Privacy
Controller
Emilio Irmscher, Max-Saupe-Straße 41, 09131 Chemnitz, Germany, email: irmscheremilio@gmail.com
This page is a personal job-application site behind access codes. What you read here describes completely which data it processes.
Hosting
The site runs on Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you open it, Vercel processes technically necessary connection data, including the IP address, in server logs. The legal basis is Art. 6(1)(f) GDPR (technical operation). A data processing agreement with Vercel is in place; transfers to the USA rest on the EU standard contractual clauses.
Database
Access and visit data live in a Postgres database at Neon (Frankfurt region, EU). Stored per access code: company, role, creation time, first and last use, and a usage counter. Per visit: start, last activity, language, the browser's user agent and which sections of the page were visible. IP addresses are not stored in the database. The CV PDFs and the vocational exam certificate are only delivered with a valid access session.
Access codes
Access works through a personal code that I issue per application. It lets me see whether and how the page was used during the application process. The legal basis is Art. 6(1)(f) GDPR; the interest is running my job application.
Chat
The site has a chat that answers questions about me. What you type there is sent, together with the conversation so far, to OpenAI, L.L.C., San Francisco, USA to generate the answer; the transfer rests on the EU standard contractual clauses. OpenAI is technically instructed not to store the conversations. The transcript itself lives in the database, is linked to the access code and visible to me; it is deleted with the code, at the latest after six months. Please do not enter sensitive personal data into the chat. The legal basis is Art. 6(1)(f) GDPR.
Repository access
On request I invite you into selected private GitHub repositories so you can read real code. For that you sign in to GitHub on this page; GitHub's own privacy policy applies to that step (GitHub, Inc., San Francisco, USA). The site then stores your public GitHub id and your GitHub username with the access code to manage the invitation. Invitations expire automatically after 14 days, and I can withdraw them at any time. This data is deleted with the access code. The legal basis is Art. 6(1)(b) GDPR; the invitation happens at your request.
Notifications
When an access code is used, I get an email with company, role, entry path (link or form), language and time. When you request a repository invitation, I get an email with company, repository and your GitHub username. I also get one daily summary of the previous day's chat activity. Both are sent through Resend, Inc., San Francisco, USA; the transfer rests on the EU standard contractual clauses. No email address of yours is involved, the messages go to me only. The legal basis is Art. 6(1)(f) GDPR.
Cookies
The site sets two cookies: aiv holds the access session (signed, without
the code itself, valid 30 days) and locale remembers the language. After
a GitHub sign-in for repository access your GitHub identity travels inside
aiv, and during that sign-in the cookie repo_oauth_state protects the
flow for ten minutes. All are required for operation; there are no
tracking cookies. Two more exist
only on my own device: aia holds the admin session after my GitHub
sign-in (7 days) and admin_oauth_state protects that sign-in for ten
minutes. Visitors never get either.
No third-party services
There are no third-party analytics. Fonts are served from this site's own server, not from Google or any other provider.
Retention
I delete access and visit data when the respective application process ends, at the latest six months after the last visit. This happens automatically. The notification emails live in my mailbox and are cleaned up with it.
Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to complain to a supervisory authority. An email to the address above is enough.