Privacy policy

This policy explains what personal data changemaker.cv processes, for what purposes, on which legal bases, and what rights you have. It is written to be read — if anything is unclear, write to [email protected].

1. Controller

The controller responsible for data processing on changemaker.cv is:

Company

Loistava Holding UG (haftungsbeschränkt)

Address

Asternring 9
15732 Schulzendorf, Germany

Represented by

Antti Savolainen (Managing Director)

E-mail

[email protected]

Full company details are in the Impressum.

2. Summary in plain words

• We run a jobs index hosted in the EU. You can browse every vacancy without an account, and every listing links to the hiring organization's official application — applications never pass through us.
• An account needs exactly one piece of data: your e-mail address. Sign-in works with a magic link, so we never store passwords.
• Your page is private until you publish it. You decide what becomes public, and you can unpublish or delete it at any time.
• Analytics runs on EU servers (PostHog EU). We show no ads, sell no personal data, and build no advertising profiles.

3. Data we process, by context

Visitors

When you open the site, our hosting infrastructure processes the technical data every web server needs: your IP address, browser and device information (user agent), the requested URL, the referring page and a timestamp. These server and CDN logs are used to deliver the site, keep it secure and diagnose faults; they are short-lived. We also record pseudonymous product-analytics events (see section 9).

Account holders

To create an account we process your e-mail address, the sign-in links we send to it, sign-in timestamps and a session cookie that keeps you signed in. There are no passwords.

Page authors

If you build a page, we process the content you add to it: profile text, photo URLs, projects, experience, skills and — if you choose to record or upload one — a short video introduction, which is processed and streamed by Mux. An unpublished page is not accessible to anyone but you; a published page is public at your chosen address (changemaker.cv/p/your-slug) until you unpublish or delete it.

Job seekers browsing the index

Browsing and searching the index requires nothing beyond the visitor data above. We never receive your applications, CVs or cover letters — those go directly to the hiring organization on its own site.

Employers submitting a job

If you submit a vacancy for listing, we process the contact details you provide with the submission so that we can review and publish it and reach you with questions.

Correspondence

If you write to us, we process your e-mail address and the content of your message for as long as needed to handle the matter.

4. Purposes and legal bases

• Contract (Art. 6(1)(b) GDPR). Providing your account, hosting and displaying your page, and — once online checkout opens — running the premium subscription.
• Legitimate interests (Art. 6(1)(f) GDPR). Operating and securing the index (server logs, abuse prevention), aggregating publicly posted vacancies from official career sites, and measuring how the product is used so we can improve it.
• Consent (Art. 6(1)(a) GDPR). Where we ask for it — for example for analytics where consent is required. You can withdraw consent at any time with effect for the future.

On the balancing of interests behind the index: the vacancy data we aggregate is professional information that hiring organizations have published on their official career sites precisely so that candidates can find it. Indexing it and linking back to the source serves that same purpose, has minimal impact on the persons concerned, and is subject to the removal process described in section 11.

5. Recipients and processors

We use a small set of infrastructure providers, bound by data processing agreements, to run the service:

Our pages carry verification meta tags for Google Search and Bing; these are static markup and involve no data processing. Beyond the providers above, we disclose personal data only if the law requires it. We do not share data with advertisers or data brokers, and we do not sell personal data.

6. International transfers

Our primary infrastructure serves from the EU, and the database is hosted in Frankfurt, Germany. Where a provider is a US company or processes data in the United States (Vercel, Supabase, Mux, Resend, Inngest), transfers are safeguarded by the EU standard contractual clauses under Art. 46(2)(c) GDPR or, where the provider holds a valid certification, an applicable adequacy decision.

7. Retention

• Account data — kept until you delete your account.
• Your page — unpublished pages are never public; page content is deleted when you delete it or your account.
• Videos — kept until you replace or remove them; uploads that exceed the permitted length are deleted automatically.
• Server logs — short-lived and rotated within a few weeks.
• Vacancy listings — delisted when the vacancy expires or disappears from its source; incidental personal data in listings is removed on request (section 11).
• Correspondence — kept as long as needed to handle the matter, plus any statutory retention periods.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data rectified (Art. 16),
• have data erased (Art. 17),
• have processing restricted (Art. 18),
• receive your data in a portable format and transmit it elsewhere (Art. 20),
• object to processing based on legitimate interests (Art. 21) — note that we do no direct marketing, so there is none to object to, and
• withdraw any consent at any time with effect for the future (Art. 7(3)).

To exercise any of these rights, write to [email protected]. You also have the right to complain to a data protection supervisory authority — for example the one at your habitual residence or place of work. The authority competent for our seat is the state commissioner for data protection of Brandenburg (Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg).

9. Cookies and analytics

We use two kinds of browser storage. First, strictly necessary authentication cookies (the Supabase session) that keep signed-in users signed in; these are set only when you use an account and cannot be switched off while you are signed in. Second, PostHog analytics — first-party and hosted in the EU — which may use cookies or localStorage to measure how the product is used (pages viewed, features used). We use this to understand and improve the service, not to advertise, and the data is not shared with ad networks. There are no third-party advertising cookies.

If you prefer not to be included in analytics, tell us at [email protected] or block or delete cookies and site data in your browser settings — the site keeps working either way.

10. Third-party links

Every listing links to the hiring organization's official career site, and pages may link to other external sites. Once you leave changemaker.cv, the privacy policy of the site you visit applies. We are not responsible for the data practices of external sites.

11. Personal data in job listings

Vacancy texts published by hiring organizations occasionally contain personal data — for example the name or e-mail address of a contact person. This data originates from the organization's own official publication, which we index and reproduce with a link to the source. If you are such a person and would like your data removed from our index, write to [email protected] — we honour removal requests. Note that removal from our index does not affect the original publication on the organization's site.

12. Security

All traffic to and from changemaker.cv is encrypted in transit (TLS). Data is hosted in EU regions, access to production systems follows a least-access principle, and sign-in is passwordless — so there is no password database to lose.

13. Children

The service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

14. Changes to this policy

When we change this policy, we publish the new version here with an updated date. If a change materially affects account holders, we will notify you by e-mail before it takes effect.

Questions, objections and removal requests: [email protected] · Loistava Holding UG (haftungsbeschränkt), Asternring 9, 15732 Schulzendorf, Germany.