Impressum

Angaben gemäß § 5 DDG (Digitale-Dienste-Gesetz).

Diensteanbieter

Yigit Sahin
Borgfelder Str. 81
20537 Hamburg
Deutschland

Kontakt

E-Mail: expadojobs@gmail.com

Umsatzsteuer-ID

Umsatzsteuer-Identifikationsnummer gemäß § 27a Umsatzsteuergesetz: DE465329996

Verantwortlich i.S.d. § 18 Abs. 2 MStV

Yigit Sahin, Anschrift wie oben.

Verbraucherstreitbeilegung

Wir sind nicht verpflichtet und nicht bereit, an Streitbeilegungsverfahren vor einer Verbraucherschlichtungsstelle teilzunehmen (§ 36 VSBG).

Privacy Policy

How we handle your data under the GDPR (DSGVO). Last updated: 5 September 2026.

1. Controller

Yigit Sahin, Borgfelder Str. 81, 20537 Hamburg, Germany. Contact: expadojobs@gmail.com.

2. What data we process

• Account: your email address, and — if you register with email and password — a securely hashed password (never stored in plain text) plus a temporary token used to verify your address and to reset your password. If you sign in with LinkedIn instead, we receive your LinkedIn ID, name, email and the address of your LinkedIn profile photo from LinkedIn. We show that photo only to you, in the app's header, and refresh the address each time you sign in with LinkedIn.
• Your CV: the file you upload and the profile we extract from it (e.g. experience, skills, roles). A CV may contain sensitive personal data that you choose to include.
• If you tell us you found a job: whether it was through Expado, optionally which of your tracked roles it was, and, only if you tick the box that allows it, one sentence we may quote on our website without your name. Kept on your account and deleted with it.
• If you delete your account: the reason you choose, if any, is counted in a list that holds nothing else: no email, no id, nothing that links it to you.
• A CV you try without an account: if you use "See your top 3 matches" on the home page, we read the file to extract a profile and show you matches. We do not store the file. The extracted profile is kept only in the server's memory for 30 minutes, so that it can become your profile if you create an account in that time; otherwise it is deleted. To limit misuse, we count previews per IP address for the current day, in memory only.
• Usage events: actions such as logins, CV uploads, match views, explanations and referrals — used to operate the product, prevent abuse and estimate costs.
• How you found us: when your account is created, we record the campaign tags on the link you followed (for example utm_source=instagram), the name of the website that referred you (the site only, never the full address), and the first page you opened on Expado. We record this once and never update it. Nothing is stored on your device for this: the information travels with your sign-up request.
• Referrals: names and LinkedIn URLs of contacts you choose to add.
• Notifications: only if you turn them on for a device, the subscription your browser gives us for it: an address at your browser's push service and two keys we encrypt each message to. Deleted when you turn notifications off, when the push service reports the device gone, and with your account. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in Settings or in your browser.
• Subscription: if you subscribe, a Stripe customer reference, the date your paid access runs to, whether a cancellation is pending, and the time you confirmed that the subscription should start immediately. We do not receive or store your card details — those are entered on Stripe's own pages and stay with Stripe.
• Cancellations: if you use the cancellation form, the email address you entered, the type of cancellation, anything you wrote in the note, and the time we received it. Recorded even where no account matches, because we have to be able to show what was submitted and when.

3. Purposes & legal basis

• Providing the job-matching service — Art. 6(1)(b) GDPR (performance of a contract).
• Account management & security emails (email verification, password reset) — Art. 6(1)(b) GDPR (performance of a contract).
• Processing the content of your CV: Art. 6(1)(a) GDPR (your consent, given by uploading it) and, because a CV can contain special categories of data such as health, religion, ethnic origin or trade-union membership, your explicit consent under Art. 9(2)(a) GDPR. You give it on the upload screen and can withdraw it at any time by deleting your CV or your account.
• A CV preview without an account: the same explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR), given on the home page's upload button.
• Security, abuse prevention and product/cost analytics — Art. 6(1)(f) GDPR (legitimate interest).
• Knowing which channels bring people to Expado (the "how you found us" data above), so we can decide where to spend our limited time — Art. 6(1)(f) GDPR (legitimate interest). It is only ever looked at as totals per channel, never to profile you.
• Taking payment, keeping your subscription in step with Stripe, and handling cancellations — Art. 6(1)(b) GDPR (performance of a contract).
• Keeping the record of your cancellation and of your consent to an immediate start — Art. 6(1)(c) GDPR (legal obligation: §312k BGB requires us to confirm a cancellation, and §356 Abs. 4 BGB makes the consent legally relevant).

4. Recipients & processors

We use the following service providers (processors) to run the service:

• Google Cloud (Cloud Run backend in Frankfurt/EU & Firebase Hosting) — hosting.
• Neon — managed PostgreSQL database (AWS, Frankfurt / EU).
• Anthropic PBC (USA) — parsing your CV and generating match explanations (Claude).
• Voyage AI (USA) — turning text into numerical embeddings for matching.
• LinkedIn (Microsoft) — sign-in.
• Brevo (EU) — transactional email.
• Stripe Payments Europe, Ltd. (Ireland) — payments and subscription management. Card details are entered on Stripe's pages and are never seen by us. Stripe acts as an independent controller for parts of this (fraud prevention, its own legal duties); see Stripe's own privacy policy.
• DuckDuckGo — company logos (icons) shown next to matches are fetched by our server from DuckDuckGo's public favicon service and passed on to you; your browser does not contact DuckDuckGo, and no data about you is sent to it.
• Your browser's push service (Google for Chrome, Edge and Android; Apple for Safari and iPhone; Mozilla for Firefox; Microsoft for some Windows browsers) — delivers notifications if you turn them on. The message content is end-to-end encrypted to your device; the push service sees only that a message is being delivered. These services may be outside the EU.

Transfers to providers in the USA (Anthropic, Voyage) are safeguarded by EU Standard Contractual Clauses and the respective data processing agreements.

5. Retention

We keep your data while your account is active. When you delete your account, your account, profile, CV, matches, referrals and usage events are deleted.

Two things outlive account deletion, and only these two. Records relating to payments are kept for as long as German commercial and tax law requires us to keep them (§ 147 AO, § 257 HGB — up to ten years), and the record of a cancellation is kept so that we can show what was submitted and when. This is why a deletion request cannot remove those: the same law that gives you the right to erasure also obliges us to retain them.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing. Where processing is based on consent, you may withdraw it at any time. You may also lodge a complaint with a supervisory authority — for our seat in Hamburg: der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI).

7. Deleting your data

You can delete your account and all associated data from within the app (Profile → Delete my account), or by emailing us at expadojobs@gmail.com.

8. Job postings, and people named in them

Besides our users' data, we index job advertisements published by companies on their own public career portals and applicant-tracking systems. We store the title, location, link and description of each ad so we can match it against a user's CV, and we always link back to the employer's own page, where the application actually happens.

Job ads are normally not personal data. Sometimes they are: an ad may name a contact person. We therefore remove email addresses and telephone numbers from every description before storing it. A contact person's name may still remain in the text, because no reliable rule separates a person's name from a company's. Where a name does remain, our legal basis is Art. 6(1)(f) GDPR: our legitimate interest in showing an accurate and complete job ad, in text the employer itself published for exactly that purpose.

We keep an ad only while it is live. Once it disappears from the employer's feed for three days, it is deleted, and its search index entry goes with it.

If you are named in an ad we show, you can object under Art. 21 GDPR and ask us to remove it. See Content removal below; we act within 72 hours.

Content removal

For employers, and for anyone named in an advertisement we show.

We index job advertisements from companies' own public career pages and applicant-tracking systems. If you want an advertisement, a company, or your own name removed from Expado, you do not need to give a reason and you do not need a lawyer. Write to expadojobs@gmail.com with the word removal in the subject line.

What to include

• The link to the advertisement, or the company name if you want all of its ads removed.
• Whether you are writing as the employer, or as a person named in an ad.
• An address we can reply to.

What we do

• We remove the content within 72 hours of receiving the request, and confirm to you.
• For an employer, we also stop fetching that company, so the ads do not come back on the next run.
• We keep a record of the request and of what we did, so that both sides can see what happened and when.

How we fetch

Our fetcher identifies itself on every request as ExpadoJobs/1.0 (+https://jobs.expado.app; expadojobs@gmail.com), runs once a night, and stores only roles located in Germany. If our traffic is causing you a problem, write to the same address and we will adjust or stop it.

Cookie & Local Storage Notice

Gemäß § 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz).

We only use storage that is strictly necessary to provide the service. Under § 25(2) TDDDG such storage does not require consent, so we do not show a cookie consent banner.

• Sign-in token (browser local storage): keeps you logged in. Removed when you log out.
• Theme (browser local storage): only if you switch between light and dark mode yourself, so the site remembers the choice you made.
• We set no advertising, analytics or third-party tracking cookies.
• We do not profile you for advertising and do not sell your data.

If we ever add analytics or marketing cookies, we will first ask for your consent through a proper consent tool and update this notice.

Terms of Use (AGB)

Nutzungsbedingungen. Last updated: 3 July 2026.

1. Service

Expado (“the Service”) is an AI-powered tool that matches your CV against job openings published by companies on their public career portals, and shows you the most relevant ones. The Service is provided by Yigit Sahin (see Impressum).

2. Free and paid plans

The Service has a free plan and a paid plan (Premium). The free plan includes job matching, the application tracker, the match email and a small one-off allowance of the AI tools. Premium costs €10 per month including 19 % German VAT, is billed monthly in advance, and can be cancelled at any time to the end of the period already paid for.

All prices include 19 % German VAT (Umsatzsteuer), which is shown on every invoice; €10 is the full amount payable. Our VAT ID is DE465329996. Payments are processed by Stripe.

The Service is provided “as is”. We do not warrant that matches are complete, accurate, up to date, or that any job is still open, and we may change, suspend or discontinue it. Where you pay for it, we owe you the Service for the period you have paid for; if we discontinue it during a paid period we refund the unused part.

3. Your account & acceptable use

• You must provide accurate information and keep your login secure.
• You may upload only your own CV and data you are entitled to share.
• You may not misuse the Service (automated scraping, overloading, reverse engineering, uploading unlawful content, or attempting to access other users' data).
• Fair-use limits (e.g. daily CV parses and AI explanations) apply and may change.

4. Job listings & third-party content

Job descriptions, company names and logos belong to the respective employers. We display limited information and link to the original posting; we are not the employer, do not offer the jobs ourselves, and are not part of any application or hiring decision. Content may be outdated or removed by the employer at any time.

5. Intellectual property

The Service's software, design and branding are ours or our licensors'. You keep all rights to the CV and content you upload and grant us only the limited right to process it to provide the Service to you.

6. Liability

We are liable without limitation for intent and gross negligence and under mandatory law (e.g. the Product Liability Act, injury to life/body/health). For slight negligence we are liable only for breach of an essential contractual obligation, limited to foreseeable, typical damages. We are not liable for hiring outcomes or decisions you make based on the Service.

7. Right of withdrawal (Widerruf)

If you are a consumer and take out Premium, you have a statutory right to withdraw from the contract within 14 days, without giving reasons. Premium is a digital service, so the period runs from the day the contract is concluded (§ 355 Abs. 2, § 356 Abs. 4 BGB).

Before checkout we ask you to confirm that the subscription should start immediately, before that period ends, and to acknowledge that the right ends once the service has been fully provided for the period you paid for. If you withdraw before then, you owe a proportionate amount for the part already used and we refund the rest.

Withdrawing is not the same as cancelling. Cancelling stops the next renewal and is always available at Verträge hier kündigen.

You can withdraw online at Vertrag widerrufen (no login needed). The statutory instruction below is in German, as the law provides it; it is the binding text.

8. Termination

You can stop using the Service and delete your account at any time. We may suspend or terminate accounts that violate these terms.

9. Applicable law & jurisdiction

German law applies. Mandatory consumer-protection provisions of your country of residence remain unaffected. Online dispute resolution: see the note in the Impressum.