Privacy Policy

Last updated: 24 September 2026

1. Controller Information

The controller responsible for data processing on this website is:

Fodoj GmbH Prinzregentenstrasse 54 80538 München, Germany

Email: team@misujob.com Phone: +49 89 54197048

2. Overview of Data Processing

2.1 What Data We Collect

When you use MisuJob, we collect and process the following data:

Account Data:

Email address
Full name
Authentication data, including a one-way password hash; MisuJob does not store your password in plaintext

Profile Data:

In the current Career Radar, your CV file, pasted text, filename, and extracted text are processed only in your browser memory and are not sent to or stored by the Career Radar account service
If you explicitly choose cross-device storage, bounded derived identifiers for role directions, market, objective, evidence reports, scenarios, and checklist state
Career and work preferences or contact information you separately choose to provide in other service areas

Confirmed Career Profile and Free Result:

The profile you confirm in Career Radar (skills you confirmed, aims, exclusions, target country and goal) is sent to our server to compute the free result; the server does not store it for the free result and keeps only a daily count of results shown
If you save the confirmed profile to your account, it is stored until it expires, you delete it, or you withdraw the storage consent

Purchases (Career Move Report):

The order: product, price, currency, status, dates, the version of the Terms you accepted, and the Stripe checkout and payment references
A copy of your confirmed profile taken at payment (the input snapshot), used only to produce your report and its revision
The report itself, its versions and the digest that proves it was not altered
Payment details are entered on Stripe’s page; MisuJob receives the payment status, amount and references, never your card details
Counts of report views and downloads per day and product, without any link to you

Research and Early-Access Data:

Reports, job records, and research pages you view or interact with
Messages you send when asking about Career Radar early access
Feedback, research questions, and product preferences you choose to share

Team Coverage Review Requests:

The decision question, role or topic, country, decision date and job description or requirements a company submits on the For Teams page, with emails, phone numbers, links and contact lines removed automatically before analysis or storage
The company’s own classification of each requirement and the work email address given for our reply

Usage Data:

IP address
Browser type and version
Device information
Pages visited and actions taken for non-essential analytics only with your cookie consent; operational requests may also be logged for security and reliability
Timestamps of activities

Historical Workflow Data:

Application history or status records created while the previous application workflow was active
Legacy job-site connection metadata and, for some older accounts, encrypted credentials
Historical plan, transaction, invoice, cancellation, and support records

The previous application and connected-site workflows are disabled. MisuJob does not use legacy credentials to submit new applications while those workflows remain disabled.

2.2 Purpose of Data Processing

We process your data for the following purposes:

creating, authenticating, securing, and managing your account;
processing the current Career Radar CV locally in your browser and, only with your separate consent, storing a minimised derived profile across devices;
operating the public labour-market reports and job evidence database;
responding when you ask about Career Radar early access or provide feedback;
computing the free Career Radar result from the profile you confirm;
selling, producing, delivering, revising and supporting the Career Move Report you buy, including automatic refunds when a report cannot be produced;
preparing the free coverage review a company requests for a Role Decision Brief and replying to it;
performing expressly identified CV or AI processing for existing account functions, research or testing;
maintaining, exporting, deleting, and supporting historical workflow records;
measuring and improving the Service where permitted and, for non-essential analytics, where you consent;
preventing fraud, abuse, and security incidents; and
complying with legal, tax, accounting, and regulatory obligations.

MisuJob does not currently submit applications, operate an automatic-application service, connect new job-site accounts, or sell application-based plans.

Contract performance (Art. 6(1)(b)): Processing necessary to create and manage an account, compute the free result you request, sell, produce and deliver a report you buy (including the input snapshot and refunds), maintain user-requested profile functions, provide requested resources, and respond to service requests
Legitimate interests (Art. 6(1)(f)): Security, fraud prevention, service maintenance, product research, defence of legal claims, and improvement that does not override your rights
Consent (Art. 6(1)(a)): Non-essential analytics cookies, marketing communications, and processing that is specifically presented as optional or consent-based
Legal obligation (Art. 6(1)(c)): Tax, accounting, regulatory, and lawful-request requirements

3. Data Storage and Security

3.1 Where We Store Your Data

MisuJob uses cloud and edge infrastructure providers, including Google Cloud Platform and Cloudflare. Primary service infrastructure is configured in the European Economic Area where applicable. Some service providers may process data in other countries as described in Sections 6 and 7. We use encryption in transit and access controls appropriate to the data and service.

3.2 How Long We Keep Your Data

Career Radar account: The email address is kept until account deletion or an earlier valid deletion request, subject to lawful exceptions and backup cycles
Current Career Radar CV: The file, filename, pasted text, and extracted text remain in browser memory for the active session and are not stored in the cross-device account
Derived cross-device Career Radar histories: Up to 12 months after each save, or until you delete a history, withdraw cross-device storage consent, or delete the account, whichever occurs first
Team coverage review requests: The work email for our reply for up to 12 months after the request, then deleted automatically; the job description, with contact details removed, is kept with the agreed scope; if you ask us to delete it, we delete it within 30 days
Operational and security logs: Normally retained for a limited period appropriate to troubleshooting, fraud prevention, and security; selected audit records may be retained longer where necessary
Analytics data: According to the consent choice, provider configuration, and applicable retention setting
Historical application and integration records: Up to 24 months after the last relevant activity unless deleted earlier or retained to resolve a user request, dispute, or legal obligation
Legacy credential data: Until disconnection, account deletion, completion of the legacy-data deletion process, or an earlier valid deletion request, except where temporary backup retention is necessary
Confirmed profile saved to your account: Until it expires, you delete it, you withdraw the storage consent or you delete the account
Input snapshot of a purchase: Until the copied profile would have expired, or earlier if you delete the account; it is used only for that report and its revision
Purchased reports and their versions: Available to you for 12 months after delivery; after a valid erasure request, the report content is deleted within 30 days, except where needed to handle a refund, complaint or legal claim
Order and payment records: Up to 10 years where required by German tax or commercial law (§ 147 AO, § 257 HGB), without the report content or the profile
Payment, invoice, and accounting data: Up to 10 years where required by German tax or commercial law

We delete or anonymise data when it is no longer needed for the stated purpose, subject to legal obligations, disputes, security needs, and proportionate backup retention. Deletion and consent withdrawal remove derived histories from the live account database immediately. Encrypted backup copies follow the infrastructure provider’s controlled backup rotation and are not restored into an active account except for disaster recovery.

3.3 Security Measures

SSL/TLS encryption for all data transfers
Application-layer encryption for sensitive legacy credential data that has not yet been deleted
Secure password hashing (bcrypt)
Access controls and authentication (JWT)
Logging, monitoring, and security review appropriate to the Service

3.4 AI Data Processing and PII Protection

The current Career Radar parses the CV and derives its profile in the browser. It does not send the CV file, CV text, filename, or extracted text to OpenAI, Cloudflare Workers AI, or the Career Radar account API. MisuJob may use AI services elsewhere for job-data classification, summarisation, embeddings, translation, product research, or separately identified features.

AI Service Providers:

OpenAI: Selected text-processing, extraction, classification, or research tasks when invoked by a Service feature
Cloudflare Workers AI: Selected job-data extraction, skill extraction, classification, or embedding tasks

PII Redaction (GDPR Art. 25 - Data Protection by Design):

Where external AI processing is used outside the current browser-local Career Radar, MisuJob is designed to minimise the text sent and to redact direct identifiers such as names, email addresses, phone numbers, and personal URLs before transfer. We also seek to exclude special-category data that is not needed for the task.

AI Decision Logging:

We may log operational metadata about AI processing, such as the provider, task type, timing, and success or failure, for security, debugging, cost control, and accountability. We seek to avoid placing raw CV text or direct identifiers in operational logs. MisuJob does not currently use AI to make hiring decisions or submit applications, and no current automated processing is intended to produce legal or similarly significant effects on users.

3.5 Historical Job-Site Integration Data

MisuJob no longer offers new job-site connections and does not use legacy connection credentials to submit new applications while the workflow is disabled. Older accounts may still contain connection metadata or encrypted credential records created under the previous service. Access is restricted, and users may request deletion at team@misujob.com. Some data may remain temporarily in backups or where needed to resolve a security incident, dispute, or legal obligation.

3.6 Job Listing Data from Aggregator Sources

MisuJob collects or derives job-market records from third-party and public sources. Depending on the source and permitted use, a record may contain source references, descriptions or summaries, skills, location, employment type, observation dates, and available compensation information. Coverage and field completeness vary, and a database record may remain after the original vacancy changes or closes. Users should verify records with the original source. Companies, platforms, or individuals can request review or removal through our opt-out page.

As a data subject, you have the following rights:

4.1 Right of Access (Art. 15)

You can request information about the personal data we hold about you.

4.2 Right to Rectification (Art. 16)

You can request correction of inaccurate personal data. In Career Radar you can untick incorrectly detected signals and save the corrected derived profile again.

4.3 Right to Erasure (Art. 17)

You can request deletion of personal data (“right to be forgotten”) and may use account-deletion controls where available. Deletion is subject to lawful exceptions, identity verification, proportionate backup cycles, and records we must retain for tax, accounting, security, disputes, or other legal obligations.

4.4 Right to Restrict Processing (Art. 18)

You can request restriction of processing under certain circumstances.

4.5 Right to Data Portability (Art. 20)

Where Article 20 applies, you can request personal data you provided in a structured, commonly used, machine-readable format. A signed-in Career Radar user can use Download my data in the account page, or contact team@misujob.com. The product export covers the active Career Radar account, consent record, and derived histories. Separate payment, accounting, security, and legacy records can be requested through the contact address and may be retained where law requires it.

4.6 Right to Object (Art. 21)

You can object to processing based on legitimate interests.

Where processing is based on consent, you can withdraw it at any time. A signed-in Career Radar user can choose Stop cross-device storage to withdraw that consent and delete every derived history without deleting the account. This does not remove payment, accounting, security, or other records retained on a separate legal basis. For cookie consent, click “Cookie Settings” in the footer.

4.8 Right Regarding Automated Decisions (Art. 22)

MisuJob does not currently use automated processing to make hiring decisions or other decisions intended to produce legal or similarly significant effects. Any current or early-access AI-assisted career information is informational. If this changes, we will provide the information and safeguards required by Article 22, including applicable rights to human intervention, to express your point of view, and to contest a decision.

To exercise these rights, contact us at: team@misujob.com

5. Cookies and Tracking

We use essential cookies/localStorage for authentication and core functionality. These cannot be disabled.

Storage	Purpose	Duration
`token`	JWT authentication	Session
`user`	User profile data	Session
`cookie_consent`	Your cookie preferences	Persistent
`onboardingCompleted`	Onboarding state	Persistent

5.2 Optional Career Radar Device Save

Career Radar processes the selected CV file or pasted text in browser memory. It does not place the raw CV, filename, pasted text, or extracted text in browser storage. If you explicitly select Save on this device, the browser stores misujob.career-radar.workspace.v2 with derived recognised market signals, evidence snapshot metrics, selected role directions, and checklist state. This optional record remains until you select Remove device save, select Use another CV and remove save, or clear browser storage.

Analytics cookies are only loaded after you give explicit consent via our cookie banner.

Service	Purpose
Google Analytics 4	Page views, feature usage
PostHog	Pseudonymous event tracking; session recording is disabled

No personal data is shared with third parties for advertising purposes. You can withdraw consent at any time by clicking “Cookie Settings” in the footer.

5.4 Managing Cookies

You can manage cookie preferences through our cookie banner or your browser settings.

6. Third-Party Services

6.1 AI Services

OpenAI: Selected CV or job-data text processing, extraction, classification, translation, or research tasks when a relevant Service function is invoked. Contractual and transfer safeguards apply where required.
Cloudflare Workers AI: Selected job-data extraction, skill extraction, classification, or embedding tasks.

Data minimisation and redaction measures are described in Section 3.4. These services work on job postings; the free result and the Career Move Report are computed by fixed statistical methods on our servers, not written by a generative AI model.

6.2 Payment Processing

Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments for the Career Move Report, refunds, disputes and receipts, and historical subscription records. Stripe receives only the order reference, the product and its version, and the payment details you enter on its page; your email address for the receipt is entered there by you. CV content, confirmed profiles and reports are never sent to Stripe. Stripe acts as an independent controller for its own legal obligations (for example, fraud prevention and anti-money-laundering rules). Stripe’s privacy policy is available at https://stripe.com/privacy.

6.3 Email Services

We use AWS SES for transactional emails. Data is processed within the EU.

6.4 Job Sources and Legacy Integrations

Third-party job sources may receive ordinary requests when a user opens an original-source link. MisuJob does not currently create new connected job-site accounts or use legacy credentials to submit applications. Historical integration data is handled as described in Sections 2.1, 3.2, and 3.5.

6.5 Operational Error Monitoring

Sentry receives limited technical error information, such as the page URL, browser details, stack traces, and request timing, so we can diagnose security and reliability failures. The browser integration is configured not to send default personal data or form contents. This operational monitoring is based on our legitimate interest in maintaining a secure and reliable service; it is separate from optional analytics.

7. International Data Transfers

Your data is primarily intended to be processed within the EEA where the relevant service supports it. Some providers, including OpenAI, Google, Stripe, AWS, PostHog, or their subprocessors, may process data in countries outside the EEA. Where required, we rely on an adequacy decision, Standard Contractual Clauses, and supplementary safeguards. Data-minimisation and redaction reduce transfer risk but do not make all unstructured career data anonymous.

8. Content Removal / Opt-Out

Companies, job platforms, or individuals who wish to have content reviewed or removed from MisuJob can submit a request at /legal/opt-out/ or email team@misujob.com. We aim to review requests promptly; any statutory rights and response deadlines remain unaffected.

9. Children’s Privacy

MisuJob is not intended for users under 16 years of age. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or through our platform.

11. Contact and Complaints

Data Protection Contact: Email: team@misujob.com

Supervisory Authority: If you believe we have violated your data protection rights, you can file a complaint with:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany Website: https://www.lda.bayern.de