Last updated: 27 March 2026

1. Controller and Contact

Controller: ContactVault (Owner: Louis Dauphin)
c/o IP-Management #9147, Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany
E‑mail: Show email

Data Protection Officer: Not appointed. For all privacy requests, contact the Controller using the email above.

2. What data we process

• Application data: your email address, the recipient email address for a prospective employer or recruiting contact that you enter, optional employer name and job reference details, message content, and any CV details you add (work history, education, skills/levels).
• Verification and delivery data: message identifiers, verification tokens, signed links, timestamps, delivery/bounce/complaint metadata, and technical markers required to complete the applicant-initiated sending and reply flow.
• Applicant mailbox and session data: mailbox-based login tokens, secure session-cookie state for the applicant inbox, thread metadata, and technical state required for applicant-side mailbox features. Where a new email address starts using the service, this can include automatic creation of an applicant inbox and associated reply mailbox.
• Reply mailbox and thread data: reply-capable mailbox addresses, structured response markers, inbound and outbound thread events, and related delivery references.
• Newsletter data (optional): your email if you subscribe and confirm the subscription.
• Support, abuse and compliance data: contact-form content, abuse reports, deletion requests, DSAR records, and security-incident metadata where applicable.
• Network/technical data: IP address and request/security metadata used for rate limiting, abuse prevention, signed-link validation, and security logging.

3. Purposes and legal bases

• Providing the service (applicant-initiated sending of your message/CV, verification, delivery, applicant inbox access, and linking inbound replies or structured response outcomes to the correct thread). Legal basis: Art. 6(1)(b) GDPR (performance of a contract or steps at your request).
• Security, fraud and abuse prevention, rate limiting, and service reliability. Legal basis: Art. 6(1)(f) GDPR (legitimate interests). Our interests include keeping the service available and preventing misuse.
• Legal compliance (e.g., logs required to investigate abuse). Legal basis: Art. 6(1)(c) GDPR.
• Newsletter (only if you opt in). Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time.

4. Recipients and processors

• Email delivery provider: Mailgun Technologies, Inc. (as processor) for sending transactional emails and handling bounces/complaints.
• Hosting and infrastructure: standard cloud/server providers used to run the application and store encrypted data.
• Recipient entered by you: we send your message and any attachments to the email address you enter, typically a prospective employer or recruiting contact. That recipient acts as an independent controller of any copy they receive.

5. International transfers

Where processors or recipients you choose are located outside the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses where applicable. If you use the Service to send to an email address outside the EEA/UK, that transfer may occur at your request and as part of the requested service delivery (Art. 49(1)(b) GDPR) where no adequacy decision or other safeguard applies.

6. Retention periods

• Pending submissions: stored encrypted with a short verification TTL (currently 10 minutes), deleted on completion, and regularly purged after expiry.
• Short-lived access and confirmation flows: signed confirmation links and mailbox-login challenges have separate short timeouts and are regularly purged after use or expiry.
• Delivered messages and thread content: stored encrypted and purged after the configured retention window (default: 90 days), unless legal obligations require longer retention.
• Inactive applicant account or inbox references: removed after the configured inactivity window where no remaining message, thread, or pending references still require them.
• Reply mailbox aliases and structured response markers: retained only as long as needed for thread continuity, delivery handling, and abuse prevention, then deleted together with the associated message or thread records.
• Operational logs: retained and rotated with a target retention of 30 days; aggregated rate-limit counters are retained for 14 days.
• Administrative recovery copies and exports: internal backup/export copies under backups_codex/ are kept only for short recovery, handover, or review windows and are deleted under a separate short-retention policy; the authoritative records remain in the underlying product and compliance stores.
• DSAR and breach registers: accountability registers are retained with separate compliance horizons (currently 3 years for DSAR records and 6 years for security-incident records). Auto-purge of those domains is disabled by default.
• Finance/compliance records: where applicable, these are retained under longer legal/accounting horizons (currently 10 years configured).
• Newsletter: retained until you unsubscribe; suppression entries kept to prevent unwanted mail.

7. Security measures

We use industry‑standard transport encryption (TLS). Message bodies and sensitive identifiers are encrypted at rest using modern authenticated encryption with per‑record salts. Access is restricted, keys are managed via environment secrets, and abuse controls include proof‑of‑work and rate limiting. Operational logs are limited and periodically purged.

8. Your rights

• Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21).
• Right to withdraw consent at any time, without affecting prior processing.
• Right to lodge a complaint with a supervisory authority, in particular in your habitual residence or where we are established. In Germany, you can contact your state authority (e.g., Berlin Commissioner for Data Protection).

9. Cookies and similar tech

We currently use only essential cookies or equivalent storage necessary to operate the service. No advertising or cross‑site tracking cookies are used.

This currently includes signed session cookies such as cvp, cva, and cv2_session for mailbox-verified account access and the 2.0 applicant inbox session.

If non-essential cookies are introduced later, controls and disclosures will be updated and reflected at /en/cookies.

10. Source of data

Most data is provided directly by you. Some technical data is generated by your device or our systems during use (e.g., timestamps, IP address for security).

11. Automated decision‑making

No decisions with legal or similarly significant effects are made solely by automated means. Automated abuse-prevention measures may rate-limit or block suspicious submissions to protect the service.

12. How to exercise your rights

Email us at Show email . To protect your data, we require verification of ownership of the mailbox you used with the service. You may also submit a deletion request via /gdpr/delete; requests are reviewed and processed according to legal obligations and abuse-prevention safeguards.

13. Changes to this policy

We may update this policy to reflect changes to our processing. Substantive changes will be announced within the service. The current version is always available at /en/privacy-policy.