Privacy Policy

1. Controller

Uejs Kaso
Chicago Lane 5a
30539 Hannover, Germany
Email: hey@supaceai.com

No data protection officer has been appointed; the conditions of § 38 BDSG (German law) are not met.

2. Just looking at the website

Loading a page processes technically necessary connection data (IP address, time, page requested, browser and OS identifier). Without it, no page can be delivered. Legal basis: our legitimate interest in secure operation, Art. 6(1)(f) GDPR.

Fonts are served from our own server. There is no connection to Google Fonts; your IP address is not sent there.

3. What is stored in your browser

Supace itself sets no cookies. What is stored lives in your browser's local storage, and only what you triggered yourself:

• Sign-in — your session token, so you stay logged in.
• Chosen plan — if you click something on the pricing page.
• Sidebar, hidden questions, dismissed notices — display preferences.
• Device identifier — only after signing in, to detect multiple use of one account.
• Your privacy choice — so we don't ask again.

None of this needs consent: it is strictly necessary to provide the service you explicitly asked for (§ 25(2) no. 2 TDDDG, German law). The only cookie that can ever appear is the partner-programme cookie described in section 4, and only if you choose “Accept all”.

4. Measurement and analytics

Without consent: counting at the server. Our hosting provider counts page views, the referring page, country, browser and loading times. This needs no consent, because nothing is stored on your device and nothing is read from it — no cookie, no identifier, no fingerprint. § 25 TDDDG (German law) applies to storing and reading on your device and therefore does not apply here at all. We cannot identify you from these counts, and they are never joined to your account. Legal basis: our legitimate interest in knowing whether the site works and is found, Art. 6(1)(f) GDPR.

Only with your consent: Google Analytics.

If you choose "Accept all" in the notice window, we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — only then, not before. Choose "Reject all" and it never loads — the counting described above still happens at the server, but nothing of it reaches your device.

We measure pages visited, approximate location, device type and the path through the site. Your IP address is truncated (anonymize_ip). Transfer to the US to Google LLC is not excluded; Google is certified under the EU-US Data Privacy Framework. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Withdraw anytime: your choice lives in your browser. You can withdraw it by reopening the notice window and choosing "Reject all". The withdrawal takes effect going forward.

Also only with your consent: partner links (PromoteKit). If you choose “Accept all”, we also load the script of our partner-programme service, PromoteKit (a US-based provider) — on the public pages only (home, pricing, download, sign-up), never inside your account. If you arrived through a partner’s link, the script stores that partner’s reference in a cookie on your device (promotekit_referral) and tells the service that the page was visited. When you buy, the reference is passed to our payment provider together with your order, and the service receives details of that purchase from it, so that the partner can be credited. Purpose: crediting the partners who send us customers. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Choose “Reject all” and none of this happens: the script never loads, no such cookie is set and nothing is passed on with your order. You withdraw exactly as described above. The cookie itself can be deleted in your browser settings; once you have withdrawn, we no longer read it or send it on.

5. Account, documents and interviews

For an account we process your email address and name. If you sign in with Google, we receive the same fields from there. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

The CV, job posting and notes you upload are stored so an interview can draw answer suggestions from them. Whether an interview is recorded is a switch in the app; when it is off, nothing is stored.

Help requests from the app. If you write to us through Help in the desktop app, we store your subject and message with your account, together with the app version and the system version of your computer, so we can answer. A switch under the form, on by default, also attaches the last lines of the app's internal log. That log records sequences, timings and error codes. It never contains what was said in an interview or the content of your documents. Turn the switch off and no log is sent. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

Error reports from the app. From version 1.6.5, the desktop app tells us automatically when something actually breaks: an unhandled error, a crashed process, or a run that ended without closing properly. A report contains the type of error, its message and the technical stack trace, the app version and the system version of your computer, linked to your account. Before sending, the app removes paths to your user folder, email addresses and longer quoted text, so no interview content leaves your device this way. Legal basis: our legitimate interest in finding and fixing faults, Art. 6(1)(f) GDPR. You can object to this at any time (section 8).

6. Processors and recipients

We work with the following service providers. Data processing agreements under Art. 28 GDPR are in place with all of them.

• Website hosting, delivery and reach counting (provider with German and US entities) — delivering and protecting the website, and the consent-free counting described in section 4.
• Database, sign-in and document storage (US-based provider) — accounts, database and document storage. Server location is Frankfurt, Germany; your account data, documents, interview history, help requests and error reports stay in the EU. Standard Contractual Clauses cover any support access from the US.
• Google Analytics (Google Ireland Limited) — only with your consent, see section 4.
• PromoteKit (partner-programme service, US-based provider) — crediting partner referrals, only with your consent, see section 4.
• Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing. Payment details are entered directly with Stripe; we never see card numbers.
• Speech-to-text processing (US-based provider) — turning speech into text during an interview, desktop app only.
• AI language-model processing (provider with EU and US entities) — generating answer suggestions. What is sent is the question asked and context from your own documents; your account identifier is not included.
• Software distribution (US-based provider) — delivering the app and its updates.

Where a provider is based in the US, the transfer relies on Standard Contractual Clauses under Art. 46(2)(c) GDPR or on certification under the EU-US Data Privacy Framework. If you want to know the specific companies behind these categories, ask at hey@supaceai.com — under Art. 15 GDPR you are entitled to that answer, and we give it.

7. Retention

• Account data — until you delete the account and the 30-day grace period after it has run out.
• Documents — until you remove them or delete the account.
• Interview history — until you remove it. Older sessions are removed automatically once the count allowed by your plan is exceeded.
• Saved questions — until you remove them; they are tied to the account and survive deleting a single interview.
• The questions you were asked (the list under “What they ask”) — copied from your transcripts and kept with the account until you delete them there; they survive deleting a single interview, so that the list does not empty itself.
• Help requests — kept with the account, so an earlier conversation can be looked up, and deleted with it.
• Error reports — deleted automatically after 90 days, or earlier together with the account.
• Invoices — ten years, statutory retention (§ 147 AO, § 257 HGB, German law).

Deleted means deleted, after a short grace period: when you delete your account, it is switched off at once and you are signed out everywhere. For the next 30 days nothing is erased, so that you can change your mind: sign in again and choose “Restore my account”. After those 30 days the deletion runs automatically. It first removes your documents from storage, then the account itself; everything else falls away as a result. No copy is retained. If you do not want to wait, you can have everything erased immediately from the same sign-in page, or by email to hey@supaceai.com. During the 30 days we keep your data only for this purpose and do not use it otherwise. We email you a confirmation with the date when you delete the account.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Any consent given can be withdrawn at any time, effective going forward.

For access or deletion, an email to hey@supaceai.com is enough. You can also delete your account yourself, any time, in settings.

You may lodge a complaint with a supervisory authority, in particular the one responsible for our location: the Data Protection Commissioner of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

9. Changes

We update this notice when processing changes — for example when a new service provider is added. If a purpose requiring consent is added, we ask again; a previously given consent does not cover it.