Menu

Data privacy regulations

Privacy Policy

Effective: October 2026

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data refers to any data that can be used to personally identify you. For detailed information on data protection, please refer to our Privacy Policy listed below this text.

Data Collection on Our Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator’s contact information in the legal notice section of this website. The data is entered by either the candidate or the company. The website operator does not add any additional data.

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us. This may include, for example, data you enter into a contact form, as well as your photo and voice recordings for the strengths video, your personality test results, your professional and personal profile information under “Your Profile,” your certificates, and your resume. No data is collected that is not exclusively related to the provision of the skillster service.

Other data is automatically collected by our IT systems when you visit the website. This consists primarily of technical data (e.g., internet browser, operating system, or time of page view). This data is collected automatically as soon as you access our website.

How do we use your data?

skillster relies on candidates providing data to create a strengths video and to complete a personality test. The strengths video can be used privately, sent to employers, or used to apply for a job posting. All user data is used exclusively for this purpose. Every active user must be registered. Viewing applicant profiles requires providing the master data of the company posting the job. The companies’ master data is not shared with candidates.

Some data is collected to ensure the website functions properly. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to receive, free of charge, information about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction, restriction, or deletion of this data.

You can delete your profile and data yourself at any time or have skillster delete them for you. Afterward, they will no longer be visible to companies. Due to the 14-day backup cycle, your data will also be deleted from the backup after 14 days. Chapter 3 describes what applies to data that a company has already retrieved.

Where is your data stored?

Data regarding master data, professional criteria, and personality test results, as well as photos, voice recordings, and videos, are stored on a web server operated by the provider Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.

To create the strengths video, your photo and voice recordings are transmitted to the service provider HeyGen Technology Inc., USA (see Chapter 7). The finished video is then also stored on our server at Hetzner.

You can contact us at any time at the address listed in the legal notice regarding this matter or any other questions about data protection. Furthermore, you have the right to file a complaint with the relevant supervisory authority.

Analysis Tools and Third-Party Tools

When you visit our website, your browsing behavior may be statistically analyzed. This is primarily done using cookies and so-called analytics programs. The analysis of your browsing behavior is generally anonymous; your browsing behavior cannot be traced back to you. You may object to this analysis or prevent it by not using certain tools. Detailed information on this can be found in the following privacy policy.

2. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations as well as this Privacy Policy.

Personal profile data, personal information, photos, certificates, and other documents—such as a resume—are stored on a server located in Germany operated by skillster or its partners. To create the strengths video, photos and voice recordings are additionally transmitted to HeyGen in the U.S. (see Section 7).

skillster undertakes to make the most recent version of the videos available for the video player. Furthermore, skillster undertakes not to use the previous versions for any commercial purpose. However, skillster is entitled to use the previous versions of the videos to improve candidate-related services.

When you use this website, various types of personal data are collected. Personal data is data that can be used to personally identify you. This Privacy Policy explains what data we collect and how we use it. It also explains how and for what purpose this is done.

Users who do not respond to the email reminder after 60 days to actively renew their profile will be deactivated after an additional 30 days. After that, the account and all profile data will be deleted. If the user takes action and responds to the email reminder after 60 days, their profile will remain active for another 60 days.

Within the platform, videos are protected by a username and password. The integrated video player displays the videos only to logged-in users with the appropriate permissions.

Sharing via Link: Candidates can generate a link for their strengths video and share it themselves, e.g., in their resume, via email, or on LinkedIn. Anyone who has this link can view the video without logging in. The candidate alone decides whether and to whom the link is shared. skillster has no control over who receives a shared link or records the video. If the candidate deletes their video or profile, the video will no longer be accessible via the link.

Please note that data transmission over the Internet (e.g., when communicating via email) may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. To do so, simply send us an informal email. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to File a Complaint with the Competent Supervisory Authority

In the event of violations of data protection laws, the data subject has the right to file a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the State Data Protection Commissioner of the federal state in which our company is headquartered. A list of data protection commissioners and their contact information can be found at the following link: www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Right to Data Portability

You have the right to have data that we process automatically—based on your consent or in fulfillment of a contract—provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another data controller, this will only take place to the extent that it is technically feasible.

SSL or TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Access, Restriction, and Deletion

In accordance with applicable legal provisions, you have the right at any time to receive, free of charge, information about your stored personal data, its origin, recipients, and the purpose of data processing, as well as, where applicable, the right to have this data corrected, restricted, or deleted. For this and any other questions regarding personal data, you may contact us at any time at the address provided in the legal notice. Users can delete their profile at any time.

Service Emails

We do not send newsletters or promotional emails. Registered users receive only emails that are necessary for using the platform, such as reminders to renew their profile or notifications regarding technically necessary changes.

3. Actively Applying for a Job Posting

When is your data visible to companies?

Your data is only visible to companies if you explicitly apply for a job. To do this, enter the specific job title in the “Job Posting Title” field in your profile and complete all required information. Only then will your profile become visible to the company posting the job. Other companies cannot view your profile. Without such an application, no company can view your profile.

The company posting the job can then download your documents or import them into its applicant tracking system. Both methods are described below.

Applying via a Job Posting Link

Applicants access skillster via the link in a job posting. There, they register and create their profile. The profile data is stored on skillster. The hiring company receives it only through the two methods described below: via download or by transfer to its applicant tracking system.

By registering, applicants agree to have their personal data stored for the purpose of the application. This includes videos, personality test results, photos, certificates, resumes, and other uploaded documents.

How the Company Can Receive Your Data

The hiring company can view its applicants’ profiles on the platform. In addition, it can retrieve data from skillster in two ways:

1. Downloading individual documents: The company can download the anonymous personality profile, grades, and resume directly from the platform. Videos and photos cannot be downloaded.

2. Transfer to the applicant tracking system (ATS): Profile data can be transferred to the company’s system via API interfaces, typically through integrations with HR management system providers. This transfer does not occur automatically. The company must first select the applicant as a favorite and then manually initiate the transfer for each applicant individually.

In accordance with our Terms and Conditions, companies agree to use the data exclusively for recruitment purposes.

Deletion and Limits of Our Access

Applicants can delete their profile themselves at any time or have it deleted by skillster. Once deleted, the profile and data are no longer visible to companies on the platform, including in “Favorites” and “Lists.” After 14 days, the data is also deleted from our backups.

Data that a company has transferred to its own systems via download or transmission is no longer accessible to skillster. Deletion on skillster does not affect this. Since you applied for a specific position, you know which company may have transferred your data. To have this data deleted, please contact that company directly.

4. Data Collection on Our Website

Contact Form

If you submit inquiries to us via the contact form, the information you provide in the form—including the contact details you enter there—will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not share this data without your consent.

The processing of data entered into the contact form is based exclusively on your consent (Art. 6(1)(a) GDPR). You may revoke this consent at any time. To do so, simply send us an informal email. The lawfulness of data processing operations carried out prior to revocation remains unaffected by the revocation.

The data you enter in the contact form will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Registration on This Website

You can register on our website to use additional features on the site. We use the data you provide for this purpose solely to enable you to use the specific offer or service for which you have registered. The required information requested during registration must be provided in full; otherwise, we will reject the registration.

For important changes—such as changes to the scope of our offerings or technically necessary modifications—we will use the email address you provided during registration to notify you.

The processing of the data entered during registration is based on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time. To do so, simply send us an informal email. The lawfulness of any data processing that has already taken place remains unaffected by the withdrawal.

We store the data collected during registration for as long as you remain registered on our website, after which it will be deleted. Statutory retention periods remain unaffected.

Processing of Data (Customer and Contract Data)

We collect, process, and use personal data only to the extent necessary for the establishment, content, or modification of the legal relationship (master data). This is done on the basis of Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process, and use personal data regarding the use of our website (usage data) only to the extent necessary to enable the user to access the service or to bill for it.

The collected customer data is deleted upon completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data Transfer Upon Conclusion of a Contract for Services and Digital Content

We transfer personal data to third parties only if this is necessary for the fulfillment of the contract, such as to the financial institution responsible for processing payments. No further transfer of data takes place, or only if you have expressly consented to such transfer. Your data will not be disclosed to third parties without your express consent, for example for advertising purposes.

The legal basis for data processing is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

Cookies

Some websites use so-called “cookies.” Cookies do not harm your computer and do not contain viruses. Cookies serve to make our website more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.

Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser the next time you visit.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be limited.

Cookies that are necessary for carrying out the electronic communication process or for providing specific functions you have requested are stored on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in storing cookies to ensure the technically error-free and optimized provision of its services. To the extent that other cookies (e.g., cookies used to analyze your browsing behavior) are stored, they are addressed separately in this Privacy Policy.

5. Analytics Tools and Advertising

Google Analytics

This website uses the web analytics service Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics enables us to analyze visitor behavior on our website. In doing so, pseudonymous usage data is collected, such as pages visited, duration of visit, device used, browser, and approximate location (region). Cookies or similar technologies are used for this purpose. IP addresses are not stored by Google Analytics 4.

Processing takes place only with your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can revoke your consent at any time via our cookie settings.

The data may also be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework. In addition, we have entered into a data processing agreement with Google based on the EU Standard Contractual Clauses.

You can also prevent data collection by Google Analytics using Google’s browser add-on: tools.google.com/dlpage/gaoptout. For more information on how user data is handled, please see Google’s Privacy Policy: policies.google.com/privacy

Google Ads and Conversion Tracking

This website uses Google Ads, an online advertising program provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

As part of Google Ads, we use conversion tracking. If you click on an ad placed by Google and then visit our website, Google and we can recognize that you came to us via the ad and performed certain actions, such as registering. We receive only statistical reports; no information that could be used to personally identify users.

Processing takes place only with your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can revoke your consent at any time via our cookie settings. The information regarding Google Analytics applies accordingly to data transfers to the U.S.

Remarketing

With your consent, we use the remarketing feature of Google Ads. This allows us to display interest-based ads to visitors of our website on other websites and services. If you are signed in to your Google Account and have enabled personalized ads there, Google can do this across devices.

Processing takes place only with your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), which you can revoke at any time via our cookie settings. You can also disable personalized ads in your Google Account: adssettings.google.com

6. Use of Anthropic Claude (AI-powered matching and script generation)

This supplement describes the processing of personal data through the use of Anthropic Claude as an AI technology service provider. It applies in conjunction with the other sections of this Privacy Policy.

Introduction and Scope

The following provisions concern the processing of personal data through AI-powered functions based on technology from Anthropic PBC, 548 Market St PMB 90375, San Francisco, CA 94104, USA (“Anthropic”). Specifically, this applies to:

  • the AI-powered matching of resumes, personality profiles, questionnaire responses, and video content to job descriptions and job postings,
  • the automated generation of job postings based on the matching results, and
  • the AI-powered creation of personalized scripts based on personality profiles, resumes, and questionnaire responses.

We currently use Claude Opus 4.5 from Anthropic as our language model. Should we switch to another model from Anthropic, the following provisions will remain unchanged.

In this context, Anthropic acts exclusively as a data processor in accordance with Article 28 of the GDPR. Responsibility for the processing remains with skillster.

Categories of Data Processed

As part of AI-assisted processing, the following personal data is transmitted to Anthropic:

For matching: Professional information from the resume (work history, qualifications, degrees, skills), results from standardized personality profile tests, written responses to questions as part of the application or onboarding process, and technical metadata from video submissions (e.g., transcripts; no biometric data).

For script generation: The complete personality profile, relevant excerpts from the resume, and the submitted questionnaire responses. This data is used to create a personalized script that authentically reflects the individual and their strengths.

Where possible, the data is pseudonymized before transmission. Direct references to names or unique identifiers are only transmitted if this is technically necessary for the respective function.

Legal Bases for Processing

Depending on the context, processing is based on the following legal bases under the GDPR:

  • Art. 6(1)(a) GDPR (Consent): If special categories of data are processed or if the processing goes beyond what is necessary for the performance of the contract, we obtain explicit consent.
  • Art. 6(1)(b) GDPR (Performance of a Contract): The processing is necessary for the provision of our service—AI-powered career and recruiting support.
  • Art. 6(1)(f) GDPR (Legitimate Interest): To the extent that we use AI for quality assurance and the further development of our matching algorithms, we rely on our legitimate interest, which outweighs the interests of the data subjects.

If special categories of personal data within the meaning of Article 9 of the GDPR are processed (e.g., psychological profile characteristics), this is done exclusively on the basis of explicit consent pursuant to Article 9(2)(a) of the GDPR.

Purposes of Processing

The data provided is processed exclusively for the following purposes:

  • Matching: Analysis and comparison of candidate profiles with job requirements to enable the most accurate recommendation possible.
  • Job posting generation: Automated drafting of job postings based on the identified requirement profiles and matching results.
  • Script generation: Creation of a personalized text that serves as the basis for a video self-presentation or a job interview.

Any use of the transmitted data by Anthropic for its own training purposes is contractually prohibited. Anthropic processes the data exclusively to provide the commissioned service within the scope of API usage.

Data Transfer to Third Countries

Anthropic is headquartered in the United States. Data transfers are carried out on the basis of appropriate safeguards in accordance with Article 46 of the GDPR, specifically based on the Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework, provided that Anthropic has joined it. We have entered into a data processing agreement with Anthropic that meets the requirements of Article 28 of the GDPR.

Retention Period

We transmit data to the Anthropic API exclusively in the context of individual requests (so-called “stateless” processing). By default, Anthropic stores API requests and responses for up to 30 days for the purposes of abuse prevention and technical support, unless a shorter period has been contractually agreed upon. Anthropic does not store or analyze the data beyond this period. On our end, we store the results of AI processing (matching results, generated scripts, job postings) in accordance with the general retention periods set forth in this Privacy Policy.

Automated Decision-Making

AI-powered matching serves exclusively as a decision-making aid. There is no fully automated decision-making within the meaning of Art. 22 of the GDPR that produces legal or similarly significant effects on data subjects.

Rights of Data Subjects

Data subjects may exercise the rights set forth in Chapter 2 of this Privacy Policy (right of access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent) with us at any time . In the event of a withdrawal of consent, the relevant AI functions can no longer be used. Results that have already been processed remain unaffected by this, provided that another legal basis justifies further processing.

7. Use of HeyGen (Creation of the AI Strengths Video)

Provider and Purpose

To create the strengths video, we use the HeyGen service provided by HeyGen Technology Inc., 12130 Millennium Drive, Suite 300, Los Angeles, CA 90094, USA (“HeyGen”). HeyGen uses your photo and voice recordings to generate a lip-synced video featuring your original voice. A video recording is not required.

Processed Data

  • the photo (portrait) you uploaded,
  • your voice recordings for the individual sequences of the AI script,
  • technical metadata (e.g., time of creation).

Process

You upload your photo and record the sequences as voice messages. The recordings are first stored on our server and then transmitted to HeyGen to generate the video. The finished video is displayed to you on skillster and can be shared as a link (see Chapter 2, “Sharing via Link”).

Legal Basis

The processing of your photo and voice is based on your explicit consent (Art. 6(1)(a) GDPR). Your photo and voice are used solely to create a digital representation of you, not to uniquely identify you. To the extent that biometric data within the meaning of Art. 9 GDPR is nevertheless processed, this is done on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR. You may withdraw your consent at any time. In this case, your strengths video will be deleted.

Transfer to HeyGen and Third Countries

HeyGen stores and processes data in the United States. HeyGen is certified under the EU-U.S. Data Privacy Framework, on the basis of which the transfer takes place. HeyGen’s privacy policy (https://www.heygen.com/privacy) also applies to processing by HeyGen. Under these provisions, HeyGen may also use content to improve its services and AI models.

Retention Period

Photos, voice recordings, and videos remain stored on skillster until you delete them or your profile. After that, the backup retention periods specified in Chapter 1 apply. Until the transition described below takes effect, HeyGen’s privacy policy governs the retention period for data stored with HeyGen.

Planned Transition

We are currently preparing a direct technical connection to HeyGen with a separate data processing agreement. We will provide information about the transition in this Privacy Policy.

8. Payment Providers

PayPal

On our website, we offer, among other options, payment via PayPal. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you select payment via PayPal, the payment information you enter will be transmitted to PayPal. The transmission of your data to PayPal is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing necessary for the performance of a contract). You have the option to revoke your consent to data processing at any time. Withdrawal does not affect the lawfulness of data processing operations that took place in the past.

If you have any questions regarding data protection, please contact us at any time at the address provided in the legal notice.