Privacy Policy

Controller (Art. 4 No. 7 GDPR)

1. Overview

This policy explains how Bildungly processes personal data when you visit bildungly.de, use the Career Advisor, import LinkedIn information, request a course brief or consent to contact by a selected training provider. We process data under the GDPR, BDSG and TDDDG. Please do not submit third-party data without authority or special-category data such as health, religion or political beliefs unless strictly necessary.

2. Data processed when visiting the website

When you access the site, our hosting and delivery systems receive technical data such as IP address, request time, requested URL, referrer, browser/device information and error or security events. Processing is necessary to deliver, secure and troubleshoot the Service (Art. 6(1)(f) GDPR). Infrastructure logs are kept only for the period required for operations, security and abuse prevention, then deleted or anonymised unless a security incident or legal duty requires longer retention.

3. AI advisor and chat

For each advisor request, your messages, structured advisory case, preferences, relevant course context and any imported profile information are sent to our Supabase Edge Function and processed transiently to return an answer. Google Gemini generates conversational and recommendation text. If semantic retrieval is enabled, OpenAI may process a bounded search representation to create an embedding. The legal basis is Art. 6(1)(b) GDPR for the service you request. Our application does not intentionally store raw chat transcripts in the server database; operational logs contain request and performance metadata rather than message content.

4. Browser storage

The browser stores your language, chat transcript, advisory case, shortlist context and consent choice in local storage so you can continue the experience. An imported LinkedIn profile and interface preferences are stored in session storage. Chat data remains until you select New chat or clear site data; session data normally ends when the browser session closes. This storage is necessary for features you request (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR). Analytics storage is described separately below.

5. Optional LinkedIn enrichment

If you submit a LinkedIn profile URL, we send its public handle to LinkdAPI to retrieve public profile details such as roles, education, skills and languages. We hash the handle and cache the compact returned profile in Supabase for up to 24 hours to improve reliability; the profile is also kept in your browser session. The legal basis is Art. 6(1)(b) GDPR. Sharing LinkedIn is optional and you may instead describe your background in the chat. Bildungly is not affiliated with LinkedIn.

6. Service providers and international transfers

We use Supabase for database and Edge Function infrastructure hosted in the EU, Google Gemini for generated advisor text, OpenAI for semantic embeddings where enabled, LinkdAPI for optional LinkedIn enrichment, Resend for course-brief email delivery and PostHog for product analytics. They receive only the data required for their function and act under their applicable data-processing terms. Processing may involve countries outside the EEA. Where no adequacy decision applies, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses (Art. 46 GDPR), supplemented where required.

7. Analytics, cookies and session recording

PostHog receives pageviews, interaction events, technical device information and event properties. Before consent or after a refusal, PostHog uses memory-only mode: Bildungly does not ask PostHog to write a cookie or cross-session identifier, but the event request and IP address are still processed. We rely on our legitimate interest in understanding aggregate use and improving the Service (Art. 6(1)(f) GDPR); no analytics information is stored on your device in this mode. You may object through the controller contact above. If you accept analytics, PostHog additionally stores cookies/local-storage identifiers, links activity across sessions, captures page-leave events and enables session recording. Input values and content expressly marked as private are masked. The legal bases are your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. To withdraw or change consent, clear Bildungly site data in your browser and reload the page; PostHog then returns to memory-only mode. This does not affect earlier lawful processing. We do not use advertising cookies or sell analytics data.

8. Course briefs and provider introductions

When you request follow-up for a selected course, we process your name, email, phone number, selected course, language, source, consent timestamp and a concise structured summary of your career goal, professional background, skills, motivations, priorities, voucher status and learning constraints. We store this lead in Supabase, use Resend to email the course brief to you and, based on your explicit consent (Art. 6(1)(a) GDPR), may share it with that specifically named provider so it can contact you. We do not send the provider your raw chat transcript or full LinkedIn profile. The provider becomes an independent controller for its follow-up. We do not send your data to the Agentur für Arbeit or Jobcenter.

9. Purposes, recipients and legal obligations

We process data to provide requested features (Art. 6(1)(b) GDPR), operate and secure the Service and conduct memory-only analytics (Art. 6(1)(f)), fulfil legal duties (Art. 6(1)(c)) and carry out provider introductions or persistent analytics only with consent (Art. 6(1)(a)). Recipients are the processors listed above, the one provider you selected after consent, and public authorities only where legally required. We do not sell personal data or intentionally provide chat/profile data to train general-purpose third-party AI models.

10. Retention

LinkedIn cache entries are reused for no more than 24 hours. Browser chat remains until reset or site data is cleared; session data normally ends with the browser session. Lead and consent records are retained while the requested introduction or follow-up remains active and afterwards only as needed to document consent, handle objections or establish, exercise or defend legal claims. Operational and analytics data follow the provider configuration and are deleted or anonymised when no longer needed for their stated purposes. Mandatory legal retention or an active incident may require longer storage.

11. Your rights

You may request access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time for the future (Art. 7(3)). Contact the controller using the address above. You may also complain to a supervisory authority (Art. 77), including the Berlin Commissioner for Data Protection and Freedom of Information.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service or to legal requirements. The current version is always available on this page.