Privacy · Datenschutzerklärung
Privacy
Last updated 9 October 2026
This policy says, in plain words, what Conxto does with your data. Conxto is a job-search tool: you upload a résumé, it finds and checks job postings for you and prepares applications. With Autopilot switched on, it also submits applications inside the rules you set.
1. Controller
Vamsi Venkatesh, Magdeburg, Deutschland · hello@conxto.com
2. What we store, and where
Your account (email, name, password hash), your profile and job preferences, your résumé (the file, its text and the structured version), your applications and their history, the documents Conxto prepares, Autopilot rules and run reports, your subscription status, and what you asked the assistant to remember.
It is stored in a PostgreSQL database on a server rented from Contabo GmbH (Germany), located in the EU. Passwords are stored only as salted scrypt hashes; session and reset tokens only as SHA-256 hashes.
3. Purposes and legal bases
Matching you with jobs, checking your résumé, preparing documents, submitting applications when you use Autopilot, tracking applications, billing, and running the assistant: performance of the contract you signed up for (Art. 6 (1) b GDPR). Security logging and abuse prevention: our legitimate interest in running the service safely (Art. 6 (1) f GDPR). Keeping invoices: legal obligation (Art. 6 (1) c GDPR).
4. AI processing: where your text goes
When Conxto checks a posting, tailors a document or answers you, the text the task needs (parts of your résumé, the posting, your message) is sent to a large-language-model provider. In order:
| First | OpenAI (GPT-6 Luna), OpenAI, USA. API response storage is disabled. |
|---|---|
| Second | Anthropic (Claude), Anthropic PBC, USA. |
| Third | DeepSeek, Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China, used when Anthropic is unavailable. |
| Only for pseudonymised tasks | Groq (USA), Mistral AI (France), Cloudflare (USA) and OpenRouter (USA). They receive text only after your name and contact details are removed, and only when the providers above cannot serve. |
Providers outside the EU process data under the safeguards of Art. 44 ff. GDPR (EU–US Data Privacy Framework or standard contractual clauses where available). We never send your password or payment details to any AI provider.
5. Payments
Subscriptions are paid through Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe receives your email and card details directly; Conxto never sees or stores your full card number. We keep your plan, its status and Stripe's customer reference.
6. Email
Account email only (confirmation codes, password reset, approval, billing notices, Autopilot reports, account deletion), sent from hello@conxto.com through Zoho Mail (Zoho Corporation). No newsletters, no marketing email.
7. Cookies and tracking
Exactly one cookie: conxto_session, an httpOnly session cookie that keeps you signed in (up to 30 days). No tracking or advertising cookies and no third-party analytics. Your browser's local storage keeps interface preferences and the plan you picked; they do not leave your device.
8. Retention
Your data is kept while your account exists. Deleting the account erases profile, résumé, documents, applications, memory and usage records in one operation. Invoices are kept for as long as tax law requires.
9. Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). In the app: Profile → Your data gives you a complete export and deletes your account. For anything else write to hello@conxto.com. You may also complain to a supervisory authority; ours is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt.
10. What we do not do
We do not sell your data or share it with advertisers. Conxto submits an application only through Autopilot, only after you switched it on, and only inside the rules you set.