate interest: Security monitoring, fraud prevention, system reliability.
• Art. 6(1)(c) GDPR, Legal obligation: Tax and accounting records as required by German law.

4. Third-Party Processors

All processors are bound by data processing agreements (DPAs) pursuant to Art. 28 GDPR.

5. Data Retention

• Account data: Retained for the lifetime of your account, then deleted within 30 days of account deletion.
• Voice onboarding: Audio is streamed to Google Gemini Live for transcription and is not stored by us. The transcript and extracted preference data are retained with your profile and deleted when you delete your account.
• Application documents: CVs and cover letters retained for 2 years from creation.
• Payment records: Retained for 10 years as required by German commercial law (HGB §257).
• Usage logs: Retained for 90 days for security purposes.

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Art. 15, Right of access: You may request a copy of all personal data we hold about you.
• Art. 16, Right to rectification: You may request correction of inaccurate or incomplete data.
• Art. 17, Right to erasure ("right to be forgotten"): You may request deletion of your data (subject to legal retention obligations).
• Art. 18, Right to restriction: You may request that processing be restricted in certain circumstances.
• Art. 20, Right to data portability: You may request your data in a structured, machine-readable format.
• Art. 21, Right to object: You may object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@kariyan.de. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, in particular the data protection authority of the German federal state where you reside.

You may also lodge a complaint with your local data protection supervisory authority. For residents of Saxony, this is the Sächsische Datenschutz- und Transparenzbeauftragte: www.saechsdsb.de. A federal list of all supervisory authorities is available at www.bfdi.bund.de.

7. Cookies

Essential cookies are used for session management and authentication. See our Cookie Policy for full details.

8. Data Protection Officer

As a small business with fewer than 20 employees regularly processing personal data, Kariyan is not required under Art. 37 GDPR to appoint a Data Protection Officer. For all privacy-related inquiries, contact us directly at privacy@kariyan.de.

9. International Data Transfers

Your data is processed exclusively within the European Union. All infrastructure and AI processing takes place in EU data centres.

No personal data is transferred outside the European Economic Area (EEA). All third-party processors are bound by data processing agreements pursuant to Art. 28 GDPR. Data in transit is encrypted via TLS, and data at rest is encrypted by each provider.

10. Automated Decision-Making (Art. 22 GDPR)

Kariyan uses automated systems and language models to:

• Match your profile against job listings
• Generate tailored CVs, cover letters, and application emails
• Score job relevance based on your stated preferences

These processes assist in preparing application documents but do not produce legally binding or similarly significant decisions without your review. You always retain the ability to review, edit, and approve or reject any generated output before it is sent. No application is submitted without your explicit consent (in approval mode) or within rules you have explicitly defined (in autopilot mode).

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority within 72 hours of becoming aware of the breach (Art. 33 GDPR)
• Notify you directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Art. 34 GDPR)
• Document all breaches, including their effects and remedial actions taken

12. Children's Data

Kariyan is designed for professional job seekers and is not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at privacy@kariyan.de and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email and update the "Last updated" date above. Continued use of the service after changes constitutes acceptance of the updated policy.

14. Contact

For privacy-related inquiries: privacy@kariyan.de

15. Google User Data and Gmail Access

If you choose to connect your Google (Gmail) account, Kariyan requests permission to send job application emails from your address and to read the reply threads to those applications so we can track their status and organize them with a label. Connecting Gmail is optional, and you can disconnect it at any time in your settings or through your Google Account permissions page.

Kariyan's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide and improve the application-sending and reply-tracking features described above.
• We do not use Google user data for advertising.
• We do not sell Google user data or transfer it to third parties, except as needed to provide these features, to comply with applicable law, or as part of a merger or acquisition with appropriate notice.
• We do not allow humans to read your Gmail data, unless you give specific consent, it is necessary for security purposes such as investigating abuse, or we are required to do so by law.
• We do not use your Gmail data to develop, improve, or train generalized or non-personalized AI or machine learning models.