Datenschutzerklärung

This policy describes, in plain language, what Conxto actually does with your data — nothing more and nothing less. Conxto is a career tool: you upload a résumé, it finds and scores job openings for you, and it helps you prepare applications. Nothing is ever submitted anywhere without your explicit approval.

1. Controller (Verantwortlicher)

Vamsi Venkatesh, Robert-Seitz-Straße 1 · 39108 Magdeburg, Deutschland · hello@conxto.com

2. What we store, and where

Your account (email, name, password hash), your profile and career targets, your résumé (the uploaded file, its extracted text, and the structured version you edit), your applications with their event history, generated documents (tailored résumés, cover letters, interview notes), and the assistant's per-user memory (your conversations with it and durable facts you tell it, e.g. "remote only").

All of it lives in a PostgreSQL database on a server rented from Contabo GmbH, a German hosting provider, located in Germany/EU. Passwords are stored only as salted scrypt hashes; session and reset tokens only as SHA-256 hashes.

3. What we use it for (purposes and legal bases)

Matching you against job openings, scoring your résumé (ATS analysis), tailoring documents you ask for, tracking your applications, and running the assistant you talk to — i.e. performing the service you signed up for (Art. 6 (1) b GDPR). Operational logging and abuse prevention rest on our legitimate interest in running the service securely (Art. 6 (1) f GDPR).

4. AI processing — where your text goes

Honest and specific: when you chat with the assistant, or ask for tailoring, critique, or similar AI features, the relevant text — which can include parts of your résumé, your messages, and the job description — is sent to the API of DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), a large-language-model provider whose processing takes place outside the EU. If the primary provider is unavailable, a configured fallback provider (Anthropic) may process the same kind of text. We send only what the feature needs; we do not send your password or account credentials. If you are not comfortable with LLM processing, the deterministic features (job feed, ATS scoring, tracker) work without it — but the assistant, tailoring and critique do not. One correction, because the earlier wording was wrong: uploading a FILE (PDF or DOCX) to the résumé checker sends its contents to the LLM provider, because that is how the file is turned into text. The scoring that follows is deterministic and involves no model, but the upload step does leave your device. Pasting your résumé as text skips the provider entirely.

5. Email

Transactional email only (signup confirmation, email verification, password reset, approval notice, account-deletion confirmation), sent as hello@conxto.com through Zoho Mail (Zoho Corporation) as the SMTP provider. No newsletters, no marketing email.

6. Cookies and tracking

Exactly one cookie: conxto_session — an httpOnly, SameSite=Lax session cookie that keeps you signed in (up to 30 days). There are no tracking or advertising cookies, and no third-party analytics of any kind (no Google Analytics, no Plausible, no pixels — we checked the code before writing this sentence). Your browser's local storage holds only interface preferences (e.g. theme, résumé design) that never leave your device.

7. Retention

Your data is kept for as long as your account exists. Delete your account and it is erased — the deletion cascades through profile, résumé, documents, applications, memory and usage records in the same operation. Password-reset and verification tokens expire on their own (1 hour / 7 days) and are single-use.

8. Your rights

Access (Art. 15), rectification (Art. 16 — most data is directly editable in the app), erasure (Art. 17 — self-serve: Settings → Account → "Delete account"), data portability (Art. 20 — self-serve: Settings → Account → "Export my data" gives you a complete JSON export), restriction (Art. 18) and objection (Art. 21). For anything not covered by the in-app controls, email hello@conxto.com. You also have the right to complain to a supervisory authority — for us that is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt.

9. What we do not do

We do not sell your data. We do not share it with advertisers. We do not submit applications, emails, or anything else on your behalf without your explicit, per-item approval.