Privacy Policy
This notice describes what data Bewerbomat processes, why, and what rights you have over it.
Data controller
Miguel Martinez Mota (sole proprietorship), Balgriststrasse 40, 8008 Zürich, Switzerland. Contact: hallo@bewerbomat.ch, +41 79 126 92 11. See also our legal notice (Impressum).
What data we process
Account data (name, email address, password in hashed form, or sign-in via Google); the details in your application profile (address, phone number, date of birth, nationality, marital status, driver's licence, photo, education, work experience, languages, core skills) that you enter yourself or that are read automatically from an uploaded or photographed CV; saved job listings and generated application drafts; messages from career coaching; and technical data needed to keep you signed in (session cookie).
What we use this data for
To create tailored application documents from your profile, to find matching jobs (manually or automatically via the scheduler), to send applications through your own connected Gmail or Outlook account, to process your subscription, and to provide the coaching features. Your data is not used for advertising and is never sold to third parties.
External service providers
For specific features we use the following providers, each of which only receives the data needed for its function: Anthropic (the AI model that drafts text from your profile and the job posting), Stripe (subscription payment processing - we never see or store card details), Google (sign-in, and, if you connect it, sending applications through your own Gmail account), Microsoft (if you connect it, sending applications through your own Outlook account), Adzuna (external job search based on your target role), and Vercel and Neon (hosting the application and its database). These providers may process data outside Switzerland and the EU, in particular in the US - see each provider's own privacy policy for details.
Google user data (Gmail)
If you connect your Gmail account, Bewerbomat receives from Google only the permission to send email on your behalf (gmail.send). We use it solely to send applications that you have approved yourself. We do not read, scan or store any email in your mailbox and have no access to it. We store only the access tokens Google issues for sending, plus your name and email address from sign-in. We do not sell data received through Google APIs, use it for advertising, transfer it to third parties or use it to train AI models. No person reads it unless you explicitly agree, it is needed for security, or the law requires it. Bewerbomat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. You can revoke the permission at any time in your Google account at https://myaccount.google.com/permissions; deleting your Bewerbomat account also deletes the tokens. Each application is sent individually to the address the employer publishes in the job posting for applications (or one you enter yourself). We do not send advertising, bulk or cold-outreach email, and nothing is sent automatically without your approval. The tokens are held in our database at Neon (EU, Frankfurt); connections to it and to Google are encrypted with TLS, and only the application and its operators have access.
Data security (how we protect your data)
This is how we protect your data, in particular the access tokens for your Google or Microsoft mailbox and your credentials. Encryption in transit: all connections between your device, our application, the database, Google and Microsoft use TLS. Encryption at rest: we store the access tokens for Google and Microsoft encrypted in the database (authenticated encryption with XChaCha20-Poly1305), and the passwords of mailboxes connected with an app password with AES-256-GCM. The key is not kept in the database but as a protected secret in the hosting environment. In addition, our database provider Neon (data centre in the EU, Frankfurt) encrypts stored data (AES-256). Passwords for your Bewerbomat account are stored only as hashes. Access control: only the operators (two people) have access to the systems, each with personal credentials; secrets are kept in the hosting provider's protected environment, not in the source code. Data minimisation: we ask Google only for the permission to send (gmail.send), we do not read emails and we do not store the contents of your mailbox. Deletion and revocation: when you disconnect your mailbox or delete your account, we delete the access tokens and revoke the permission at Google (for Microsoft you can remove the permission in your Microsoft account). Security incidents: if a security incident affects your data, we inform you without delay.
Cookies
We use only one technically necessary session cookie, which keeps you signed in after login. There are no tracking, analytics, or advertising cookies. For our own usage statistics we store in our database which pages and features are used and which website or ad link a visit came from (for example 'google' or 'instagram'). Your browser uses a random identifier for this that is deleted when you close the tab; if you are signed in, the entries are linked to your account. We do not pass this data on to any analytics or advertising service.
Retention and deletion
We keep your data for as long as your account exists. You can delete your account yourself at any time (under "Account" behind your profile picture) - this irreversibly deletes your profile, saved job listings, applications, and coaching history, and automatically cancels any active subscription. Your usage and search statistics are deleted as well. The only exception: so that the free application cannot be used several times in the same month by deleting and recreating an account (abuse protection, legitimate interest), when you delete your account we keep, until the end of the current billing month, only irreversible hashes of your email address and your Google/Microsoft account id together with the number of applications used this month. After that this record is deleted.
Your rights
You have the right to request access to your stored data, and to have it corrected or deleted. Most of these rights you can exercise yourself directly in your account; for anything else, reach us at hallo@bewerbomat.ch.
Changes
We update this notice whenever our data processing changes. The current version is always available on this page.